Enabling Unauthorized Dhcp Server Detection; Enabling Dhcp Starvation Attack Protection - HP 10500 Series Configuration Manual
Layer 3 - ip services
Hide thumbs
Also See for 10500 Series:
- Security configuration manual (596 pages) ,
- Configuration manual (512 pages) ,
- Specifications (42 pages)
Table of Contents
With this feature, the DHCP relay agent uses the IP address of a client and the MAC address of the DHCP
relay interface to periodically send a DHCP-REQUEST message to the DHCP server.
If the server returns a DHCP-ACK message or does not return any message within a specific interval,
•
the DHCP relay agent ages out the entry.
If the server returns a DHCP-NAK message, the relay agent keeps the entry.
•
To configure periodic refresh of dynamic client entries:
Step
1.
Enter system view.
2.
Enable periodic refresh of
dynamic client entries.
3.
Configure the refresh interval.
Enabling unauthorized DHCP server detection
Unauthorized DHCP servers may assign wrong IP addresses to DHCP clients.
With unauthorized DHCP servers detection enabled, the DHCP relay agent checks whether a request
contains Option 54 (Server Identifier Option). If yes, the DHCP relay agent records in the option the IP
address of the DHCP server that assigned an IP address to a requesting DHCP client, and records the
receiving interface. The administrator can use this information to check for unauthorized DHCP servers.
The relay agent logs a DHCP server only once.
To enable unauthorized DHCP server detection:
Step
1.
Enter system view.
2.
Enable unauthorized DHCP
server detection.
Enabling DHCP starvation attack protection
A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using
different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of
the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail
to work because of exhaustion of system resources. The following methods are available to relieve or
prevent such attacks.
•
To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source
MAC addresses, limit the number of ARP entries that a Layer 3 interface can learn or MAC
addresses that a Layer 2 port can learn. You can also configure an interface that has learned the
maximum MAC addresses to discard packets whose source MAC addresses are not in the MAC
address table.
To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source
•
MAC address, enable MAC address check on the DHCP relay agent. The DHCP relay agent
Command
system-view
dhcp relay security refresh
enable
dhcp relay security tracker
{ interval | auto }
Command
system-view
dhcp relay server-detect
61
Remarks
N/A
Optional.
Enabled by default.
Optional.
The default is auto. The auto interval is
calculated by the relay agent according
to the number of client entries.
Remarks
N/A
Disabled by default.
Table of Contents
Troubleshooting
