Dell PowerConnect 6248 Configuration Guide - Page 56

DHCP Snooping

Get Dell PowerConnect 6248 PDF manuals and user guides View all Dell PowerConnect 6248 manuals
Add to My Manuals
Save this manual to your list of manuals

Page 56 highlights

Example #2: Viewing the DoS Configuration Information console#show dos-control SIPDIP Mode Enable First Fragment Mode Enable Min TCP Hdr Size 20 TCP Fragment Mode Enable TCP Flag Mode Disable L4 Port Mode Enable ICMP Mode Enable Max ICMP Pkt Size 512 DHCP Snooping Dynamic Host Configuration Protocol (DHCP) Snooping is a security feature that monitors DHCP messages between a DHCP client and DHCP server to: • Filter harmful DHCP messages • Build a bindings database of (MAC address, IP address, VLAN ID, port) authorized tuples. DHCP snooping is disabled globally and on all VLANs by default. Ports are untrusted by default. Network administrators can enable DHCP snooping globally and on specific VLANs. They can also configure ports within the VLAN to be trusted or untrusted. DHCP servers must be reached through trusted ports. DHCP snooping enforces the following security rules: • DHCP packets from a DHCP server (DHCPOFFER, DHCPACK, DHCPNAK, DHCPRELEASEQUERY) are dropped if received on an untrusted port. • DHCPRELEASE and DHCPDECLINE messages are dropped if for a MAC addresses in the snooping database, but the binding's interface is other than the interface where the message was received. • On untrusted interfaces, the switch drops DHCP packets with a source MAC address that does not match the client hardware address. This is a configurable option. Dynamic ARP Inspection uses the DHCP snooping bindings database to validate ARP packets. To prevent DHCP packets being used as a DoS attack when DHCP snooping is enabled, the snooping application enforces a rate limit for DHCP packets received on interfaces. DHCP snooping monitors the receive rate on each interface separately. If the receive rate exceeds a configurable limit, DHCP snooping brings down the interface. The user must do "no shutdown" on this interface to further work with that port. The user can configure both the rate and the burst interval. 56 Switching Configuration

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
56
Switching Configuration
Example #2: Viewing the DoS Configuration Information
console#show dos-control
SIPDIP Mode
....................................
Enable
First Fragment Mode
............................
Enable
Min TCP Hdr Size
...............................
20
TCP Fragment Mode
..............................
Enable
TCP Flag Mode
..................................
Disable
L4 Port Mode
...................................
Enable
ICMP Mode
......................................
Enable
Max ICMP Pkt Size
..............................
512
DHCP Snooping
Dynamic Host Configuration Protocol (DHCP) Snooping is a security feature that monitors DHCP
messages between a DHCP client and DHCP server to:
•
Filter harmful DHCP messages
•
Build a bindings database of (MAC address, IP address, VLAN ID, port) authorized tuples.
DHCP snooping is disabled globally and on all VLANs by default. Ports are untrusted by default.
Network administrators can enable DHCP snooping globally and on specific VLANs. They can also
configure ports within the VLAN to be trusted or untrusted. DHCP servers must be reached through
trusted ports.
DHCP snooping enforces the following security rules:
•
DHCP packets from a DHCP server (DHCPOFFER, DHCPACK, DHCPNAK,
DHCPRELEASEQUERY) are dropped if received on an untrusted port.
•
DHCPRELEASE and DHCPDECLINE messages are dropped if for a MAC addresses in the snooping
database, but the binding's interface is other than the interface where the message was received.
•
On untrusted interfaces, the switch drops DHCP packets with a source MAC address that does not
match the client hardware address. This is a configurable option.
Dynamic ARP Inspection uses the DHCP snooping bindings database to validate ARP packets.
To prevent DHCP packets being used as a DoS attack when DHCP snooping is enabled, the snooping
application enforces a rate limit for DHCP packets received on interfaces. DHCP snooping monitors the
receive rate on each interface separately. If the receive rate exceeds a configurable limit, DHCP snooping
brings down the interface. The user must do “no shutdown” on this interface to further work with that
port. The user can configure both the rate and the burst interval.