Home » Dell Manuals » Hubs & Switches » Dell N3200-ON » Manual Viewer

Dell N3200-ON Networking N-Series Switches User Guide version 6.8.0 - Page 1006

What Is DHCP Snooping?, Dynamic Host Configuration Protocol DHCP Snooping is a security feature

Get Dell N3200-ON PDF manuals and user guides

Add to My Manuals
Save this manual to your list of manuals

Page 1006 highlights

What Is DHCP Snooping? Dynamic Host Configuration Protocol (DHCP) Snooping is a security feature that monitors DHCP messages between a DHCP client and DHCP server to accomplish the following tasks: • Ensure that only authorized DHCP clients are able to utilize the network. • Designate which ports are connected to trusted DHCP servers and drop DHCP messages from servers connected to untrusted ports • Build an authorized DHCP client bindings database with entries that consist of the following information: • MAC address • IP address • VLAN ID • Client port • Type (static or dynamic) • Lease time Entries in the bindings database are considered to be authorized network clients. DHCP clients can exchange messages with DHCP servers connected via trusted ports. DHCP client messages are never forwarded to untrusted ports. DHCP snooping can be enabled on VLANs, and the trust status (trusted or untrusted) is specified on individual physical ports or LAGS that are members of the VLAN. When a port or LAG is configured as untrusted, it could potentially be used to launch a network attack. DHCP snooping protects against attacks on untrusted ports. DHCP servers must be reached through trusted ports. DHCP clients are configured on untrusted ports. DHCP snooping enforces the following security rules: • DHCP packets from a DHCP server (DHCPOFFER, DHCPACK, DHCPNAK, DHCPRELEASEQUERY) are dropped if they are received on an untrusted port and a warning level message is logged if invalid DHCP packet logging is enabled. DHCP client originated messages are never forwarded over untrusted ports. • DHCPRELEASE and DHCPDECLINE messages are dropped if the MAC addresses are found in the snooping database, but the binding's interface is other than the interface where the message was received. 1006 Snooping and Inspecting Traffic

Section	Page
Dell Networking N-Series Switches User's Configuration Guide	1
Contents	3
Introduction	53
About This Document	53
Audience	54
Document Conventions	54
Additional Documentation	55
Switch Feature Overview	57
System Management Features	58
Multiple Management Options	58
System Time Management	58
Log Messages	59
System Reset	59
Integrated DHCP Server	59
Management of Basic Network Information	60
IPv6 Management Features	60
Dual Software Images	60
File Management	61
Switch Database Management Templates	61
Automatic Installation of Firmware and Configuration	61
sFlow	62
SNMP Alarms and Trap Logs	62
CDP Interoperability Through ISDP	63
Remote Monitoring (RMON)	63
Stacking Features	63
Mixed and Single Series Stacking	63
Single IP Management	64
Primary Failover with Transparent Transition	64
Nonstop Forwarding on the Stack	64
Hot Add/Delete and Firmware Synchronization	64
Security Features	66
Configurable Access and Authentication Profiles	66
Password-Protected Management Access	66
Strong Password Enforcement	66
TACACS+ Client	66
RADIUS Support	67
SSH/SSL	67
Inbound Telnet Control	67
Denial of Service	67
Port Protection	68
Captive Portal	69
802.1X Authentication (IEEE 802.1X)	69
MAC-Based 802.1X Authentication	70
802.1X Monitor Mode	70
Port Security	71
Access Control Lists (ACLs)	71
Time-Based ACLs	71
IP Source Guard (IPSG)	72
DHCP Snooping	72
Dynamic ARP Inspection	72
Protected Ports (Private VLAN Edge)	72
Green Technology Features	73
Energy Detect Mode	73
Energy Efficient Ethernet	73
Power Utilization Reporting	73
Power over Ethernet (PoE) Features	74
PD Detection	74
Legacy (Reduced Capacitor) Detection	74
Classification	74
Port Start Up	75
Overload Detection and Port Shutdown	75
Disconnect Detection	75
IC Thermal Monitoring	75
Over-Temperature Protection	75
4-Pair Ports	76
IEEE 802.3bt Capability	77
PoE Port Capabilities and Power Limits	77
Key PoE Plus Features	79
Power Over Ethernet (PoE) Support	80
PoE Plus Support	80
PoE 60W Support	81
Powered Device Detection	81
PoE Power Management Modes	81
Power Management in Guard Band	83
PoE Plus Default Settings	85
Special Mode Setting for Legacy and Non-Compliant PDs	85
Switching Features	87
Flow Control Support (IEEE 802.3x)	87
Head of Line Blocking Prevention	87
Jumbo Frames Support	87
Auto-MDI/MDIX Support	87
VLAN-Aware MAC-based Switching	88
Back Pressure Support	88
Auto-negotiation	88
Storm Control	88
Port Mirroring	89
Static and Dynamic MAC Address Tables	89
Link Layer Discovery Protocol (LLDP)	89
Link Layer Discovery Protocol (LLDP) for Media Endpoint Devices	90
Connectivity Fault Management (IEEE 802.1ag)	91
Cisco Protocol Filtering	91
DHCP Layer-2 Relay	91
Virtual Local Area Network Supported Features	92
VLAN Support	92
Port-Based VLANs	92
IP Subnet-based VLAN	92
MAC-based VLAN	92
IEEE 802.1v Protocol-Based VLANs	92
Voice VLAN	93
GARP and GVRP Support	93
Guest VLAN	93
Unauthorized VLAN	93
Double VLANs	93
Spanning Tree Protocol Features	94
Spanning Tree Protocol (STP)	94
Spanning Tree Port Settings	94
Rapid Spanning Tree	94
Multiple Spanning Tree	94
Bridge Protocol Data Unit (BPDU) Guard	95
BPDU Filtering	95
RSTP-PV and STP-PV	95
Link Aggregation Features	96
Link Aggregation	96
Link Aggregate Control Protocol (LACP)	97
Multi-Switch LAG (MLAG)	97
Routing Features	98
Address Resolution Protocol (ARP) Table Management	98
VLAN Routing	98
IP Configuration	98
Open Shortest Path First (OSPF)	99
Border Gateway Protocol (BGP)	99
Virtual Routing and Forwarding	99
BOOTP/DHCP Relay Agent	100
IP Helper and DHCP Relay	100
Routing Information Protocol	100
Router Discovery	100
Routing Table	100
Virtual Router Redundancy Protocol (VRRP)	101
Tunnel and Loopback Interfaces	101
IPv6 Routing Features	102
IPv6 Configuration	102
IPv6 Routes	102
OSPFv3	102
DHCPv6	102
Quality of Service (QoS) Features	103
Differentiated Services (DiffServ)	103
Class Of Service (CoS)	103
Auto Voice over IP (VoIP)	103
Internet Small Computer System Interface (iSCSI) Optimization	104
Layer-2 Multicast Features	104
MAC Multicast Support	104
IGMP Snooping	104
IGMP Snooping Querier	105
MLD Snooping	105
Multicast VLAN Registration	105
Layer-3 Multicast Features	106
Distance Vector Multicast Routing Protocol	106
Internet Group Management Protocol	106
IGMP Proxy	106
Protocol Independent Multicast—Dense Mode	106
Protocol Independent Multicast—Sparse Mode	107
Protocol Independent Multicast—Source Specific Multicast	107
Protocol Independent Multicast IPv6 Support	107
MLD/MLDv2 (RFC2710/RFC3810)	107
Hardware Overview	109
Dell Networking N1108EP-ON Series Switch Hardware	109
N1108EP-ON Series Front Panel	109
N1108EP-ON Series Power Supply	112
N1108EP-ON Series Ventilation System	112
N1108EP-ON Series Thermal Shutdown	112
N1108EP-ON Series LED Definitions	112
Power Consumption for N1108EP-ON Series PoE Switches	115
N1108EP-ON Series Wall Installation	116
Dell Networking N1500 Series Switch Hardware	118
N1500 Series Front Panel	118
N1500 Series Back Panel	121
N1500 Series LED Definitions	123
Power Consumption for N1500 Series PoE Switches	125
Dell Networking N2200-ON Series Switch Hardware	127
N2200-ON Series Front Panel	127
N2200-ON Series Rear Panel	127
N2200X-ON Series Switch Ports	128
N2200-ON Series Console Port	129
N2200-ON Series USB Port	130
N2200-ON Series Reset Button	130
N2200-ON Series Port and System LEDs	130
N2200-ON Series LED of Management Unit in Stack and Stack Number Display	130
N2200-ON Series Power Supplies	131
N2200-ON Series LED Definitions	132
Dell Networking N3200-ON Series Switch Hardware	136
N3200-ON Series Front Panel	136
N3200-ON Series Rear Panel	136
N3200-ON Series Switch Ports	137
N3200-ON Series Console Port	138
N3200-ON Series USB Port	139
N3200-ON Series Reset Button	139
N3200-ON Series Port and System LEDs	140
N3200-ON Series LED of Management Unit in Stack and Stack Number Display	140
N3200-ON Series Power Supplies	140
N3200-ON Series LED Definitions	141
Switch MAC Addresses	154
Cables and Optics	156
Using Dell OpenManage Switch Administrator	159
About Dell OpenManage Switch Administrator	159
Starting the Application	160
Understanding the Interface	161
Using the Switch Administrator Buttons and Links	163
Defining Fields	164
Understanding the Device View	164
Using the Device View Port Features	164
Using the Device View Switch Locator Feature	165
Using the Command-Line Interface	167
Accessing the Switch Through the CLI	167
Console Connection	167
Telnet Connection	168
Understanding Command Modes	169
Entering CLI Commands	171
Using the Question Mark to Get Help	171
Using Command Completion	172
Entering Abbreviated Commands	172
Negating Commands	172
Command Output Paging	172
Understanding Error Messages	173
Recalling Commands from the History Buffer	173
Default Settings	175
Setting the IP Address and Other Basic Network Information	179
IP Address and Network Information Overview	179
What Is the Basic Network Information?	179
Why Is Basic Network Information Needed?	180
How Is Basic Network Information Configured?	181
What Is Out-of-Band Management and In-Band Management?	181
Default Network Information	184
Configuring Basic Network Information (Web)	185
Out-of-Band Interface	185
IP Interface Configuration (Default VLAN IP Address)	186
Route Entry Configuration (Switch Default Gateway)	188
Domain Name Server	190
Default Domain Name	191
Host Name Mapping	192
Dynamic Host Name Mapping	193
Configuring Basic Network Information (CLI)	194
Enabling the DHCP Client on the OOB Port	194
Enabling the DHCP Client on the Default VLAN	194
Managing DHCP Leases	195
Configuring Static Network Information on the OOB Port	196
Configuring Static Network Information on the Default VLAN	197
Configuring and Viewing Additional Network Information	198
Basic Network Information Configuration Examples	200
Configuring Network Information Using the OOB Port	200
Configuring Network Information Using the Serial Interface	201
Stacking	205
Stacking Overview	205
Dell Networking Stacking Compatibility	208
How is the Management Unit in the Stack Selected?	209
Adding a Switch to the Stack	210
Removing a Switch from the Stack	211
How is the Firmware Updated on the Stack?	212
What is Stacking Standby?	212
What is Nonstop Forwarding?	213
Switch Stack MAC Addressing and Stack Design Considerations	216
NSF Network Design Considerations	217
Why is Stacking Needed?	217
Default Stacking Values	217
Managing and Monitoring the Stack (Web)	219
Unit Configuration	219
Stack Summary	220
Stack Firmware Synchronization	221
Supported Switches	222
Stack Port Summary	223
Stack Port Counters	224
Stack Port Diagnostics	224
NSF Summary	225
Checkpoint Statistics	226
Managing the Stack (CLI)	227
Configuring Stack Member, Stack Port, SFS and NSF Settings	227
Viewing and Clearing Stacking and NSF Information	229
Connecting to the Management Console from a Stack Member	230
Stacking and NSF Usage Scenarios	230
Basic Failover	230
Preconfiguring a Stack Member	232
NSF in the Data Center	234
NSF and VoIP	235
NSF and DHCP Snooping	236
NSF and the Storage Access Network	237
NSF and Routed Access	239
Authentication, Authorization, and Accounting	241
AAA Introduction	241
Methods	242
Method Lists	243
Access Lines	244
Enabling SSH Access	245
Access Lines (AAA)	246
Access Lines (Non-AAA)	246
Authentication	247
Authentication Access Types	247
Authentication Manager	248
Using RADIUS	257
Using TACACS+	262
Dynamic ACL Overview	264
Downloadable ACLs	271
Authentication Examples	272
Public Key SSH Authentication Example	281
Associating a User With an SSH Key	290
Multi-Factor Authentication	292
Authorization	293
Exec Authorization Capabilities	293
Authorization Examples	295
RADIUS Change of Authorization	297
TACACS Authorization	301
Accounting	305
RADIUS Accounting	305
IEEE 802.1X	308
What is IEEE 802.1X?	308
What are the 802.1X Port Authentication Modes?	309
What are Authentication Host Modes	310
What is MAC Authentication Bypass?	311
What is the Role of 802.1X in VLAN Assignment?	313
What is Monitor Mode?	317
How Does the Authentication Server Assign DiffServ Policy or ACLs?	319
What is the Internal Authentication Server?	319
Default 802.1X Values	320
Configuring IEEE 802.1X (Web)	321
Captive Portal	345
Captive Portal Overview	345
Default Captive Portal Behavior and Settings	353
Configuring Captive Portal (Web)	355
Configuring Captive Portal (CLI)	371
Captive Portal Configuration Example	377
In Case Of Problems in Captive Portal Deployment	381
Network Access Control	382
Pre-enrollment State	382
Walled Garden	382
Media Access Control Security	384
Monitoring and Logging System Information	385
System Monitoring Overview	385
What System Information Is Monitored?	385
Why Is System Information Needed?	386
Where Are Log Messages Sent?	386
What Are the Severity Levels?	387
What Are the System Startup and Operation Logs?	387
What Is the Log Message Format?	388
What Factors Should Be Considered When Configuring Logging?	390
Default Log Settings	391
Monitoring System Information and Configuring Logging (Web)	392
Device Information	392
System Health	394
System Resources	395
Unit Power Usage History	396
Integrated Cable Test for Copper Cables	397
Optical Transceiver Diagnostics	398
Log Global Settings	399
RAM Log	400
Log File	402
SYSLOG Server	402
Email Alert Global Configuration	405
Email Alert Mail Server Configuration	405
Email Alert Subject Configuration	407
Email Alert To Address Configuration	408
Email Alert Statistics	408
Monitoring System Information and Configuring Logging (CLI)	410
Viewing System Information and Enabling the Locator LED	410
Running Cable Diagnostics	410
Configuring Local Logging	412
Configuring Remote Logging	413
Configuring Mail Server Settings	414
Configuring Email Alerts for Log Messages	415
Logging Configuration Examples	417
Configuring Local and Remote Logging	417
Configuring Email Alerting	420
Managing General System Settings	423
System Settings Overview	423
Why Does System Information Need to Be Configured?	424
What Are SDM Templates?	425
Why is the System Time Needed?	427
How Does SNTP Work?	427
Default General System Information	428
Configuring General System Settings (Web)	429
System Information	429
CLI Banner	432
SDM Template Preference	433
Clock	434
SNTP Global Settings	435
SNTP Authentication	436
SNTP Server	438
Summer Time Configuration	441
Time Zone Configuration	442
Card Configuration	443
Slot Summary	444
Supported Cards	445
Power Over Ethernet Global Configuration	446
Power Over Ethernet Unit Configuration	447
Power Over Ethernet Interface Configuration	448
Configuring System Settings (CLI)	450
Configuring System Information	450
Configuring the Banner	451
Managing the SDM Template	452
Configuring SNTP Authentication and an SNTP Server	452
Setting the System Time and Date Manually	454
Viewing Slot Information	455
Configuring PoE Settings	455
General System Settings Configuration Examples	458
Configuring System and Banner Information	458
Configuring SNTP/NTP	461
Configuring the Time Manually	463
SNMP	465
SNMP Overview	465
What Is SNMP?	465
What Are SNMP Traps?	466
Why Is SNMP Needed?	467
Default SNMP Values	467
Configuring SNMP (Web)	469
SNMP Global Parameters	469
SNMP View Settings	470
Access Control Group	472
SNMPv3 User Security Model (USM)	474
Communities	477
Notification Filter	479
Notification Recipients	480
Trap Flags	482
OSPFv2 Trap Flags	483
OSPFv3 Trap Flags	484
Trap Log	485
Configuring SNMP (CLI)	487
Configuring the SNMPv3 Engine ID	487
Configuring SNMP Views, Groups, and Users	488
Configuring Communities	491
Configuring SNMP Notifications (Traps and Informs)	493
SNMP Configuration Examples	496
Configuring SNMPv1 and SNMPv2	496
Configuring SNMP Management Station Access	497
Configuring SNMPv3	498
Images and File Management	503
Image and File Management Overview	503
What Files Can Be Managed?	503
Why Is File Management Needed?	505
What Methods Are Supported for File Management?	508
What Factors Should Be Considered When Managing Files?	508
How Is the Running Configuration Saved?	511
Managing Images and Files (Web)	512
File System	512
Active Images	513
USB Flash Drive	514
File Download	515
File Upload	517
Copy Files	519
Managing Images and Files (CLI)	520
Downloading and Activating a New Image (TFTP)	521
Managing Files in Internal Flash	522
Managing Files on a USB Flash Device	523
Uploading a Configuration File (SCP)	524
Managing Configuration Scripts (SFTP)	525
SCP Server	526
File and Image Management Configuration Examples	527
Upgrading the Firmware	527
Managing Configuration Scripts	530
Managing Files by Using the USB Flash Drive	532
DHCP and USB Auto-Configuration	535
Auto Configuration Overview	535
What Is USB Auto Configuration?	536
What Files Does USB Auto Configuration Use?	536
How Does USB Auto Configuration Use the Files on the USB Device?	537
What Is the Setup File Format?	539
What Is the DHCP Auto Configuration Process?	539
Monitoring and Completing the DHCP Auto Configuration Process	546
What Are the Dependencies for DHCP Auto Configuration?	547
Default Auto Configuration Values	548
Managing Auto Configuration (Web)	549
Auto-Install Configuration	549
Managing Auto Configuration (CLI)	550
Managing Auto Configuration	550
Auto Configuration Example	551
Enabling USB Auto Configuration and Auto Image Download	551
Enabling DHCP Auto Configuration and Auto Image Download	552
Easy Firmware Upgrade/Downgrade via USB	554
Monitoring Switch Traffic	555
Traffic Monitoring Overview	555
What is sFlow Technology?	555
What is RMON?	558
What is Port Mirroring?	559
Port Mirroring Behaviors	561
RSPAN	563
Remote Capture	564
Why is Traffic Monitoring Needed?	565
Default Traffic Monitoring Values	565
Monitoring Switch Traffic (Web)	566
sFlow Agent Summary	566
sFlow Receiver Configuration	567
sFlow Sampler Configuration	568
sFlow Poll Configuration	569
Interface Statistics	570
Etherlike Statistics	571
GVRP Statistics	572
EAP Statistics	573
Utilization Summary	574
Counter Summary	575
Switchport Statistics	576
RMON Statistics	577
RMON History Control Statistics	577
RMON History Table	580
RMON Event Control	581
RMON Event Log	583
RMON Alarms	584
Port Statistics	586
LAG Statistics	587
Port Mirroring	588
Monitoring Switch Traffic (CLI)	590
Configuring sFlow	590
Configuring RMON	592
Viewing Statistics	594
Configuring Port Mirroring	595