Home » Dell Manuals » Hubs & Switches » Dell PowerConnect B-RX » Manual Viewer

Dell PowerConnect B-RX BigIron RX Series Configuration Guide v02.7.03 - Page 1055

Inspecting and Tracking DHCP Packets, Dynamic ARP inspection, ARP attacks

View all Dell PowerConnect B-RX manuals

Add to My Manuals
Save this manual to your list of manuals

Page 1055 highlights

Chapter Inspecting and Tracking DHCP Packets 35 The features described in this chapter were introduced in software release 02.3.00 for the BigIron RX Series devices. For enhanced network security, you can configure the Brocade device to inspect and keep track of Dynamic Host Configuration Protocol (DHCP) assignments. To do so, use the following features. TABLE 162 Chapter contents Description See page Dynamic ARP Inspection - Intercepts and examines all ARP request and response page 983 packets in a subnet, and blocks all packets that have invalid IP to MAC address bindings DHCP Snooping - Filters replay DHCP packets from untrusted ports (those connected to page 988 host ports), and allows DHCP packets from trusted ports (those connected to DHCP servers) IP Source Guard - Permits traffic with valid source IP addresses only, which is learned page 992 from Dynamic ARP Inspection or DHCP snooping Dynamic ARP inspection NOTE This feature is only supported on Layer 3 code. Dynamic ARP Inspection (DAI) enables the Brocade device to intercept and examine all ARP request and response packets in a subnet and discard those packets with invalid IP to MAC address bindings. DAI can prevent common man-in-the-middle (MiM) attacks such as ARP cache poisoning, and disallow mis-configuration of client IP addresses. ARP attacks ARP provides IP communication within a Layer 2 broadcast domain by mapping an IP address to a MAC address. Before a host can talk to another host, it must map the IP address to a MAC address first. If the host does not have the mapping in its ARP table, it sends an ARP request to resolve the mapping. All computers on the subnet will receive and process the ARP requests, and the host whose IP address matches the IP address in the request will send an ARP reply. An ARP poisoning attack can target hosts, switches, and routers connected to the Layer 2 network by poisoning the ARP caches of systems connected to the subnet and by intercepting traffic intended for other hosts on the subnet. For instance, a malicious host can reply to an ARP request with its own MAC address, thereby causing other hosts on the same subnet to store this information in their ARP tables or replace the existing ARP entry. Furthermore, a host can send BigIron RX Series Configuration Guide 983 53-1001986-01

Section	Page
Contents	3
About This Document	41
Audience	41
Supported hardware and software	41
List of supported features	41
Unsupported features	44
What’s new in this document	45
Enhancements in release 02.7.03	45
Enhancements in release 02.7.02	46
Enhancements in release 02.7.00	47
Enhancements in release 02.6.00	48
Enhancements in patch release 02.5.00c	51
Enhancements in patch release 02.5.00b	51
Enhancements in release 02.5.00	51
Enhancements in patch release 02.4.00c	52
Enhancements in release 02.4.00	53
Enhancements in patch release 02.3.00a	57
Enhancements in release 02.3.00	58
Enhancements in release 02.2.01	63
Enhancements in release 02.2.00g	67
Enhancements in release 02.2.00	68
Document conventions	69
Text formatting	69
Command syntax conventions	69
Notes, cautions, and danger notices	69
Notice to the reader	70
Related publications	70
Getting technical help or reporting errors	70
Web access	71
E-mail and telephone access	71
Getting Started with the Command Line Interface	73
In this chapter	73
Logging on through the CLI	73
On-line help	74
Command completion	74
Scroll control	74
Line editing commands	75
EXEC commands	75
Global level	76
CONFIG commands	76
Accessing the CLI	79
Navigating among command levels	80
CLI command structure	80
Searching and filtering output	81
Allowable characters for LAG names	85
Syntax shortcuts	86
Saving configuration changes	86
Getting Familiar With the BigIron RX Series Switch Management Applications	87
How to manage BigIron RX Series switch	87
Logging on through the CLI	87
On-line help	88
Command completion	88
Scroll control	88
Line editing commands	88
Searching and filtering output from CLI commands	89
Allowable characters for LAG names	93
Logging on through the Web Management Interface	94
Web Management Interface	95
Logging on through IronView Network Manager	96
Using a Redundant Management Module	97
How management module redundancy works	97
Management module redundancy overview	97
Management module switchover	98
Switchover implications	99
Management module redundancy configuration	101
Changing the default active Chassis slot	101
Managing management module redundancy	101
File synchronization between the active and standby management modules	101
Manually switching over to the standby management module	104
Rebooting the active and standby management modules	104
Monitoring management module redundancy	105
Determining management module status	105
Displaying temperature information	106
Displaying switchover information	106
Flash memory and PCMCIA flash card file management commands	108
Management focus	109
Flash memory file system	110
PCMCIA flash card file system	111
Wildcards	112
Formatting a flash card	112
Determining the current management focus	113
Switching the management focus	113
Displaying a directory of the files	114
Displaying the contents of a file	116
Displaying the hexadecimal output of a file	117
Creating a subdirectory	117
Removing a subdirectory	119
Renaming a file	120
Changing the read-write attribute of a file	120
Deleting a file	121
Recovering (“undeleting”) a file	122
Appending a file to another file	123
Copying files using the copy command	123
Copying files using the cp command	127
Loading the software	128
Saving configuration changes	130
File management messages	131
System Monitoring Service	131
Securing Access to Management Functions	135
Securing access methods	135
Restricting remote access to management functions	137
Using ACLs to restrict remote access	137
Restricting remote access to the device to specific IP addresses	140
Specifying the maximum number of login attempts for Telnet access	141
Restricting remote access to the device to specific VLAN IDs	141
Disabling specific access methods	143
Setting passwords	144
Setting a Telnet password	144
Setting passwords for management privilege levels	145
Recovering from a lost password	147
Displaying the SNMP community string	147
Disabling password encryption	148
Specifying a minimum password length	148
Setting up local user accounts	148
Configuring a local user account	149
Username, password and login rules	151
Configuring the strict password feature	152
Configuring SSL security for the Web Management Interface	154
Enabling the SSL server on the device	155
Importing digital certificates and RSA private key files	155
Generating an SSL certificate	156
Configuring TACACS and TACACS+ security	156
How TACACS+ differs from TACACS	156
TACACS and TACACS+ authentication, authorization, and accounting	157
TACACS and TACACS+ configuration considerations	160
Enabling SNMP to configure TACACS and TACACS	161
Identifying the TACACS and TACACS+ servers	161
Specifying different servers for individual AAA functions	162
Setting optional TACACS and TACACS+ parameters	162
Configuring authentication-method lists for TACACS and TACACS+	164
Configuring TACACS+ authorization	166
Configuring TACACS+ accounting	169
Configuring an interface as the source for all TACACS and TACACS+ packets	170
Displaying TACACS and TACACS+ statistics and configuration information	170
Configuring RADIUS security	172
RADIUS authentication, authorization, and accounting	172
RADIUS configuration considerations	175
RADIUS configuration procedure	175
Configuring Brocade-specific attributes on the RADIUS server	176
Enabling SNMP to configure RADIUS	177
Identifying the RADIUS server to the BigIron RX	177
Specifying different servers for individual AAA functions	178
Setting RADIUS parameters	178
Configuring authentication-method lists for RADIUS	179
Configuring RADIUS authorization	180
Configuring RADIUS accounting	182
Configuring an interface as the source for all RADIUS packets	183
Displaying RADIUS configuration information	184
Configuring authentication-method lists	185
Configuration considerations for authentication- method lists	186
Examples of authentication-method lists	187
Configuring Basic Parameters	189
Entering system administration information	189
Configuring Simple Network Management Protocol traps	190
Specifying an SNMP trap receiver	190
Specifying a Single trap source	191
Setting the SNMP Trap holddown time	191
Disabling SNMP traps	192
Disabling Syslog messages and traps for CLI access	193
Configuring an interface as source for all Telnet packets	194
Cancelling an outbound Telnet session	195
Configuring an interface as the source for all TFTP packets	195
Configuring an interface as the source for Syslog packets	195
Specifying a Simple Network Time Protocol (SNTP) server	196
Setting the system clock	198
New Daylight Saving Time (DST)	199
Configuring CLI banners	200
Setting a message of the day banner	200
Setting a privileged EXEC CLI level banner	201
Displaying a message on the console when an incoming Telnet session is detected	201
Configuring terminal display	202
Checking the length of terminal displays	202
Enabling or disabling routing protocols	202
Displaying and modifying system parameter default settings	203
Enabling or disabling Layer 2 switching	205
CAM partitioning for the BigIron RX	206
Re-distributing CAM allocations	206
Nexthop table	207
Changing the MAC age time	208
Configuring static ARP entries	208
Pinging an IPv4 address	209
Configuring Interface Parameters	211
Assigning a port name	211
Assigning an IP address to a port	211
Speed/Duplex negotiation	212
Disabling or re-enabling a port	213
Changing the default Gigabit negotiation mode	213
Changing the negotiation mode	214
Disabling or re-enabling flow control	214
Specifying threshold values for flow control	214
Locking a port to restrict addresses	215
Wait for all cards feature	215
Port transition hold timer	216
Port flap dampening	216
Modifying port priority (QoS)	217
Assigning a mirror port and monitor ports	218
Configuration guidelines for monitoring traffic	218
Configuring port mirroring and monitoring	218
Monitoring an individual trunk port	219
Mirror ports for Policy-Based Routing (PBR) traffic	220
About hardware-based PBR	220
Configuring mirror ports for PBR traffic	221
Displaying mirror and monitor port configuration	221
Enabling WAN PHY mode support	222
Configuring IP	223
Overview of configuring IP	223
The IP packet flow	223
ARP cache table	224
Static ARP table	224
IP Route table	225
IP forwarding cache	226
Basic IP parameters and defaults	226
When parameter changes take effect	227
IP global parameters	227
IP interface parameters	230
Configuring IP parameters	231
Configuring IP addresses	231
Changing the network mask display to prefix format	234
Configuring the default gateway	234
GRE IP tunnel	235
IPv6 over IPv4 tunnels in hardware	240
Configuring Domain Name Server (DNS) resolver	244
Adding host names to the DNS cache table	245
Configuring packet parameters	249
Changing the encapsulation type	249
Setting maximum frame size per PPCR	250
Changing the MTU	251
Changing the router ID	252
Specifying a single source interface for Telnet, TACACS, TACACS+, or RADIUS packets	253
Configuring an interface as the source for Syslog packets	255
IP fragmentation protection	256
IP option attack protection	256
IP receive access list	256
Configuring ARP parameters	257
How ARP works	257
Rate limiting ARP packets	258
Applying a rate limit to ARP packets on an interface	259
Clearing the rate limit for ARP packets	260
Changing the ARP aging period	260
Creating a floating static ARP entry	262
Static route ARP validation check	263
Configuring forwarding parameters	264
Disabling ICMP messages	266
Disabling ICMP redirect messages	268
Configuring static routes	269
Static route tagging	273
Configuring a default network route	278
Configuring IP load sharing	279
Default route ECMP	282
IP receive access list	283
Configuring IRDP	284
Configuring UDP broadcast and IP helper parameters	286
Configuring BootP/DHCP forwarding parameters	288
Displaying IP information	290
Displaying IP interface information	293
Displaying interface name in Syslog	294
Displaying ARP entries	294
Displaying the forwarding cache	296
Displaying the IP route table	298
Clearing IP routes	301
Displaying IP traffic statistics	301
Displaying TCP traffic statistics	304
Link Aggregation	307
Link aggregation overview	307
LAG formation rules	307
LAG load sharing	310
Migration from a pre-02.6.00 trunk or LACP configuration	311
Configuration of a LAG	312
Creating a Link Aggregation Group (LAG)	312
Deploying a LAG	315
Commands available under LAG once it is deployed	316
Configuring ACL-based mirroring	316
Disabling ports within a LAG	316
Enabling ports within a LAG	317
Monitoring an individual LAG port	317
Assigning a name to a port within a LAG	318
Enabling sFlow forwarding on a port within a LAG	318
Setting the sFlow sampling rate for a port within a LAG	318
Displaying LAG information	319
Displaying LAG statistics	322
Configuring LLDP	325
Terms used in this chapter	325
LLDP overview	325
Benefits of LLDP	326
General operating principles	327
Operating modes	327
LLDP packets	327
TLV support	328
MIB support	331
Syslog messages	331
Configuring LLDP	331
Configuration notes and considerations	332
Enabling and disabling LLDP	332
Changing a port’s LLDP operating mode	333
Specifying the maximum number of LLDP neighbors	334
Enabling LLDP SNMP notifications and Syslog messages	335
Specifying the minimum time between SNMP traps and Syslog messages	335
Changing the minimum time between LLDP transmissions	336
Changing the interval between regular LLDP transmissions	336
Changing the holdtime multiplier for transmit TTL	337
Changing the minimum time between port reinitializations	337
LLDP TLVs advertised by the Brocade device	338
Displaying LLDP statistics and configuration settings	344
LLDP configuration summary	344
LLDP statistics	345
LLDP neighbors	346
LLDP neighbors detail	347
LLDP configuration details	349
Resetting LLDP statistics	349
Configuring Uni-Directional Link Detection (UDLD)	351
Configuration considerations	352
Configuring UDLD	352
Changing the keepalive interval	352
Changing the keepalive retries	352
Displaying UDLD information	353
Displaying information for all ports	353
Displaying link-keepalive information	353
Displaying information for a single port	354
Clearing UDLD statistics	356
VLANs	357
Overview of Virtual Local Area Networks (VLANs)	357
Tagged, untagged, and dual-mode ports	357
Protocol-based VLANs	359
VLAN configuration rules	360
VLAN ID range	360
Tagged VLANs	360
VLAN hierarchy	360
Multiple VLAN membership rules	360
Layer 2 control protocols on VLANs	361
Configuring port-based VLANs	361
VLAN byte accounting	362
Strictly or explicitly tagging a port	364
Assigning or changing a VLAN priority	364
Assigning a different ID to the default VLAN	364
Configuring protocol-based VLANs	365
Configuring an MSTP instance	366
Configuring virtual routing interfaces	366
Bridging and routing the same protocol simultaneously on the same device	367
Integrated Switch Routing (ISR)	368
VLAN groups	369
Configuring a VLAN group	369
Configuring super aggregated VLANs	371
Configuring aggregated VLANs	373
Complete CLI examples	374
Configuring 802.1q-in-q tagging	377
Configuration rules	378
Enabling 802.1Q-in-Q tagging	379
Example configuration	379
Configuring 802.1q tag-type translation	380
Configuration rules	382
Enabling 802.1q tag-type translation	383
Private VLANs	384
Implementation notes	385
Configuration notes	385
Configuring a private VLAN	386
Enabling broadcast, multicast or unknown unicast traffic to the private VLAN	388
CLI example for Figure 30	388
Other VLAN features	389
Allocating memory for more VLANs or virtual routing interfaces	389
Hardware flooding for Layer 2 multicast and broadcast packets	389
Unknown unicast flooding on VLAN ports	390
Flow based MAC learning	390
Configuring uplink ports within a port-based VLAN	391
Configuring control protocols in VLANs	391
Other configuration options	392
Displaying VLAN information	392
Displaying VLAN information	392
Displaying VLAN information for specific ports	393
Displaying VLAN status and port types	393
Displaying VLAN group information	395
Transparent firewall mode	395
Enabling a transparent firewall	395
Configuring Spanning Tree Protocol	397
IEEE 802.1D Spanning Tree Protocol (STP)	397
Enabling or disabling STP	397
Default STP bridge and port parameters	398
Changing STP bridge parameters	399
Changing STP port parameters	400
STP root guard	400
Spanning Tree Protocol (STP) BPDU guard	401
Displaying STP information	402
IEEE Single Spanning Tree (SSTP)	408
SSTP defaults	408
Enabling SSTP	409
Displaying SSTP information	410
PVST/PVST+ compatibility	410
Overview of PVST and PVST+	411
VLAN tags and dual mode	411
Enabling PVST+ support	412
Displaying PVST+ support information	412
Configuration examples	413
SuperSpan™	415
Customer ID	416
BPDU forwarding	416
Configuring SuperSpan	421
Configuring Rapid Spanning Tree Protocol	425
Overview of Rapid Spanning Tree Protocol	425
Bridges and bridge port roles	425
Assignment of port roles	426
Ports on Switch 1	427
Ports on Switch 2	427
Ports on Switch 3	427
Ports Switch 4	428
Edge ports and edge port roles	428
Point-to-point ports	429
Bridge port states	429
Edge port and non-edge port states	430
Changes to port roles and states	430
State machines	430
Handshake mechanisms	431
Convergence in a simple topology	441
Convergence at start up	442
Convergence after a link failure	444
Convergence at link restoration	445
Convergence in a complex RSTP topology	446
Propagation of topology change	449
Compatibility of RSTP with 802.1D	452
Configuring RSTP parameters	453
Enabling or disabling RSTP in a port-based VLAN	453
Enabling or disabling RSTP on a single spanning tree	454
Disabling or enabling RSTP on a port	454
Changing RSTP bridge parameters	454
Changing port parameters	455
Fast port span	456
Fast uplink span	458
Displaying RSTP information	460
Metro Ring Protocol (MRP) Phase 1 and 2	465
Metro Ring Protocol (MRP) phase 1	465
MRP rings without shared interfaces	466
Ring initialization	467
How ring breaks are detected and healed	470
Master VLANs and customer VLANs in a topology group	472
Configuring MRP	474
Adding an MRP ring to a VLAN	475
Changing the hello and preforwarding times	476
MRP phase 2	476
Ring initialization for shared interfaces	478
How ring breaks are detected and healed between shared interfaces	478
Selection of master node	479
RHP processing in rings with shared interfaces	479
Normal flow	480
Flow when a link breaks	481
Configuring MRP with shared interfaces	481
Using MRP diagnostics	482
Enabling MRP diagnostics	482
Displaying MRP diagnostics	483
Displaying MRP information	483
Displaying topology group information	483
Displaying ring information	484
MRP CLI example	485
Commands on switch A (master node)	486
Commands on switch B	486
Commands on switch C	487
Commands on switch D	487
Virtual Switch Redundancy Protocol (VSRP)	489
Overview of Virtual Switch Redundancy Protocol (VSRP)	489
Layer 2 and Layer 3 redundancy	490
Master election and failover	490
Configuring basic VSRP parameters	495
Enabling Layer 3 VSRP	496
Configuring optional VSRP parameters	496
Disabling VSRP on a VRID	496
Configuring authentication	496
Configuring a VRID IP address	497
VSRP fast start	498
Changing the backup priority	499
Saving the timer values received from the master	499
VSRP slow start	500
Changing the Time-To-Live (TTL)	500
Changing the hello interval	501
Changing the dead interval	501
Changing the backup hello state and interval	501
Changing the hold-down interval	502
Changing the default track priority	502
Specifying a track port	503
Disabling or re-enabling backup pre-emption	503
Port transition hold timer	503
Clearing VSRP information	504
VSRP and MRP signaling	504
Displaying VSRP information	506
Displaying VRID information	506
Displaying a summary of VSRP information	508
Displaying VSRP packet statistics for VSRP	509
Displaying the active interfaces for a VRID	510
Topology Groups	511
Topology overview	511
Master VLAN and member VLANs	511
Master VLANs and customer VLANs in MRP	512
Control ports and free ports	512
Configuration considerations	512
Configuring a topology group	513
Displaying topology group information	513
Displaying topology group information	513
Configuring VRRP and VRRPE	515
Overview of VRRP	515
Standard VRRP	515
Brocade enhancements of VRRP	517
Overview of VRRPE	519
VRRP and VRRPE parameters	522
Configuring parameters specific to VRRP	524

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166
1,167
1,168
1,169
1,170
1,171
1,172
1,173
1,174
1,175
1,176
1,177
1,178
1,179
1,180
1,181
1,182
1,183
1,184
1,185
1,186
1,187
1,188
1,189
1,190
1,191
1,192
1,193
1,194
1,195
1,196
1,197
1,198
1,199
1,200
1,201
1,202
1,203
1,204
1,205
1,206
1,207
1,208
1,209
1,210
1,211
1,212
1,213
1,214
1,215
1,216
1,217
1,218
1,219
1,220
1,221
1,222
1,223
1,224
1,225
1,226
1,227
1,228
1,229
1,230
1,231
1,232
1,233
1,234
1,235
1,236
1,237
1,238
1,239
1,240
1,241
1,242
1,243
1,244
1,245
1,246
1,247
1,248
1,249
1,250
1,251
1,252
1,253
1,254
1,255
1,256
1,257
1,258
1,259
1,260
1,261
1,262
1,263
1,264
1,265
1,266
1,267
1,268
1,269
1,270
1,271
1,272
1,273
1,274
1,275
1,276
1,277
1,278
1,279
1,280
1,281
1,282
1,283
1,284
1,285
1,286
1,287
1,288
1,289
1,290
1,291
1,292
1,293
1,294
1,295
1,296
1,297
1,298
1,299
1,300
1,301
1,302
1,303
1,304
1,305
1,306
1,307
1,308
1,309
1,310
1,311
1,312
1,313
1,314
1,315
1,316
1,317
1,318
1,319
1,320
1,321
1,322
1,323
1,324
1,325
1,326
1,327
1,328
1,329
1,330
1,331
1,332
1,333
1,334
1,335
1,336
1,337
1,338
1,339
1,340
1,341
1,342
1,343
1,344
1,345
1,346
1,347
1,348
1,349
1,350
1,351
1,352
1,353
1,354
1,355
1,356
1,357
1,358
1,359
1,360
1,361
1,362
1,363
1,364
1,365
1,366
1,367
1,368
1,369
1,370
1,371
1,372
1,373
1,374
1,375
1,376
1,377
1,378
1,379
1,380
1,381
1,382
1,383
1,384
1,385
1,386
1,387
1,388
1,389
1,390
1,391
1,392
1,393
1,394
1,395
1,396
1,397
1,398
1,399
1,400
1,401
1,402
1,403
1,404
1,405
1,406
1,407
1,408
1,409
1,410
1,411
1,412
1,413
1,414
1,415
1,416
1,417
1,418
1,419
1,420
1,421
1,422
1,423
1,424

Match case Limit results 1 per page

BigIron RX Series Configuration Guide

983

53-1001986-01

Chapter

Inspecting and Tracking DHCP Packets

The features described in this chapter were introduced in software release 02.3.00 for the BigIron

RX Series devices.

For enhanced network security, you can configure the

Brocade

device to inspect and keep track of

Dynamic Host Configuration Protocol (DHCP) assignments. To do so, use the following features.

Dynamic ARP inspection

NOTE

This feature is only supported on Layer 3 code.

Dynamic ARP Inspection (DAI) enables the

Brocade

device to intercept and examine all ARP

request and response packets in a subnet and discard those packets with invalid IP to MAC

address bindings. DAI can prevent common man-in-the-middle (MiM) attacks such as ARP cache

poisoning, and disallow mis-configuration of client IP addresses.

ARP attacks

ARP provides IP communication within a Layer 2 broadcast domain by mapping an IP address to a

MAC address. Before a host can talk to another host, it must map the IP address to a MAC address

first. If the host does not have the mapping in its ARP table, it sends an ARP request to resolve the

mapping. All computers on the subnet will receive and process the ARP requests, and the host

whose IP address matches the IP address in the request will send an ARP reply.

An ARP poisoning attack can target hosts, switches, and routers connected to the Layer 2 network

by poisoning the ARP caches of systems connected to the subnet and by intercepting traffic

intended for other hosts on the subnet. For instance, a malicious host can reply to an ARP request

with its own MAC address, thereby causing other hosts on the same subnet to store this

information in their ARP tables or replace the existing ARP entry. Furthermore, a host can send

TABLE 162

Chapter contents

Description

See page

Dynamic ARP Inspection

– Intercepts and examines all ARP request and response

packets in a subnet, and blocks all packets that have invalid IP to MAC address bindings

page 983

DHCP Snooping

– Filters replay DHCP packets from untrusted ports (those connected to

host ports), and allows DHCP packets from trusted ports (those connected to DHCP

servers)

page 988

IP Source Guard

– Permits traffic with valid source IP addresses only, which is learned

from Dynamic ARP Inspection or DHCP snooping

page 992