Edge-Core ECS4660-28F, Management Manual, Page: 1127 / 2020

C
HAPTER
29
| General Security Measures
DHCPv6 Snooping
– 1127 –
C
OMMAND
M
ODE
Global Configuration
C
OMMAND
U
SAGE
◆ Network traffic may be disrupted when malicious DHCPv6 messages are
received from an outside source. DHCPv6 snooping is used to filter
DHCPv6 messages received on an unsecure interface from outside the
network or fire wall. When DHCPv6 snooping is enabled globally by this
command, and enabled on a VLAN interface by the ipv6 dhcp snooping
vlan command, DHCP messages received on an untrusted interface (as
specified by the no ipv6 dhcp snooping trust command) from a device
not listed in the DHCPv6 snooping table will be dropped.
◆ When enabled, DHCPv6 messages entering an untrusted interface are
filtered based upon dynamic entries learned via DHCPv6 snooping.
◆ Table entries are only learned for trusted interfaces. Each entry
includes a MAC address, IPv6 address, lease time, binding type, VLAN
identifier, and port identifier.
◆ When DHCPv6 snooping is enabled, the rate limit for the number of
DHCPv6 messages that can be processed by the switch is 100 packets
per second. Any DHCPv6 packets in excess of this limit are dropped.
◆
Filtering rules are implemented as follows:
■
If global DHCPv6 snooping is disabled, all DHCPv6 packets are
forwarded.
■
If DHCPv6 snooping is enabled globally, and also enabled on the
VLAN where the DHCPv6 packet is received, DHCPv6 packets are
forwarded for a trusted port as described below.
■
If DHCPv6 snooping is enabled globally, and also enabled on the
VLAN where the DHCP packet is received, but the port is not
trusted , DHCP packets are processed according to message type as
follows:
DHCP Client Packet
■
Request: Update entry in binding cache, recording client’s
DHCPv6 Unique Identifier (DUID), server’s DUID, Identity
Association (IA) type, IA Identifier, and address (4 message
exchanges to get IPv6 address), and forward to trusted port.
■
Solicit: Add new entry in binding cache, recording client’s DUID,
IA type, IA ID (2 message exchanges to get IPv6 address with
rapid commit option, otherwise 4 message exchanges), and
forward to trusted port.
■
Decline: If no matching entry is found in binding cache, drop
this packet.
■
Renew, Rebind, Release, Confirm: If no matching entry is found
in binding cache, drop this packet.
■
If the DHCPv6 packet is not a recognizable type, it is dropped.