140
{
Limit the number of ARP entries that a Layer 3 interface can learn.
{
Set the MAC learning limit for a Layer 2 port, and disable unknown frame forwarding when
the MAC learning limit is reached.
•
To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same
source MAC address, you can enable MAC address check on the DHCP relay agent. The
DHCP relay agent compares the
chaddr
field of a received DHCP request with the source MAC
address in the frame header. If they are the same, the DHCP relay agent forwards the request
to the DHCP server. If not, the relay agent discards the request.
Enable MAC address check only on the DHCP relay agent directly connected to the DHCP clients. A
DHCP relay agent changes the source MAC address of DHCP packets before sending them.
A MAC address check entry has an aging time. When the aging time expires, both of the following
occur:
•
The entry ages out.
•
The DHCP relay agent rechecks the validity of DHCP requests sent from the MAC address in
the entry.
To enable MAC address check:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Set the aging time for MAC
address check entries.
dhcp relay check mac-address
aging-time
time
The default aging time is 30
seconds.
This command takes effect
only after you execute the
dhcp relay check
mac-address
command.
3.
Enter the interface view.
interface
interface-type
interface-number
N/A
4.
Enable MAC address check.
dhcp relay check mac-address
By default, MAC address
check is disabled.
Enabling DHCP server proxy on the DHCP relay agent
The DHCP server proxy feature isolates DHCP servers from DHCP clients and protects DHCP
servers against attacks.
Upon receiving a response from the server, the DHCP server proxy modifies the server's IP address
as the relay interface's IP address before sending out the response. The DHCP client takes the
DHCP relay agent as the DHCP server.
To configure DHCP server proxy on the DHCP relay agent:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface interface-type
interface-number
N/A
3.
Enable DHCP relay agent and
DHCP server proxy on the
interface.
dhcp select relay proxy
By default, the interface
operates in DHCP server mode.
