Juniper JUNOS OS 10.3 - SOFTWARE, Manual

Page: 2959 / 3946

Example: Configuring MAC Limiting to Protect the Switch from DHCP Starvation
Attacks
In a DHCP starvation attack, an attacker floods an Ethernet LAN with DHCP requests
from spoofed (counterfeit) MAC addresses. The switch's trusted DHCP server or servers
cannot keep up with the requests and can no longer assign IP addresses and lease times
to legitimate DHCP clients on the switch. Requests from those clients are either dropped
or directed to a rogue DHCP server set up by the attacker.
This example describes how to configure MAC limiting, a port security feature, to protect
the switch against DHCP starvation attacks:
•
Requirements on page 2863
•
Overview and Topology on page 2863
• Configuration on page 2864
• Verification on page 2865
Requirements
This example uses the following hardware and software components:
• One EX Series switch
•
Junos OS Release 9.0 or later for EX Series switches
•
A DHCP server to provide IP addresses to network devices on the switch
Before you configure MAC limiting, a port security feature, to mitigate DHCP starvation
attacks, be sure you have:
• Connected the DHCP server to the switch.
• Configured the VLAN employee-vlan on the switch. See “Example: Setting Up Bridging
with Multiple VLANs for EX Series Switches” on page 1312.
Overview and Topology
Ethernet LANs are vulnerable to address spoofing and DoS attacks on network devices.
This example describes how to protect the switch against one common type of attack,
a DHCP starvation attack.
This example shows how to configure port security features on an EX3200-24P switch
that is connected to a DHCP server.
The setup for this example includes the VLAN
employee-vlan
on the switch. The procedure
for creating that VLAN is described in the topic “Example: Setting Up Bridging with Multiple
VLANs for EX Series Switches” on page 1312. That procedure is not repeated here. Figure
71 on page 2864 illustrates the topology for this example.
2863 Copyright © 2010, Juniper Networks, Inc.
Chapter 94: Examples: Port Security Configuration