LevelOne FGP-1072, User Manual

Page: 52 / 301

52
3-2. DHCP Snooping
Function name:
Config
Function description:
The addresses assigned to DHCP clients on unsecure ports can be carefully
controlled using the dynamic bindings registered with DHCP Snooping. DHCP
snooping allows a switch to protect a network from rogue DHCP servers or
other devices which send port-related information to a DHCP server. This
information can be useful in tracking an IP address back to a physical port.
When DHCP servers are allocating IP addresses to the clients on the LAN,
DHCP snooping can be configured on LAN switches to harden the security on
the LAN to only allow clients with specific IP/MAC addresses to have access
to the network.
DHCP snooping is a series of layer 2 techniques. It works with information
from a DHCP server to:
•
Track the physical location of hosts.
•
Ensure that hosts only use the IP addresses assigned to them.
•
Ensure that only authorized DHCP servers are accessible.
In short, DHCP snooping ensures IP integrity on a Layer 2 switched domain.
With DHCP snooping, only a whitelist of IP addresses may access the network.
The whitelist is configured at the switch port level, and the DHCP server
manages the access control. Only specific IP addresses with specific MAC
addresses on specific ports may access the IP network.
DHCP snooping also stops attackers from adding their own DHCP servers to
the network. An attacker could set up a server to wreak havoc in the network
or even control it.
Config
Trust Group
DHCP Snooping
Lease List
Counter