Edge-Core AS5700-54X, Справочное руководство CLI, Страница: 294 / 1116

Chapter 8
| General Security Measures
DHCPv6 Snooping
– 294 –
wall. When DHCPv6 snooping is enabled globally by this command, and
enabled on a VLAN interface by the
ipv6 dhcp snooping vlan command, DHCP
messages received on an untrusted interface (as specified by the no ipv6 dhcp
snooping trust command) from a device not listed in the DHCPv6 snooping
table will be dropped.
◆
When enabled, DHCPv6 messages entering an untrusted interface are filtered
based upon dynamic entries learned via DHCPv6 snooping.
◆
Table entries are only learned for trusted interfaces. Each entry includes a MAC
address, IPv6 address, lease time, binding type, VLAN identifier, and port
identifier.
◆
When DHCPv6 snooping is enabled, the rate limit for the number of DHCPv6
messages that can be processed by the switch is 100 packets per second. Any
DHCPv6 packets in excess of this limit are dropped.
◆
Filtering rules are implemented as follows:
■
If global DHCPv6 snooping is disabled, all DHCPv6 packets are forwarded.
■
If DHCPv6 snooping is enabled globally, and also enabled on the VLAN
where the DHCPv6 packet is received, DHCPv6 packets are forwarded for a
trusted port as described below.
■
If DHCPv6 snooping is enabled globally, and also enabled on the VLAN
where the DHCP packet is received, but the port is
not trusted , DHCP
packets are processed according to message type as follows:
DHCP Client Packet
■
Request: Update entry in binding cache, recording client’s DHCPv6
Unique Identifier (DUID), server’s DUID, Identity Association (IA) type, IA
Identifier, and address (4 message exchanges to get IPv6 address), and
forward to trusted port.
■
Solicit: Add new entry in binding cache, recording client’s DUID, IA type,
IA ID (2 message exchanges to get IPv6 address with rapid commit
option, otherwise 4 message exchanges), and forward to trusted port.
■
Decline: If no matching entry is found in binding cache, drop this
packet.
■
Renew, Rebind, Release, Confirm: If no matching entry is found in
binding cache, drop this packet.
■
If the DHCPv6 packet is not a recognizable type, it is dropped.
If a DHCPv6 packet from a client passes the filtering criteria above, it will
only be forwarded to trusted ports in the same VLAN.