207
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Configure the DHCPv6
snooping device to back
up DHCPv6 snooping
entries to a file.
ipv6 dhcp snooping
binding database
filename
{
filename
|
url
url
[
username
username
[
password
{
cipher
|
simple
}
string
] ] }
By default, the DHCPv6 snooping device
does not back up the DHCPv6 snooping
entries.
With this command executed, the DHCPv6
snooping device backs up DHCPv6 snooping
entries immediately and runs auto backup.
This command automatically creates the file if
you specify a non-existent file.
3.
(Optional.) Manually save
DHCPv6 snooping entries
to the backup file.
ipv6 dhcp
snooping
binding
database
update
now
N/A
4.
(Optional.) Set the waiting
time after a DHCPv6
snooping entry change for
the DHCPv6 snooping
device to update the
backup file.
ipv6 dhcp
snooping
binding
database
update
interval
interval
The default waiting time is 300 seconds.
The waiting period starts when a DHCPv6
snooping entry is learned, updated, or
removed. The DHCPv6 snooping device
updates the backup file when the specified
waiting period is reached. All changed entries
during the period will be saved to the backup
file.
If no DHCPv6 snooping entry changes, the
backup file is not updated.
Setting the maximum number of DHCPv6
snooping entries
Perform this task to prevent the system resources from being overused.
To set the maximum number of DHCPv6 snooping entries:
Step Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type
interface-number
N/A
3.
Set the maximum number
of DHCPv6 snooping
entries for the interface to
learn.
ipv6
dhcp
snooping
max-learning-num
max-number
By default, the number of DHCPv6
snooping entries for an interface to
learn is not limited.
Enabling DHCPv6-REQUEST check
About DHCPv6-REQUEST check
Perform this task to use the DHCPv6-REQUEST check feature to protect the DHCPv6 server
against DHCPv6 client spoofing attacks. Attackers can forge DHCPv6-RENEW messages to renew
leases for legitimate DHCPv6 clients that no longer need the IP addresses. The forged messages
disable the victim DHCPv6 server from releasing the IP addresses. Attackers can also forge
DHCPv6-DECLINE or DHCPv6-RELEASE messages to terminate leases for legitimate DHCPv6
clients that still need the IP addresses.