HP FlexNetwork NJ5000, Руководство пользователя

Страница: 249 / 475

237
Configuring DHCP snooping
DHCP snooping works between the DHCP client and server. It guarantees that DHCP clients obtain
IP addresses from authorized DHCP servers. Also, it records IP-to-MAC bindings of DHCP clients
(called DHCP snooping entries) for security purposes.
Overview
DHCP snooping defines trusted and untrusted ports to make sure clients obtain IP addresses only
from authorized DHCP servers.
•
Trusted—A trusted port can forward DHCP messages correctly to make sure the clients get IP
addresses from authorized DHCP servers.
•
Untrusted—An untrusted port discards received DHCP-ACK and DHCP-OFFER messages to
prevent unauthorized servers from assigning IP addresses.
DHCP snooping reads DHCP-ACK messages received from trusted ports and DHCP-REQUEST
messages to create DHCP snooping entries. A DHCP snooping entry includes the MAC and IP
addresses of a client, the port that connects to the DHCP client, and the VLAN. The DHCP snooping
entries can be used by ARP detection to prevent ARP attacks. For more information about ARP
detection, see "
Configuring ARP attack protection ".
Application of trusted ports
Configure ports facing the DHCP server as trusted ports, and configure other ports as untrusted
ports.
As shown in Figure 244 , configure the DHCP snooping device's port that is connected to the DHCP
server as a trusted port. The trusted port forwards response messages from the DHCP server to the
client. The untrusted port connected to the unauthorized DHCP server discards incoming DHCP
response messages.
Figure 244 Trusted and untrusted ports
In a cascaded network as shown in Figure 245 , configure each DHCP snooping device's ports
connected to other DHCP snooping devices as trusted ports. To save system resources, you can
disable the untrusted ports that are not directly connected to DHCP clients from generating DHCP
snooping entries.