H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 57)

46
• If the server returns a DHCP-NAK message, the relay agent keeps the entry.
Follow these steps to configure periodic refresh of dynamic client entries:
To do… Use the command… Remarks
Enter system view system-view —
Enable periodic refresh of
dynamic client entries dhcp relay security refresh
enable
Optional
Enabled by default.
Configure the refresh interval
dhcp relay security tracker
{ interval | auto }
Optional
auto by default. (auto interval is calculated
by the relay agent according to the number
of client entries.)
Enabling unauthorized DHCP server detection
Unauthorized DHCP servers may assign wrong IP addresses to DHCP clients.
With unauthorized DHCP servers detection enabled, the DHCP relay agent checks whether a request
contains Option 54 (Server Identifier Option). If yes, the DHCP relay agent records the IP address in the
option, which is the IP address of the DHCP server that assigned an IP address to the DHCP client, and
records the receiving interface. The administrator can use this information to check for unauthorized
DHCP servers.
Follow these steps to enable unauthorized DHCP server detection:
To do… Use the command… Remarks
Enter system view system-view —
Enable unauthorized DHCP server
detection
dhcp relay server-detect
Required
Disabled by default.
NOTE:
The relay agent logs a DHCP server only once. After the information of recorded DHCP servers is cleared,
the relay agent will re-record server information by using this mechanism.
Enabling DHCP starvation attack protection
A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using
different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of
the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail
to work because of exhaustion of system resources.
• To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source
MAC addresses, you can limit the number of ARP entries that a Layer 3 interface can learn or MAC
addresses that a Layer 2 port can learn. You can also configure an interface that has learned the
maximum MAC addresses to discard packets whose source MAC addresses are not in the MAC
address table.
• To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source
MAC address, enable MAC address check on the DHCP relay agent. With this function enabled,
the DHCP relay agent compares the chaddr field of a received DHCP request with the source MAC