H3C Technologies H3C SecPath F1000-E - Manual (Page 222)

197
2. Configuring periodic refresh of dynamic client entries
A DHCP client unicasts a DHCP-RELEASE message to the DHCP server when releasing its dynamically
obtained IP address. The DHCP relay agent simply conveys the message to the DHCP server and does
not remove the IP-to-MAC binding. To solve this problem, the periodic refresh of dynamic client entries
feature is introduced.
With this feature, the DHCP relay agent uses the IP address of a client and the MAC address of the DHCP
relay interface to periodically send a DHCP-REQUEST message to the DHCP server.
• If the server returns a DHCP-ACK message or does not return any message within a specified
interval, the DHCP relay agent ages out the client entry.
• If the server returns a DHCP-NAK message, the relay agent keeps the client entry.
To configure periodic refresh of dynamic client entries:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable periodic refresh
of dynamic client entries. dhcp relay security refresh
enable Optional.
Enabled by default.
3. Configure the refresh
interval. dhcp relay security tracker
{ interval | auto }
Optional.
auto by default. (auto interval is calculated
by the relay agent according to the number
of client entries.)
3. Enabling unauthorized DHCP server detection
Unauthorized DHCP servers may assign wrong IP addresses to DHCP clients.
With unauthorized DHCP servers detection enabled, the DHCP relay agent checks whether a request
contains Option 54 (Server Identifier Option). If yes, the DHCP relay agent records the IP address in the
option, which is the IP address of the DHCP server that assigned an IP address to the DHCP client, and
records the receiving interface. The administrator can use this information to check for unauthorized
DHCP servers.
To enable unauthorized DHCP server detection:
Step Command Remarks
1. Enter system view. system-view N/A
2. Enable unauthorized DHCP
server detection.
dhcp relay server-detect Disabled by default.
NOTE:
The relay agent logs a DHCP server only once.
4. Enabling DHCP starvation attack protection
A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using
different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of
the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail
to work because of exhaustion of system resources.
• To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source
MAC addresses, you can limit the number of ARP entries that a Layer 3 interface can learn or MAC