SMC Networks TigerAccess SMC7816M Manuale Utente Scaricare il pdf (Pagina 186)

100

101

LIENT

ECURITY

7-8

CLI – This example configures a static source-guard binding on port 1.

Configuring DHCP Snooping

The addresses assigned to DHCP clients on unsecure ports can be

carefully controlled using the dynamic bindings registered with DHCP

Snooping (or using the static bindings configured with IP Source Guard).

DHCP snooping allows a switch to protect a network from rogue DHCP

servers or other devices which send port-related information to a DHCP

server. This information can be useful in tracking an IP address back to a

physical port.

Command Usage

• Network traffic may be disrupted when malicious DHCP messages are

received from an outside source. DHCP snooping is used to filter DHCP

messages received on an unsecure interface from outside the network or

firewall. When DHCP snooping is enabled globally on the switch, and on

a specific VLAN interface, DHCP messages received on an untrusted

interface from a device not listed in the DHCP snooping table are

dropped.

• Table entries are only learned for trusted interfaces. An entry is added or

removed dynamically to the DHCP snooping table when a client receives

or releases an IP address from a DHCP server. Each entry includes a

MAC address, IP address, lease time, VLAN identifier, and port

identifier.

• The rate limit for the number of DHCP messages that can be processed

by the switch is 100 packets per second. Any DHCP packets in excess of

this limit are dropped.

Console(config)#ip source-guard binding 11-22-33-44-55-66 vlan 1

192.168.0.99 interface ethernet 1/5 23-14

Console(config)#interface ethernet 1/5

Console(config-if)#ip source-guard sip 23-11

Console(config)#

1 2 ... 181 182 183 184 185 186 187 188 189 190 191 ... 961 962

Commenti su questo manuale

Nessun commento

SMC Networks TigerAccess SMC7816M Manuale Utente Pagina 186

Commenti su questo manuale