Dell Networking S6000 Uživatelský manuál stáhnout pdf (Strana 307)

100

101

The DHCP binding table associates addresses the DHCP servers assign, with the port on which the

requesting client is attached. When you enable IP source address validation on a port, the system verifies

that the source IP address is one that is associated with the incoming port. If an attacker is impostering as

a legitimate client, the source address appears on the wrong ingress port and the system drops the

packet. Likewise, if the IP address is fake, the address is not on the list of permissible addresses for the

port and the packet is dropped.

To enable IP source address validation, use the following command.

NOTE: If you enable IP source guard using the ip dhcp source-address-validation

command and there are 187 entries or more in the current DHCP snooping binding table, SAV may

not be applied to all entries. To ensure that SAV is applied correctly to all entries, enable the ip

dhcp source-address-validation

command before adding entries to the binding table.

• Enable IP source address validation.

INTERFACE mode

ip dhcp source-address-validation

DHCP MAC Source Address Validation

DHCP MAC source address validation (SAV) validates a DHCP packet’s source hardware address against

the client hardware address field (CHADDR) in the payload.

Dell Networking OS ensures that the packet’s source MAC address is checked against the CHADDR field

in the DHCP header only for packets from snooped VLANs.

• Enable DHCP MAC SAV.

CONFIGURATION mode

ip dhcp snooping verify mac-address

Enabling IP+MAC Source Address Validation

The following feature is available on the S6000 platform.

IP source address validation (SAV) validates the IP source address of an incoming packet against the

DHCP snooping binding table. IP+MAC SAV ensures that the IP source address and MAC source address

are a legitimate pair, rather than validating each attribute individually. You cannot configure IP+MAC SAV

with IP SAV.

1. Allocate at least one FP block to the ipmacacl CAM region.

CONFIGURATION mode

cam-acl l2acl

2. Save the running-config to the startup-config.

EXEC Privilege mode

copy running-config startup-config

3. Reload the system.

EXEC Privilege

reload

4. Enable IP+MAC SAV.

INTERFACE mode

Dynamic Host Configuration Protocol (DHCP)

307

1 2 ... 302 303 304 305 306 307 308 309 310 311 312 ... 985 986

Komentáře k této Příručce

Žádné komentáře

Dell Networking S6000 Uživatelský manuál Strana 307

Komentáře k této Příručce

Související produkty a manuály pro Software Dell Networking S6000