How to protect DHCP using Cisco switches

Here is a simple explanation of the features that can be enabled on most Cisco switches to protect DHCP services.


Port Security
Description:
  • Count the number of MAC addresses that are seen coming from a user's switchport. If the number of MAC addresses goes above a configured limit (usually a low number), take appropriate action. This action can range from blocking any new MAC addresses to disabling the switchport.
Benefits:
  • Prevents a hacker from repeatedly spoofing their MAC address to flood the switch CAM (Content Addressable Memory) table which turns the switch into a hub, where all packets are broadcasted to all ports.

  • Prevents a hacker from "gobbling" up all available DHCP leases and leaving none for your users.

DHCP Snooping
Description:
  • This feature functions like a DHCP firewall, blocking any DHCP servers on ports that are not configured as "trusted". Only switch uplinks and DHCP server ports should be configured as trusted.
Benefits:
  • Prevents a hacker from running a rouge DHCP server and giving invalid IP address information to your users. This can be used as a DoS (Denial of Service) attack, or MitM (Man-in-the-Middle) attack.
  • Prevents users from plugging in home routers that are unknowingly running DHCP, causing your users to get bogus IP information and not be able to use the network.

IP Source Guard
Description:
  • By watching which IP addresses are assigned by DHCP, a switch can create dynamic ACL's to block all traffic except traffic from DHCP-assigned IP addresses.
Benefits:
  • Prevents a hacker from spoofing their IP address to launch an anonymous attack.

  • Prevents users from ignoring DHCP and manually configuring a static IP address.

Split-Scope DHCP
Description:
  • This is not a Cisco feature, instead it is a DHCP best practice. Split-scope involves using two DHCP servers. Each DHCP server hands out a portion (usually half) of the IP addresses in a particular network, while the other server hands out the remainder of the IP addresses in the network.
Benefits:
  • Prevents the failure of one DHCP server from disrupting DHCP services.

Comments

  1. Anonymous8/24/2008 12:54 PM

    thanks a lot
    i found my answer here!
    good luck
    A. ZALI

    ReplyDelete

Post a Comment

Popular posts from this blog

Using the Cisco console in Linux

Image
Introduction People who work with Cisco network equipment need to be able to connect to the console port on their devices. In Windows, you can simply fire up HyperTerminal to get basic access to your devices. If you are using Linux, then you need to know how this can be done with an application called Minicom . Hardware First, you are going to need a Cisco console cable , a Cisco device, and a computer. If your computer has a serial port , then you can use the standard console cable that comes with every Cisco device. If you do not have a serial port (like most new laptops), then you need to purchase a USB to Serial adapter that supports Linux. This device will allow you to use the standard Cisco cable, which has a serial port on one end. Install Minicom You can easily install Minicom by using "System > Administration > Synaptic Package Manager". Search for "minicom" and choose to install the package. Click "Apply" and Minicom should be insta...
Read more

Linux NIC teaming recommendations

Image
Introduction In my job as a network engineer, I am constantly looking for ways to increase the availability of the network. This is especially true in the data center, where services are expected to always be available. One of the ways to increase the network availability of a server is by using multiple network interfaces. This technique has many different names, but I am just going to call it NIC teaming. Purpose of NIC Teaming NIC teaming increases network availability by removing single-points-of-failure (SPOF). These SPOFs are components that will cause a service outage if they become unavailable. If we consider a single network connection from your server to your switch, we can identify quite a few SPOFs: Server NIC failure Network cable failure (such as being cut or unplugged) Network switch failure (such as a planned firmware upgrade or unplanned outage) Methods of NIC Teaming The reason I am writing this blog is to help people understand the different options for NIC team...
Read more

What it takes to make Ubuntu ready for use

I recently installed Ubuntu 6.10 on a new PC at work. In this post I will document all the steps I had to perform to get it ready for everyday use. Each step is assigned a level of difficulty, which I define below: Very Easy Step can be completed without using the command prompt Intuitive to complete Easy Step can be completed without using the command prompt May require searching to find the right place to make the change Medium Requires a single command to be entered at the command prompt Requires searching internet resources to find the solution Hard Requires multiple commands to be entered at the command prompt Requires searching internet resources to find the solution Very Hard Requires multiple commands to be entered at the command prompt Requires searching internet resources to find the solution Requires the user to manually edit a configuration file These criteria are quite strict, because I believe that using an operating system should be intuitive, and not require any spec...
Read more