How to protect DHCP using Cisco switches

Here is a simple explanation of the features that can be enabled on most Cisco switches to protect DHCP services.


Port Security
Description:
  • Count the number of MAC addresses that are seen coming from a user's switchport. If the number of MAC addresses goes above a configured limit (usually a low number), take appropriate action. This action can range from blocking any new MAC addresses to disabling the switchport.
Benefits:
  • Prevents a hacker from repeatedly spoofing their MAC address to flood the switch CAM (Content Addressable Memory) table which turns the switch into a hub, where all packets are broadcasted to all ports.

  • Prevents a hacker from "gobbling" up all available DHCP leases and leaving none for your users.

DHCP Snooping
Description:
  • This feature functions like a DHCP firewall, blocking any DHCP servers on ports that are not configured as "trusted". Only switch uplinks and DHCP server ports should be configured as trusted.
Benefits:
  • Prevents a hacker from running a rouge DHCP server and giving invalid IP address information to your users. This can be used as a DoS (Denial of Service) attack, or MitM (Man-in-the-Middle) attack.
  • Prevents users from plugging in home routers that are unknowingly running DHCP, causing your users to get bogus IP information and not be able to use the network.

IP Source Guard
Description:
  • By watching which IP addresses are assigned by DHCP, a switch can create dynamic ACL's to block all traffic except traffic from DHCP-assigned IP addresses.
Benefits:
  • Prevents a hacker from spoofing their IP address to launch an anonymous attack.

  • Prevents users from ignoring DHCP and manually configuring a static IP address.

Split-Scope DHCP
Description:
  • This is not a Cisco feature, instead it is a DHCP best practice. Split-scope involves using two DHCP servers. Each DHCP server hands out a portion (usually half) of the IP addresses in a particular network, while the other server hands out the remainder of the IP addresses in the network.
Benefits:
  • Prevents the failure of one DHCP server from disrupting DHCP services.

Comments

  1. Anonymous8/24/2008 12:54 PM

    thanks a lot
    i found my answer here!
    good luck
    A. ZALI

    ReplyDelete

Post a Comment

Popular posts from this blog

Using the Cisco console in Linux

Image
Introduction People who work with Cisco network equipment need to be able to connect to the console port on their devices. In Windows, you can simply fire up HyperTerminal to get basic access to your devices. If you are using Linux, then you need to know how this can be done with an application called Minicom . Hardware First, you are going to need a Cisco console cable , a Cisco device, and a computer. If your computer has a serial port , then you can use the standard console cable that comes with every Cisco device. If you do not have a serial port (like most new laptops), then you need to purchase a USB to Serial adapter that supports Linux. This device will allow you to use the standard Cisco cable, which has a serial port on one end. Install Minicom You can easily install Minicom by using "System > Administration > Synaptic Package Manager". Search for "minicom" and choose to install the package. Click "Apply" and Minicom should be insta
Read more

What it takes to make Ubuntu ready for use

I recently installed Ubuntu 6.10 on a new PC at work. In this post I will document all the steps I had to perform to get it ready for everyday use. Each step is assigned a level of difficulty, which I define below: Very Easy Step can be completed without using the command prompt Intuitive to complete Easy Step can be completed without using the command prompt May require searching to find the right place to make the change Medium Requires a single command to be entered at the command prompt Requires searching internet resources to find the solution Hard Requires multiple commands to be entered at the command prompt Requires searching internet resources to find the solution Very Hard Requires multiple commands to be entered at the command prompt Requires searching internet resources to find the solution Requires the user to manually edit a configuration file These criteria are quite strict, because I believe that using an operating system should be intuitive, and not require any spec
Read more

Five ways to use Windows apps in Linux

Image
1. Use an open source alternative instead When someone asks me if they can run "Windows Application X" on Linux, the first thing I tell them is to look for an open source alternative. For most Windows applications, there will be a high-quality open source alternative that can meet their needs. The biggest hurdle for non-Linux people is simply knowing that these alternative exist and how to find them. The best place I have found to search for these applications is at www.osalt.com . On that site, you can enter the name of the Windows application and it will list the open source alternatives that provide similar functionality. Be sure to check it out. 2. Buy a commercial product that was designed for Linux If you cannot find an open source alternative, and you have not already purchased a Windows application, then you should consider purchasing a commercial product that was designed for Linux. Here is a story of a civil engineer who wanted to find an open source replacemen
Read more