HP 1920-24G-PoE+ Manual de usuario Pagina 319

  • Descarga
  • Añadir a mis manuales
  • Imprimir
  • Pagina
    / 547
  • Tabla de contenidos
  • MARCADORES
  • Valorado. / 5. Basado en revisión del cliente
Vista de pagina 318
306
Configuring DHCP snooping
DHCP snooping works between the DHCP client and server, or between the DHCP client and DHCP
relay agent. It guarantees that DHCP clients obtain IP addresses from authorized DHCP servers. Also, it
records IP-to-MAC bindings of DHCP clients (called DHCP snooping entries) for security purposes.
DHCP snooping does not work between the DHCP server and DHCP relay agent.
Overview
DHCP snooping defines trusted and untrusted ports to make sure clients obtain IP addresses only from
authorized DHCP servers.
Trusted—A trusted port can forward DHCP messages correctly to make sure the clients get IP
addresses from authorized DHCP servers.
Untrusted—An untrusted port discards received DHCP-ACK and DHCP-OFFER messages to prevent
unauthorized servers from assigning IP addresses.
DHCP snooping reads DHCP-ACK messages received from trusted ports and DHCP-REQUEST messages
to create DHCP snooping entries. A DHCP snooping entry includes the MAC and IP addresses of a client,
the port that connects to the DHCP client, and the VLAN. The DHCP snooping entries can be used by ARP
detection to prevent ARP attacks. For more information about ARP detection, see "Configuring ARP attack
pr
otection".
Application of trusted ports
Configure ports facing the DHCP server as trusted ports, and configure other ports as untrusted ports.
As shown in Figure 283, co
nfigure the DHCP snooping device's port that is connected to the DHCP
server as a trusted port. The trusted port forwards response messages from the DHCP server to the client.
The untrusted port connected to the unauthorized DHCP server discards incoming DHCP response
messages.
Vista de pagina 318
1 2 ... 314 315 316 317 318 319 320 321 322 323 324 ... 546 547

Comentarios a estos manuales

Sin comentarios