I. Common Issues with Deploying DHCP Services
Setting up a DHCP server allows network parameters such as IP addresses, subnet masks, default gateways, and DNS servers to be assigned automatically to clients, which simplifies network configuration and improves management efficiency. However, there are some problems in the management of DHCP services, the most common of which are:
· Rogue DHCP servers
· DoS attacks against the DHCP server, such as DHCP exhaustion attacks
· Users assigning IP addresses arbitrarily, causing IP address conflicts
1. Rogue DHCP Servers
Because there is no authentication mechanism between a DHCP server and its clients, if a DHCP server is added to the network at will, it can assign IP addresses and other network parameters to clients. As long as that DHCP server hands out incorrect IP addresses and other network parameters, it will cause enormous harm to the network.
2. Denial-of-Service Attacks Against the DHCP Server
A DHCP server usually determines a client’s MAC address by examining the CHADDR (Client MAC address) field in the DHCP request message sent by the client. Under normal circumstances, the CHADDR field matches the real MAC address of the client that sent the request. An attacker can forge a MAC address to send DHCP requests, but this type of attack can be prevented by using the port security feature of Cisco switches. Port Security can restrict each port to a single unique MAC address. However, if the attacker does not modify the source MAC address of the DHCP request message but instead modifies the CHADDR field in the DHCP message to carry out the attack, port security becomes ineffective. Because the DHCP server treats different CHADDR values as requests coming from different clients, an attacker can send a large number of DHCP requests with forged CHADDR values, exhausting the address pool on the DHCP server so that it can no longer provide network addresses to other legitimate users — this is a DHCP exhaustion attack. A DHCP exhaustion attack can be a pure DoS attack, or it can be used in combination with a rogue DHCP server. When the legitimate DHCP server is brought down, the attacker can set up a rogue DHCP server to provide addresses to clients on the LAN, causing them to forward information to a malicious computer set up for interception. Even if both the source MAC address and the CHADDR field of the DHCP request message are correct, because DHCP request messages are broadcast messages, sending a large number of them will also exhaust network bandwidth, forming another type of denial-of-service attack.
3. Clients Assigning IP Addresses Arbitrarily
A client does not have to use DHCP; it can also set its IP address statically. If addresses are assigned arbitrarily, the likelihood of IP address conflicts on the network increases greatly.
II. Introduction to DHCP Snooping
DHCP Snooping is a DHCP security feature. Cisco switches support enabling DHCP Snooping on a per-VLAN basis. With this feature, the switch can intercept all DHCP messages within a Layer 2 VLAN domain.
DHCP Snooping classifies switch ports into two types:
· Untrusted ports: usually ports connected to endpoint devices such as PCs and network printers
· Trusted ports: ports connected to legitimate DHCP servers or uplink ports connected to aggregation switches
By enabling DHCP Snooping, the switch restricts user ports (untrusted ports) to sending DHCP requests only, and discards all other DHCP messages from user ports, such as DHCP Offer messages. Moreover, not all DHCP requests from user ports are allowed through: the switch also compares the source MAC address (in the message header) of the DHCP request message with the hardware address of the DHCP client (in the message body, i.e., the CHADDR field). Only requests in which the two match are forwarded; otherwise they are discarded. This prevents DHCP exhaustion attacks.
Trusted ports can receive all DHCP messages. By setting only the port connecting the switch to the legitimate DHCP server as a trusted port and all other ports as untrusted ports, you can prevent users from forging a DHCP server to attack the network. DHCP Snooping can also rate-limit DHCP messages on a port. By applying rate limiting on each untrusted port, you can block broadcast attacks from legitimate DHCP requests.
DHCP Snooping has another very important function: building a DHCP Snooping Binding table. Once a client connected to an untrusted port obtains a legitimate DHCP Offer, the switch automatically adds a binding entry to the DHCP Snooping Binding table, containing information such as the client’s IP address, MAC address, port number, VLAN ID, and lease time on that untrusted port. For example:
Switch#show ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type VLAN Int
00:0F:1F:C5:10:08 192.168.10.131 682463 dhcp-snooping 10 FastEthernet0/1
This DHCP Snooping Binding table provides the basis for further deploying IP Source Guard (IPSG) and Dynamic ARP Inspection (DAI). Notes:
I. Untrusted ports allow only DHCP request messages from clients to pass; this applies only to DHCP messages. Other non-DHCP messages can still be forwarded normally. This means that clients can access the network through an untrusted port using a statically assigned IP address. Because static clients do not send DHCP messages, no record of such a static client will appear in the DHCP Snooping Binding table.
Client information on trusted ports is not recorded in the DHCP Snooping Binding table. If a client is connected to a trusted port, even if it obtains its IP address through normal DHCP, there will be no record of that client in the DHCP Snooping Binding table. If clients are required to access the network only with dynamically obtained IP addresses, IPSG and DAI technologies must be used.
II. To achieve high-speed forwarding, a switch normally examines only the Layer 2 frame header of a message and forwards it directly once the destination MAC address is obtained, without inspecting the message body. DHCP Snooping essentially enables the switch to inspect the content portion of DHCP messages; DHCP messages are no longer checked only at the frame header.
III. The DHCP Snooping Binding table is not only used to defend against DHCP attacks; it also provides dynamic database support for subsequent IPSG and DAI technologies.
DHCP-SNOOPING Configuration
DHCP Snooping Configuration Tasks
The task of DHCP Snooping is to inspect DHCP messages, prevent rogue DHCP servers from providing DHCP services, and maintain the binding relationship between MAC addresses and IP addresses on an interface. Based on the MAC-to-IP binding, DAI (Dynamic ARP Inspection) and IP Source Guard functions can be implemented. DHCP Snooping mainly involves listening for DHCP messages, dynamically maintaining the MAC-to-IP binding table, and having the Layer 2 switch filter out messages from untrusted ports that do not satisfy this binding relationship, thereby preventing unauthorized users from attacking the network.
· Enable/disable DHCP Snooping
· Enable DHCP Snooping on a VLAN
· Configure an interface as a DHCP trusted interface
· Enable DAI on a VLAN
· Configure an interface as an ARP Inspection trusted interface
· Enable IP Source Guard on a VLAN
· Configure an interface as an IP Source Guard trusted interface
· Configure the TFTP server for DHCP Snooping binding backup
· Configure the file name for DHCP Snooping binding backup
· Configure the interval for DHCP Snooping binding backup
· Manually add a binding entry
· DHCP Snooping monitoring and maintenance
· DHCP Snooping configuration example
Switch(config)#ip dhcp snooping //Enable DHCP Snooping
Switch(config)#ip dhcp snooping vlan 10 //Specify which VLANs DHCP Snooping applies to
Switch(config)#ip dhcp snoopiing verify mac-address //Check whether the source MAC and the CHADDR field of DHCP request messages received on untrusted ports match, in order to prevent DHCP exhaustion attacks; this function is enabled by default.
Switch(config-if)#ip dhcp snooping trust //Configure the interface as a trusted interface for DHCP Snooping; all interfaces are untrusted by default
Switch(config-if)#ip dhcp snoopiing limit rate 15 //Limit the DHCP message rate on untrusted ports to 15 packets per second (the default is 15 packets per second). If this command is not configured, the output of show ip dhcp snooping will not list ports that lack it. The optional rate range is 1-2048
It is recommended that, after configuring DHCP message rate limiting on a port, you also configure the following two commands
Switch(config)#errdisable recovery cause dhcp-rate-limit //Allow ports disabled due to DHCP message rate limiting to automatically recover from the err-disable state after 30 seconds
Switch(config)#ip dhcp snooping information option //Set whether the switch inserts Option 82 into DHCP messages received on untrusted ports; enabled by default
Swtich(config)#ip dhcp snooping information option allow-untrusted //Configure the aggregation switch to accept DHCP messages with Option 82 sent by access switches that were received on untrusted ports
Switch#ip dhcp snooping binding 000f.1fc5.1008 vlan 10 192.168.10.131 interface fa0/2 expiry 692000 //Privileged mode command: manually add a DHCP Snooping binding entry; expiry is a time value, i.e., the lease in the snooping binding
Switch(config)#ip dhcp snooping database flash:dhcp_snooping.db //Save the DHCP Snooping table in flash with the file name dhcp_snooping.db
Swtich(config)#ip dhcp snooping database tftp://192.168.2.5/Switch/dhcp_snooping.db //Make sure the TFTP server is reachable in advance. “Switch” in the URL is a folder on the TFTP server; the saved file name is dhcp_snooping.db. After the save location is changed, a write operation is performed immediately.
Swtich(config)#ip dhcp snooping database write-delay 30 //Specify that after the DHCP Snooping binding table is updated, the switch waits 30 seconds before writing to the file. The default is 300 seconds; the optional range is 15-86400 seconds
Switch(config)#ip dhcp snooping database timeout 60 //Specify that after a write operation on the DHCP Snooping binding table fails, the switch retries the write operation and stops trying after 60 seconds. The default is 300 seconds; the optional range is 0-86400 seconds
Note: In practice, when the DHCP Snooping binding table changes, the switch first waits for the write-delay period and then performs the write operation. If the write operation fails (for example, because the TFTP server is unreachable), it then waits for the timeout period, retrying continuously during that time. After the timeout period elapses, it stops attempting to write. However, because the snooping binding table has already changed, it starts waiting for the write-delay period again to perform the write operation, looping continuously until the write operation succeeds.
Switch#renew ip dhcp snooping database flash:dhcp_snooping.db //Privileged mode command: immediately read the DHCP Snooping table from the saved database file.
Displaying DHCP Snooping Status
Switch#show ip dhcp snooping //Display the current configuration of DHCP Snooping options and ports
Switch#show ip dhcp snooping binding //Display the current DHCP Snooping binding table
Switch#show ip dhcp snooping database //Display information about the DHCP Snooping binding database
Switch#show ip dhcp snooping statistics //Display DHCP Snooping operation statistics
Switch#clear ip dhcp snooping binding //Clear the DHCP Snooping binding table; note: this command cannot clear a single entry, only all entries
Switch#clear ip dhcp snooping database statistics //Clear the counters of the DHCP Snooping binding database
Switch#clear ip dhcp snooping statistics //Clear the counters of the DHCP Snooping operation statistics
DHCP Snooping Example
1. Single switch (DHCP server and DHCP clients on the same VLAN)
Environment: The Windows 2003 DHCP server and the client are both on VLAN 10; the server is connected to F0/1 and the client to F0/2
ip dhcp snoopiing vlan 10
ip dhcp snooping
!
int f0/1
switchport access vlan 10
spanning-tree portfast
ip dhcp snooping trust
!
int f0/2
switchport access vlan 10
spanning-tree portfast
ip dhcp snooping limit rate 15
Notes:
· In this example, the switch inserts Option 82 information into DHCP request messages from the client; you can also choose not to insert Option 82 information by configuring the no ip dhcp snooping information option command. Either approach is acceptable.
· For client ports, it is recommended to configure the spanning-tree portfast command so that the port does not participate in spanning-tree calculation, which saves port startup time and prevents the client from failing to obtain an IP address because the port takes too long to come up.
· The VLAN on which DHCP Snooping is enabled does not require a Layer 3 interface for that VLAN to be created.
