DHCP Snooping

Forum|Forum|4 years ago
August 27, 2021
4 replies
3915 views

Hello,

does it make sense to enable DHCP snooping in a network where does NOT have DHCP servers?

And of course PCs from the organization should not have DHCP client enabled also.

Thank you.

Regards.

gfleming

Staff

Sure it makes sense. What if someone sets up a rogue DHCP server on your network?

Yurisk

SuperUser

Hi,

if you don't have DHCP in the network at all, I'd rather go with blocking any DHCP traffic at the switch level completely. This way no rogue DHCP server can work. If using Fortiswitches (but today any vendor has it), they can do ACL including ports, some examples https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/738914/configuration-examples So, using ACL you could block port UDP ports 67, 68 and prevent any DHCP from passing the switches.

yurisk.info - all things Fortinet blog, no ads

gfleming

Staff

THat's another idea but just enabling DHCP snooping without setting a trusted interface would have the same effect with much fewer config changes.

leofrenchheheh

New Member

DHCP Snooping is a security feature that acts as a firewall between untrusted hosts and trusted DHCP servers. The DHCP Snooping function performs the following activities: • Validates DHCP messages received from untrusted sources and filters out invalid messages.

Regards: creed aventus canada

Sign up

Login with SSO

Login to the community

Login with SSO