Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
kamarale
New Contributor

DHCP Snooping

Hello,

 

does it make sense to enable DHCP snooping in a network where does NOT have DHCP servers?

And of course PCs from the organization should not have DHCP client enabled also.

 

Thank you.

Regards.

4 REPLIES 4
gfleming
Staff
Staff

Sure it makes sense. What if someone sets up a rogue DHCP server on your network?

Cheers,
Graham
Yurisk
Valued Contributor

Hi, 

if you don't have DHCP in the network at all, I'd rather go with blocking any DHCP traffic at the switch level completely. This way no rogue DHCP server can work. If using Fortiswitches (but today any vendor has it), they can do ACL including ports, some examples  https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/738914/configuration-examp... So, using ACL you could block port UDP ports 67, 68 and prevent any DHCP from passing the switches. 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
gfleming

THat's another idea but just enabling DHCP snooping without setting a trusted interface would have the same effect with much fewer config changes.

Cheers,
Graham
leofrenchheheh
New Contributor

DHCP Snooping is a security feature that acts as a firewall between untrusted hosts and trusted DHCP servers. The DHCP Snooping function performs the following activities: • Validates DHCP messages received from untrusted sources and filters out invalid messages.

 

Regards: creed aventus canada

Labels
Top Kudoed Authors