- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DHCP Snooping
Hello,
does it make sense to enable DHCP snooping in a network where does NOT have DHCP servers?
And of course PCs from the organization should not have DHCP client enabled also.
Thank you.
Regards.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure it makes sense. What if someone sets up a rogue DHCP server on your network?
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
if you don't have DHCP in the network at all, I'd rather go with blocking any DHCP traffic at the switch level completely. This way no rogue DHCP server can work. If using Fortiswitches (but today any vendor has it), they can do ACL including ports, some examples https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/738914/configuration-examp... So, using ACL you could block port UDP ports 67, 68 and prevent any DHCP from passing the switches.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
THat's another idea but just enabling DHCP snooping without setting a trusted interface would have the same effect with much fewer config changes.
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
DHCP Snooping is a security feature that acts as a firewall between untrusted hosts and trusted DHCP servers. The DHCP Snooping function performs the following activities: • Validates DHCP messages received from untrusted sources and filters out invalid messages.
Regards: creed aventus canada