DHCP Snooping

[kamarale]

Hello,

does it make sense to enable DHCP snooping in a network where does NOT have DHCP servers?

And of course PCs from the organization should not have DHCP client enabled also.

Thank you.

Regards.

[gfleming]

Sure it makes sense. What if someone sets up a rogue DHCP server on your network?

[Yurisk]

Hi, 

if you don't have DHCP in the network at all, I'd rather go with blocking any DHCP traffic at the switch level completely. This way no rogue DHCP server can work. If using Fortiswitches (but today any vendor has it), they can do ACL including ports, some examples  https://docs.fortinet.com/document/fortiswitch/7.2.3/administration-guide/738914/configuration-examp... So, using ACL you could block port UDP ports 67, 68 and prevent any DHCP from passing the switches. 

[gfleming]

THat's another idea but just enabling DHCP snooping without setting a trusted interface would have the same effect with much fewer config changes.

[leofrenchheheh]

DHCP Snooping is a security feature that acts as a firewall between untrusted hosts and trusted DHCP servers. The DHCP Snooping function performs the following activities: • Validates DHCP messages received from untrusted sources and filters out invalid messages.

Regards: creed aventus canada