DHCP Snooping

定义

DHCP Snooping是DHCP（Dynamic Host Configuration Protocol）的一种安全特性，用于保证DHCP客户端从合法的DHCP服务器获取IP地址，并记录DHCP客户端IP地址与MAC地址等参数的对应关系，防止网络上针对DHCP攻击。

目的

目前DHCP协议（RFC2131）在应用的过程中遇到很多安全方面的问题，网络中存在一些针对DHCP的攻击，如DHCP Server仿冒者攻击、DHCP Server的拒绝服务攻击、仿冒DHCP报文攻击等。

为了保证网络通信业务的安全性，可引入DHCP Snooping技术，在DHCP Client和DHCP Server之间建立一道防火墙，以抵御网络中针对DHCP的各种攻击。

受益

• 设备具有防御网络上DHCP攻击的能力，增强了设备的可靠性，保障通信网络的正常运行。
• 为用户提供更安全的网络环境，更稳定的网络服务。

DHCP Snooping的基本原理

DHCP Snooping分为DHCPv4 Snooping和DHCPv6 Snooping，两者实现原理相似，以下以DHCPv4 Snooping为例进行描述。

使能了DHCP Snooping的设备将用户（DHCP客户端）的DHCP请求报文通过信任接口发送给合法的DHCP服务器。之后设备根据DHCP服务器回应的DHCP ACK报文信息生成DHCP Snooping绑定表。后续设备再从使能了DHCP Snooping的接口接收用户发来的DHCP报文时，会进行匹配检查，能够有效防范非法用户的攻击。

实验拓补图

实验步骤

S1的配置

[S1]dhcp server group dhcpgroup1
[S1-dhcp-server-group-dhcpgroup1]dhcp-server 10.2.1.2

[S1]vlan batch 10 100
[S1]interface GigabitEthernet 0/0/1
[S1-port-group-link-type]port link-type access 
[S1-port-group-link-type]port default vlan 10
[S1]interface GigabitEthernet 0/0/2
[S1-GigabitEthernet0/0/2]port link-type access
[S1-GigabitEthernet0/0/2]port default vlan 10
[S1-GigabitEthernet0/0/2]interface gigabitethernet 0/0/3
[S1-GigabitEthernet0/0/3]port link-type access
[S1-GigabitEthernet0/0/3]port default vlan 100

[S1]dhcp enable
[S1]interface vlanif 10
[S1-Vlanif10]ip address 192.168.1.1 255.255.255.0
[S1-Vlanif10]dhcp select relay
[S1-Vlanif10]dhcp relay server-select dhcpgroup1
[S1-Vlanif10]q

[S1]interface vlanif 100
[S1-Vlanif100]ip address 10.1.1.2 255.255.255.0
[S1-Vlanif100]quit
[S1]ip route-static 0.0.0.0 0.0.0.0 10.1.1.1

[S1]dhcp snooping enable ipv4
[S1]interface gigabitethernet 0/0/1
[S1-GigabitEthernet0/0/1] dhcp snooping enable
[S1-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[S1-GigabitEthernet0/0/2]dhcp snooping enable

[S1]dhcp snooping check dhcp-rate enable
[S1]dhcp snooping check dhcp-rate 90
[S1] dhcp snooping alarm dhcp-rate enable
[S1]dhcp snooping alarm dhcp-rate threshold 500

[S1]interface gigabitethernet 0/0/1
[S1-GigabitEthernet0/0/1]dhcp snooping check dhcp-request enable
[S1-GigabitEthernet0/0/1] dhcp snooping alarm dhcp-request enable
[S1-GigabitEthernet0/0/1]dhcp snooping alarm dhcp-request threshold 120
[S1-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[S1-GigabitEthernet0/0/2]dhcp snooping check dhcp-request enable
[S1-GigabitEthernet0/0/2]dhcp snooping alarm dhcp-request enable
[S1-GigabitEthernet0/0/2]dhcp snooping alarm dhcp-request threshold 120

[S1]interface gigabitethernet 0/0/1
[S1-GigabitEthernet0/0/1]dhcp snooping max-user-number 20
[S1-GigabitEthernet0/0/1]dhcp snooping check dhcp-chaddr enable
[S1-GigabitEthernet0/0/1]dhcp snooping alarm dhcp-chaddr enable
[S1-GigabitEthernet0/0/1]dhcp snooping alarm dhcp-chaddr threshold 120
[S1-GigabitEthernet0/0/1]interface gigabitethernet 0/0/2
[S1-GigabitEthernet0/0/2]dhcp snooping max-user-number 20
[S1-GigabitEthernet0/0/2]dhcp snooping check dhcp-chaddr enable
[S1-GigabitEthernet0/0/2]dhcp snooping alarm dhcp-chaddr enable
[S1-GigabitEthernet0/0/2]dhcp snooping alarm dhcp-chaddr threshold 120