Example: Protecting against Rogue DHCP Server Attacks

This example uses the following hardware and software components:

• One EX Series switch or one QFX3500 switch

• Junos OS Release 9.0 or later for EX Series switches or Junos OS Release 12.1 or later for the QFX Series

• A DHCP server to provide IP addresses to network devices on the switch

Before you configure an untrusted DHCP server interface to mitigate rogue DHCP server attacks, be sure you have:

• Connected the DHCP server to the switch.

• Enabled DHCP snooping on the VLAN.

• Configured a VLAN on the switch. See the task for your platform:

  • Example: Setting Up Bridging with Multiple VLANs.

Ethernet LANs are vulnerable to address spoofing and DoS attacks on network devices. This example describes how to protect the switch from rogue DHCP server attacks.

This example shows how to explicitly configure an untrusted interface on an EX3200-24P switch and a QFX3500 switch. Figure 1 illustrates the topology for this example.

Topology

Figure 1: Network Topology for Basic Port Security

The components of the topology for this example are shown in Table 1.

Table 1: Components of the Port Security Topology

Properties	Settings
Switch hardware	One EX3200-24P, 24 ports (8 PoE ports) or one QFX3500 switch
VLAN name and ID	employee-vlan, tag 20
VLAN subnets	192.0.2.16/28 192.0.2.17 through 192.0.2.30192.0.2.31 is the subnet's broadcast address
Interfaces in employee-vlan	ge-0/0/1, ge-0/0/2, ge-0/0/3, ge-0/0/8
Interface for DHCP server	ge-0/0/8

In this example, the switch has already been configured as follows:

• Secure port access is activated on the switch.

• DHCP snooping is enabled on the VLAN employee-vlan.

• The interface (port) where the rogue DHCP server has connected to the switch is currently trusted.

To configure the DHCP server interface as untrusted because the interface is being used by a rogue DHCP server:

Confirm that the configuration is working properly.