SNR S2989G-24TX-UPS — настройка DHCP Snooping для защиты сети от атак [222/553]

Превью страниц Страница 222 / 553

S2989G-24TX Operation Manual

Chapter 3 IP services Configuration

3-60

Figure 3-14 Sketch Map of TRUNK

As showed in the above chart, Mac-AA device is the normal user, connected to the

non-trusted port 1/0/1 of the switch. It operates via DHCP Client, IP 1.1.1.5; DHCP Server

and GateWay are connected to the trusted ports 1/0/11 and 1/0/12 of the switch; the

malicious user Mac-BB is connected to the non-trusted port 1/0/10, trying to fake a DHCP

Server（by sending DHCPACK）. Setting DHCP Snooping on the switch will effectively

detect and block this kind of network attack.

Configuration sequence is:

switch#

switch#config

switch(config)#ip dhcp snooping enable

switch(config)#interface ethernet 1/0/11

switch(Config-Ethernet1/0/11)#ip dhcp snooping trust

switch(Config-Ethernet1/0/11)#exit

switch(config)#interface ethernet 1/0/12

switch(Config-Ethernet1/0/12)#ip dhcp snooping trust

switch(Config-Ethernet1/0/12)#exit

switch(config)#interface ethernet 1/0/1-10

switch(Config-Port-Range)#ip dhcp snooping action shutdown

switch(Config-Port-Range)#

3.16.4

DHCP Snooping Troubleshooting Help

3.16.4.1 Monitor and Debug Information

The “debug ip dhcp snooping” command can be used to monitor the debug

information.