Security DHCP

[lveraza]

HI,

We have enabled DHCP in a 3660 Router, we have two core swith (6509), access switch are around 25.

We had a problem, an End User added a DSL Router to the LAN with DHCP enabled, then all user started to use this DHCP, it´s a big problem, do you know what i can do to avoid it ? how can i block it ?

Thank you, regards. Luis

[Roberto Salazar]

I'm thinking DHCP Snooping on switches that supports it. By making all the user port untrusted, the true DHCP server and DHCP Relay Agent trusted ports. Typically, the trusted ports are used to reach a DHCP server or relay agent. When the switch receives the DHCP packets from an untrusted port, DHCP snooping validates that only the DHCP packets from the clients are allowed and verifies that no spoofing of information is occurring. So, a DHCP response from an untrusted port will cause that bogus DHCP server to not act as DHCP server.