Cisco WLC Wi-Fi network: How to prevent someone running a spurious (rogue) DHCP server?

[Sam Brynes]

I have some LWAPPs running off of a Cisco WLC. How can I prevent someone from running a rogue DHCP server off the WLAN and causing an outage for Wi-Fi clients?

[balaji.bandi]

 dhcp snooping config is the remediation for you.

[Sam Brynes]

Hi Balaji,

Where would I configure that on the WLC?

Sam

[Leo Laohoo]

Turn on DHCP snooping in your network.

[patoberli]

Configure the DHCP server on the virtual-interface. I think if you do that, the WLC will automatically forward the DHCP packets to only that one IP address. The rogue DHCP should not even hear the DHCP Request that way. I haven't tested it though :)

[Rasika Nayanajith]

DHCP Snooping is the solution & here how you can implement it

https://mrncciew.com/2012/12/27/understanding-dhcp-snooping/

HTH

Rasika

*** Pls rate all useful responses ***

[patoberli]

Is DHCP snooping in the case of Wireless really needed?

I mean, the WLC doesn't forward broadcasts by default and thus a rogue DHCP server on WLAN shouldn't cause any issues (unless the not recommended broadcast forwarding was enabled). Or did I miss something here?