Allied Telesis AT-8600 Series, Rapier i Series manual AlliedWareTM OS, Introduction

AlliedWareTM OS

How To Use DHCP Snooping, Option 82, and Filtering on AT-8800, AT-8600, AT-8700XL, Rapier, and Rapier i Series Switches

Introduction

It has increasingly become a legal requirement for service providers to identify which of their customers were using a specific IP address at a specific time. This means that service providers must be able to:

zKnow which customer was allocated an IP address at any time.

zGuarantee that customers cannot avoid detection by spoofing an IP address that was not actually allocated to them.

These security features provide a traceable history in the event of an official query. Three components are used to provide this traceable history:

zDHCP snooping

zDHCP Option 82

zDHCP filtering

With DHCP snooping an administrator can control port-to-IP connectivity by:

zpermitting port access to specified IP addresses only

zpermitting port access to DHCP issued IP addresses only

zdictating the number of IP clients on any given port

zpassing location information about an IP client to the DHCP server

zpermitting only known IP clients to ARP

This document explains each feature and provides the minimum configuration to enable them. There are also two configuration examples that make advanced use of the features.

C613-16086-00 REV B www.alliedtelesis.com