Chapter 26 IP Source Guard

26.1.1 DHCP Snooping Overview

Use DHCP snooping to filter unauthorized DHCP packets on the network and to build the binding table dynamically. This can prevent clients from getting IP addresses from unauthorized DHCP servers.

26.1.1.1 Trusted vs. Untrusted Ports

Every port is either a trusted port or an untrusted port for DHCP snooping. This setting is independent of the trusted/untrusted setting for ARP inspection. You can also specify the maximum number for DHCP packets that each port (trusted or untrusted) can receive each second.

Trusted ports are connected to DHCP servers or other switches. The Switch discards DHCP packets from trusted ports only if the rate at which DHCP packets arrive is too high. The Switch learns dynamic bindings from trusted ports.

Note: If DHCP is enabled and there are no trusted ports, DHCP requests will not succeed.

Untrusted ports are connected to subscribers. The Switch discards DHCP packets from untrusted ports in the following situations:

•The packet is a DHCP server packet (for example, OFFER, ACK, or NACK).

•The source MAC address and source IP address in the packet do not match any of the current bindings.

•The packet is a RELEASE or DECLINE packet, and the source MAC address and source port do not match any of the current bindings.

•The rate at which DHCP packets arrive is too high.

26.1.1.2DHCP Snooping Database

The Switch stores the binding table in volatile memory. If the Switch restarts, it loads static bindings from permanent memory but loses the dynamic bindings, in which case the devices in the network have to send DHCP requests again. As a result, it is recommended you configure the DHCP snooping database.

The DHCP snooping database maintains the dynamic bindings for DHCP snooping and ARP inspection in a file on an external TFTP server. If you set up the DHCP snooping database, the Switch can reload the dynamic bindings from the DHCP snooping database after the Switch restarts.

270

MGS3700-12C User’s Guide

Page 269 Page 271
Page 270
Image 270
ZyXEL Communications metrogigabit switch Dhcp Snooping Overview, 270, Trusted vs. Untrusted Ports, Dhcp Snooping Database
Page 269 Page 271

metrogigabit switch specifications

ZyXEL Communications has long been a prominent player in the networking hardware industry, providing innovative solutions that cater to both business and consumer markets. Among their notable offerings is the Metrogigabit switch, a device designed to meet the high demands of modern networks.

The ZyXEL Metrogigabit switch is primarily aimed at service providers and large enterprises, recognizing the need for seamless connectivity in an increasingly digital world. This switch is engineered for scalability, enabling users to effortlessly expand their network as their operational needs grow. With support for high bandwidth, it is particularly suited for environments requiring extensive data traffic management, such as data centers and campus networks.

One of the standout features of the Metrogigabit switch is its high-density gigabit Ethernet ports, which provide a backbone for reliable data transmission. The switch typically supports multiple 10G SFP+ uplinks, ensuring fast and efficient connections to upstream devices. This capability allows users to configure their networks to handle large volumes of data quickly and without interruption.

In terms of technology, the Metrogigabit switch leverages advanced Layer 2 and Layer 3 functionalities. This includes features such as VLAN support for traffic segmentation, Quality of Service (QoS) for prioritizing mission-critical applications, and robust multicast management. These capabilities contribute to enhanced network efficiency and performance.

Another characteristic that sets the ZyXEL Metrogigabit switch apart is its built-in security features. The device is designed to protect network integrity through mechanisms like port security, access control lists, and advanced authentication protocols. This focus on security helps prepare businesses to counteract potential threats in a landscape where cyber attacks are increasingly sophisticated.

Moreover, the switch is equipped with a user-friendly management interface, which simplifies the process of monitoring and configuring network settings. This is complemented by support for SNMP and RMON, allowing network administrators to leverage tools for effective performance monitoring.

In summary, the ZyXEL Metrogigabit switch is an essential tool for organizations seeking robust performance, reliability, and security in their networking infrastructure. With its high-density ports, flexible configuration options, and comprehensive management features, it provides a strong foundation for building efficient and scalable networks. Whether for service providers or enterprises, this switch stands out as a reliable choice in the fast-evolving technological landscape.
Top Page Image Contents