Configure DHCP Trust

보통레벨 1수동 검토cisco-nxos

설명

You can configure whether DHCP snooping trusts traffic sources. An untrusted source may initiate traffic attacks or other hostile actions. To prevent such attacks, DHCP snooping filters messages from untrusted sources. In an enterprise network, a trusted source is a device that is under your administrative control. These devices include the switches, routers, and servers in the network. In a service provider environment, any device that is not in the service provider network is an untrusted source (such as a customer switch). Host ports are untrusted sources. CIS assessment: Manual. Reported as SKIP with review instructions.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

CIS assessment: Manual. switch(config)# show running-config dhcp

조치 방법

조치 방식: 가이드 또는 인프라 패치

! First, enable DHCP Snooping ip dhcp snooping Next, enable DHCP Snooping on target VLANs ip dhcp snooping vlan 100,200,250-252 Configure Interface as Trusted interface port-channel 5 ip dhcp snooping trust On a distribution or access switch (for instance in a wiring closet or branch office), typically only the uplink ports are configured as trusted - the ports leading towards the DHCP server On a datacenter switch, especially with virtualization, usually multiple ports are candidates for where the DHCP servers may appear on, all possible ports that may have a DHCP server on them should be trusted.

속성

운영 체제: 모두
태그: cisco-nxosnetworkmanagement-plane
참고 자료: CIS Cisco NX-OS Benchmark v1.2.0 - 3.3.1 Configure DHCP Trust