topic Mitigation for DHCP Starvation attack in shared network zone (e.g.Eduroam) in Next-Generation Firewall Discussions

Mitigation for DHCP Starvation attack in shared network zone (e.g.Eduroam)

LuckyLau — Tue, 10 Oct 2023 03:26:13 GMT

Hi everyone,

Is there anyway for us to utilize Palo NGFW to prevent or mitigate DHCP starvation attack.

For example, a user's BYOD device is infected with malware, after authenticated with eduroam network, the device start performing DHCP starvation attack without the user even realize.

I have tried looking online for solutions, there's recommendation such as DHCP snooping, port security in layer 2 but not sure if it is effective for shared network/wifi zone.

Thank you in advance your help!

Re: Mitigation for DHCP Starvation attack in shared network zone (e.g.Eduroam)

ozheng — Tue, 10 Oct 2023 08:27:40 GMT

Hello LuckyLau,

You can set some rate limiting toward the DHCP server with DoS profile.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection-and-dos-protection/zone-defense/dos-protection-profiles-and-policy-rules/classified-versus-aggregate-dos-protection

But not sure it is as efficient as other L2 mechanism (I'm a fan of blocking as soon as possible an unwanted traffic)

Olivier