topic Alert at unauthorized DHCP server activity.. in General Topics

Alert at unauthorized DHCP server activity..

LCMember4427 — Fri, 08 Nov 2013 11:16:59 GMT

Hi,

It happens from time to time that students succeeds to connect a private router to our dorms network and it starts to propose leases that lead nowhere to our clients.

I wonder if my PA500 box can be configured to alert us if it discovers such DHCP lease proposals from other sources than our authorized DHCP servers?

Thanks for comments on this.

regards Tor

Re: Alert at unauthorized DHCP server activity..

_slv_ — Fri, 08 Nov 2013 13:33:58 GMT

IMHO - PA cant do that, but much better idea is to use You switch to dosn't let tem do it.

If You have managed switch please find DHCP Snooping funtion. This will protect your DHCP server and you network from such problem.

Regards

SLawek

Re: Alert at unauthorized DHCP server activity..

mikand — Sun, 01 Dec 2013 16:57:00 GMT

DHCP Snooping and DCHP Relay is the way to go.

And while you are at it check up for the possibility to use private (or at least protected) vlans aswell.

Configuring the DHCP features of the switch should also end up with configuring DAI, IP Source Guard and Option82 for traceability.

Many switch vendors also have extra logging available to log when a rogue dhcp server is detected in the network (that is when you have already configured dchp snooping and dhcp relay which points out which the valid dhcp servers are).