Mitigation for DHCP Starvation attack in shared network zone (e.g.Eduroam)

[LuckyLau]

Hi everyone, 

Is there anyway for us to utilize Palo NGFW to prevent or mitigate DHCP starvation attack. 

For example, a user's BYOD device is infected with malware, after authenticated with eduroam network, the device start performing DHCP starvation attack without the user even realize.  

I have tried looking online for solutions, there's recommendation such as DHCP snooping, port security in layer 2 but not sure if it is effective for shared network/wifi zone. 

Thank you in advance your help!

[ozheng]

Hello LuckyLau,

You can set some rate limiting toward the DHCP server with DoS profile.

https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/zone-protection-and-dos-protection/zone-de...

But not sure it is as efficient as other L2 mechanism (I'm a fan of blocking as soon as possible an unwanted traffic)

Olivier