Troubleshooting IP service issues

DHCP issues

·     This document mainly introduces the procedures of troubleshooting attack protection issues on the DHCP server.

·     For specific implementations of various attack prevention functions of DHCP, see DHCP Attack Protection Technology White Paper.

DHCP starvation attack prevention issues

About DHCP starvation attack prevention

A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using different MAC addresses in the chaddr field to a DHCP server. This might cause the following issues:

·     Legitimate DHCP clients cannot obtain IP addresses, because the IP address resources of the DHCP server are exhausted.

To resolve this issue, enable the DHCP starvation attack prevention feature for the DHCP server.

·     The DHCP server might fail to work due to exhaustion of system resources.

To resolve this issue, enable the DHCP starvation attack prevention feature in conjunction with the DHCP flood attack protection feature for the DHCP server.

Symptom

·     Although the DHCP starvation attack prevention feature is enabled, the DHCP server still frequently runs out of IP address resources.

·     A legitimate user cannot obtain any IP address from the DHCP server, because its requests are regarded as attack packets.

Common causes

The following are the common causes of this type of issue:

·     The DHCP starvation attack prevention feature is not enabled on the client-facing interfaces of the DHCP server.

·     When multiple DHCP relay agents exist between a DHCP client and the DHCP server, the DHCP server or non-first-hop relay agents are enabled with the MAC address check feature.

·     The maximum number of ARP entries or MAC addresses that a client-facing interface can learn is unreasonable.

Troubleshooting flow

Figure 1 shows the troubleshooting flowchart.

Figure 1 Flowchart for troubleshooting DHCP starvation attack prevention issues

 

Solution

1.     Check whether the DHCP starvation attack prevention feature is enabled on the client-facing interfaces of the DHCP server.

 

NOTE: Take this step when DHCP clients are directly connected to the DHCP server. If DHCP clients are connected to a DHCP relay agent, proceed to step 2.

 

For better DHCP starvation attack prevention, configure the DHCP server to achieve DHCP starvation attack prevention against DHCP requests with different MAC addresses and with the same MAC address.

To achieve DHCP starvation attack prevention against DHCP requests with different MAC addresses:

¡     For a Layer 3 interface, use the arp max-learning-num command in Layer 3 interface view to set an ARP entry learning limit.

¡     For a Layer 2 interface, perform the following operations in Layer 2 interface view:

-     Use the mac-address max-mac-count command to set an MAC learning limit.

-     Use the undo mac-address max-mac-count enable-forwarding command to disable forwarding unknown frames received on the interface after the MAC learning limit on the interface is reached.

You can use the display this command to view the configuration of a client-facing interface on the DHCP server.

¡     Display Layer 3 interface configuration.

<Sysname> system-view

[Sysname] interface ten-gigabitethernet 0/0/6

[Sysname-Ten-GigabitEthernet0/0/6] display this

#

interface Ten-GigabitEthernet0/0/6

port link-mode route

arp max-learning-num 10

...

If no ARP entry limit is configured on the interface, use the arp max-learning-num command in Layer 3 interface view to set an ARP entry learning limit.

¡     Display Layer 2 interface configuration.

<Sysname> system-view

[Sysname] interface ten-gigabitethernet 0/0/6

[Sysname-Ten-GigabitEthernet0/0/6] display this

#

interface Ten-GigabitEthernet0/0/6

 port link-mode bridge

 mac-address max-mac-count 600

 undo mac-address max-mac-count enable-forwarding

...

If the interface does not have any configuration about DHCP starvation attack prevention, perform the following operations in Layer 2 interface view:

-     Use the mac-address max-mac-count command to set an MAC learning limit.

-     Use the undo mac-address max-mac-count enable-forwarding command to disable forwarding unknown frames received on the interface after the MAC learning limit on the interface is reached.

To achieve DHCP starvation attack prevention against DHCP requests with the same MAC address, use the dhcp server check mac-address command to enable MAC address check on all client-facing interfaces. The MAC address check feature enables the DHCP server to compare the chaddr field of a received DHCP request with the source MAC address in the frame header. If they are the same, the DHCP server verifies the packet legal and continues processing the packet. If they are not the same, the DHCP server discards the request.

You can use the display this command to check whether the MAC address check feature is enabled on a client-facing interface of the DHCP server.

<Sysname> system-view

[Sysname] interface ten-gigabitethernet 0/0/6

[Sysname-Ten-GigabitEthernet0/0/6] display this

#

interface Ten-GigabitEthernet0/0/6

 port link-mode route

 dhcp server check mac-address

...

If the MAC address check feature is not enabled, use the dhcp server check mac-address command to enable this feature on the interface.

2.     Check whether the DHCP starvation attack prevention feature is configured correctly on the DHCP server or DHCP relay agent.

 

NOTE: Take this step when a DHCP client is connected to a DHCP relay agent for communication with the DHCP server. If no DHCP relay agent is deployed on the network, skip this step.

 

a.     Check whether an ARP entry learning limit or MAC learning limit is configured on the client-facing interfaces of the DHCP relay agent or the DHCP server. The check process is similar as step 1.

b.     Check whether the DHCP server or non-first-hop relay agents are enabled with the MAC address check feature.

When a Layer 3 device forwards a DHCP request to the DHCP server, the Layer 3 device replaces the source MAC address of the DHCP request with its MAC address. On receipt of the packet from the Layer 3 device, the DHCP server or a non-first-hop DHCP relay agent will consider that packet as an attack packet.

When multiple DHCP relay agents exist between a DHCP client and the DHCP server, follow these guidelines as a best practice:

-     Disable the MAC address check feature on the client-facing interfaces of the DHCP server and non-first-hop DHCP relay agents.

To disable the MAC address check feature on a client-facing interface of the DHCP server, use the undo dhcp server check mac-address  command. To disable the MAC address check feature on a client-facing interface of a non-first-hop DHCP relay agent, use the undo dhcp relay check mac-address command.

-     Enable the MAC address check feature only on the client-facing interfaces of the first-hop DHCP relay agent.

For more information about how to check whether the MAC address check feature is enabled on a DHCP relay agent, see step 1.

3.     Check whether the maximum number of ARP entries or MAC addresses that a client-facing interface can learn is unreasonable.

You can use the display this command in any view of the DHCP server to view the ARP entry learning limit or MAC learning limit on a client-facing interface.

¡     Display Layer 3 interface configuration.

<Sysname> system-view

[Sysname] interface ten-gigabitethernet 0/0/6

[Sysname-Ten-GigabitEthernet0/0/6] display this

#

interface Ten-GigabitEthernet0/0/6

port link-mode route

arp max-learning-num 10

...

If no ARP entry limit is configured on the interface, use the arp max-learning-num command in Layer 3 interface view to set an ARP entry learning limit.

¡     Display Layer 2 interface configuration.

<Sysname> system-view

[Sysname] interface ten-gigabitethernet 0/0/6

[Sysname-Ten-GigabitEthernet0/0/6] display this

#

interface Ten-GigabitEthernet0/0/6

 port link-mode bridge

 mac-address max-mac-count 600

...

If the ARP entry learning limit or MAC learning limit is much greater than the number of assignable IPs on the DHCP server, numerous users will fail to obtain IPs from the DHCP server. If the ARP entry learning limit or MAC learning limit is too small, the DHCP server might discard DHCP requests from legitimate users.

To ensure successful IP address acquisition and correct communication between legitimate users and the DHCP server, set a reasonable ARP entry learning limit or MAC learning limit. As a best practice, use the default ARP entry learning limit or MAC learning limit. If the default one cannot meet the service requirement, you can use the arp max-learning-num command or the mac-address max-mac-count command in interface view to set a new learning limit.

4.     If the issue persists, collect the following information and contact Technical Support:

¡     Results of each step.

¡     The configuration file, log messages, and alarm messages.

¡     Collect the debugging results after you use the debugging dhcp server all command.

Related alarm and log messages

Alarm messages

N/A

Log messages

N/A