topic Re: How to block Rogue DHCP Servers on the connected clients in Aerohive Migrated Content

How to block Rogue DHCP Servers on the connected clients

george_margarit — Fri, 20 Apr 2018 16:04:41 GMT

Looking to block DHCP Offers from connected clients.

From: Any (client)

To: Any

Source port: 67

Destination Port: 68

Protocol : UDP

Action: Block

Everything else: Permit

Can i have some guidance on how to set this up, so I don't also block DHCP Offers from our DHCP Server?

Thanks

Re: How to block Rogue DHCP Servers on the connected clients

sderikonja1 — Fri, 20 Apr 2018 19:34:51 GMT

My thought is block interstation traffic between wireless clients or using provided example allow DHCP requests to authorized DHCP servers and block all other DHCP traffic while permitting everything else.

Re: How to block Rogue DHCP Servers on the connected clients

jose_gonzalez — Fri, 20 Apr 2018 21:16:05 GMT

Enable DHCP snooping on your switches. You mark trusted ports where DHCP is allowed, such as routers, uplinks, trunk ports, and DHCP server location. The configuration varies from vendor to vendor.

Re: How to block Rogue DHCP Servers on the connected clients

AnonymousM — Tue, 24 Apr 2018 16:27:00 GMT

Your source and destination ports look good, this is traffic from a dhcp server back to the client. So creating a rule like this is straight forward - the trick is to apply it on traffic FROM any client, and not the other way.

Classic: From-Access
NG: Outbound Traffic

On NG it should look like this:

I still highly recommend to test this first.

Hope this helps.

Re: How to block Rogue DHCP Servers on the connected clients

george_margarit — Tue, 24 Apr 2018 17:34:05 GMT

Thanks Carsten.

It's only been a week using Aerohive and navigating through the GUI is still a tricky.

I have created that exact policy on your screenshot, but was finding tricky to make sure where to 'apply' this and the User Profiles (IP Firewall -> From-access) is the answer here.

As a follow up, do we have an option to similarly block IPv6 Router-Advertisements?

It's not on the list of network services (under that name at least).

Re: How to block Rogue DHCP Servers on the connected clients

AnonymousM — Tue, 24 Apr 2018 17:57:28 GMT

Ah, that ICMPv6 / Multicast, which is a bit tricky with Aerohive... I suggest to open a new thread explicitly for this topic. Hopefully someone else will jump on it 😉

Re: How to block Rogue DHCP Servers on the connected clients

george_margarit — Tue, 24 Apr 2018 18:12:50 GMT

Cool, thanks.

Re: How to block Rogue DHCP Servers on the connected clients

nlowe — Wed, 25 Apr 2018 16:30:54 GMT

Hi all,

Have you tried running a rogue DHCP server?

In the feature branch of HiveOS, you should observe enabled by default:

forwarding-engine dhcp-shield enable

forwarding-engine arp-shield enable

These have to be switched off by supplemental CLI if they are not wanted.

Cheers,

Nick