Reference Guide

282 | Dynamic Host Configuration Protocol (DHCP)
www.dell.com | support.dell.com
Displaying the Helper Address Configuration
R1_E600#show ip int gig 1/3
GigabitEthernet 1/3 is up, line protocol is down
Internet address is 10.11.0.1/24
Broadcast address is 10.11.0.255
Address determined by user input
IP MTU is 1500 bytes
Helper address is 192.168.0.1
192.168.0.2
Directed broadcast forwarding is disabled
Proxy ARP is enabled
Split Horizon is enabled
Poison Reverse is disabled
ICMP redirects are not sent
ICMP unreachables are not sent
Configure Secure DHCP
DHCP as defined by RFC 2131 provides no authentication or security mechanisms. Secure DHCP is a
suite of features that protects networks that use dynamic address allocation from spoofing and attacks.
• Option 82
• DHCP Snooping
• Dynamic ARP Inspection
• Source Address Validation
Option 82
RFC 3046 (Relay Agent Information option, or Option 82) is used for class-based IP address assignment.
The code for the Relay Agent Information option is 82, and is comprised of two sub-options, Circuit ID
and Remote ID.
• Circuit ID is the interface on which the client-originated message is received.
• Remote ID identifies the host from which the message is received. The value of this sub-option is the
MAC address of the relay agent that adds Option 82.
The DHCP relay agent inserts Option 82 before forwarding DHCP packets to the server. The server can
use this information to:
• track the number of address requests per relay agent; restricting the number of addresses available per
relay agent can harden a server against address exhaustion attacks.
• associate client MAC addresses with a relay agent to prevent offering an IP address to a client spoofing
the same MAC address on a different relay agent.
• assign IP addresses according to the relay agent. This prevents generating DHCP offers in response to
requests from an unauthorized relay agent.