Web Management Guide-R04

Chapter 12 | Security Measures
DHCPv6 Snooping
– 380 –
◆ DHCPv6 Snooping Option Remote ID – Enables the insertion of remote-id
option 37 information into DHCPv6 client messages. Remote-id option
information such as the port attached to the client, DUID, and VLAN ID is used
by the DHCPv6 server to assign preassigned configuration data specific to the
DHCPv6 client. (Default: Disabled)
■
DHCPv6 provides a relay mechanism for sending information about the
switch and its DHCPv6 clients to the DHCPv6 server. Known as DHCPv6
Option 37, it allows compatible DHCPv6 servers to use the information
when assigning IP addresses, or to set other services or policies for clients.
■
When DHCPv6 Snooping Information Option 37 is enabled, the requesting
client (or an intermediate relay agent that has used the information fields
to describe itself) can be identified in the DHCPv6 request packets
forwarded by the switch and in reply packets sent back from the DHCPv6
server.
■
When the DHCPv6 Snooping Option 37 is enabled, clients can be identified
by the switch port to which they are connected rather than just their MAC
address. DHCPv6 client-server exchange messages are then forwarded
directly between the server and client without having to flood them to the
entire VLAN.
■
DHCPv6 snooping must be enabled for the DHCPv6 Option 37 information
to be inserted into packets. When enabled, the switch will either drop, keep
or remove option 37 information in incoming DHCPv6 packets. Packets are
processed as follows:
■
If an incoming packet is a DHCPv6 request packet with option 37
information, it will modify the option 37 information according to the
settings specified.
■
If an incoming packet is a DHCPv6 request packet without option 37
information, enabling the DHCPv6 snooping information option will
add option 37 information to the packet.
■
If an incoming packet is a DHCPv6 reply packet with option 37
information, enabling the DHCPv6 snooping information option will
remove option 37 information from the packet.
■
When this switch inserts Option 37 information in DHCPv6 client request
packets, the switch’s MAC address (hexadecimal) is used for the remote ID.
◆ DHCPv6 Snooping Option Policy – Sets the remote-id option policy for
DHCPv6 client packets that include Option 37 information.
When the switch receives DHCPv6 packets from clients that already include
DHCP Option 37 information, the switch can be configured to set the action
policy for these packets. The switch can either drop the DHCPv6 packets, keep
the existing information, or replace it with the switch’s relay agent information.