dhcp session-mismatch

Usage Scenario

In a WLAN scenario, when end users switch their SSIDs, their physical location information is changed, but their MAC addresses stay the same. In this situation, the end users resend DHCP or ND requests. Since the physical location information is changed but the MAC addresses stay the same, the device concludes that the resent DHCP or ND requests are attack packets and discards them. The device considers the end users are still online, but the end users may have gone offline. The device cannot sense that the end users are offline immediately. As a result, the end users cannot go online again quickly. You can run the dhcp session-mismatch action offline command to log out the end users when the end users resend DHCP or ND requests. After that, when the end users continue to send DHCP or ND requests, the end users can go online again quickly.

When a WLAN user roams between different APs, the user resends DHCPv4 Discover or Request messages or DHCPv6 Solicit messages for login from the new AP. Because the user's VLAN and interface information has changed (MAC address unchanged), the device considers the messages newly received from the user as attacks and then discards them. This prevents the device from immediately detecting that the WLAN user has logged off. As such, the user cannot rapidly log in from the new AP. To resolve this problem, run the dhcp session-mismatch action roam { ipv4 | ipv6 } * command.

Prerequisites

WLAN user roaming switchover has been enabled using the wlan-switch enable command.

Configuration Impact

Note:

If an attacker forges a MAC address to send a DHCP or ND request packet after you run this command, the normal online user is logged out. This may cause a potential security risk, exercise caution when you run this command.

After this command is run, the CPU usage may go up. To address the issue, run the dhcp connection chasten command or refer to Enabling One-to-Many Mapping Between One MAC Address and Many Sessions.

Precautions

In VS mode, this command is supported only by the admin VS.

This dhcp session-mismatch action {roam { ipv4 | ipv6 | nd } *} command does not support VE interfaces and PW-VE interfaces.

In an IPoE access scenario, after one-to-many mapping between one MAC address and multiple sessions is enabled, run the dhcp session-mismatch action offline command. After a user logs in from another interface, the user re-logs in as a new user, with no need for making the user log out from the original interface.