Adjusting DHCPv4 Service Parameters

You can adjust DHCPv4 service parameters to enhance the security of the DHCPv4 service.

Usage Scenario

After configuring a DHCPv4 server, you need to configure the security function of the DHCPv4 service. This enhances security of the DHCPv4 service and prevents other unauthorized DHCPv4 servers from assigning invalid IP addresses to clients. By viewing logs, the administrator determines whether there are unauthorized DHCPv4 servers assigning invalid IP addresses to clients.

Pre-configuration Tasks

Before adjusting DHCPv4 parameters, configure a DHCPv4 server.

(Optional) Configuring Global DHCPv4 Parameters: Global DHCPv4 parameters include the maximum number of DHCPv4 access users allowed for a specified board and the limit on the packet transmission rate of a DHCPv4 server group.

Configuring a DHCP Option: DHCP provides a framework for parameter transmission over the TCP/IP network. The DHCP client and server can transmit the negotiated parameters and control information to each other through options.

(Optional) Configuring the Format for Encapsulating the Option 82 Attribute into DHCP Messages: This section describes how to enable a device to insert Sub-option 2 (remote ID) into the Option 82 attribute or replace Sub-option 2 carried in the Option 82 attribute of a message to be sent to the DHCP server based on a fixed format.

(Optional) Shortening the User Address Lease Before a DHCPv4 Server Restarts: The user address lease can be shortened before a DHCPv4 server restarts. This change allows DHCP users to get online within a short period of time after the DHCPv4 server restarts due to an upgrade without restarting the terminal.

Configuring Transparent Transmission of DHCPv4 Packets: You need to configure transparent transmission of DHCPv4 packets when STB users send only one DHCPv4 Discover packet after they restart.

(Optional) Enabling the BRAS to Transparently Transmit NAK Messages to DHCP Clients: In scenarios where IP addresses are assigned from a DHCP remote address pool, if a DHCP client sends a Discover message to the DHCP server through a BRAS and the BRAS receives a NAK message from the DHCP server, the BRAS discards the NAK message by default. After the BRAS is enabled to transparently transmit NAK messages to clients, the clients can be informed of login failures if parsing of NAK messages is supported on the client terminals.

Enabling a DHCPv4 Server to Detect Unauthorized DHCPv4 Servers: Enabling a DHCPv4 server to detect unauthorized DHCPv4 servers help prevent unauthorized DHCPv4 servers from allocating invalid IP addresses to clients.

Enabling IP Address Conflict Detection: Enabling IP address conflict detection allows the NetEngine 8000 F that functions as a DHCPv4 server to send ping packets to detect IP address conflicts.

Saving DHCPv4 Data: After the DHCPv4 data of the NetEngine 8000 F that functions as a DHCPv4 server is saved to a storage device, the data can be restored from the storage device when the NetEngine 8000 F fails.

Restoring DHCPv4 Data: DHCPv4 data restoration allows the NetEngine 8000 F that functions as a DHCPv4 server capable of saving DHCPv4 data to a storage device to restore saved information about address leases and address conflicts.

(Optional) Configuring the NetEngine 8000 F to Log Out an Online User and Deny Access of a New User After Detecting an IPv4 Address Conflict: You can configure the NetEngine 8000 F to log out an online user and deny access of a new user if it detects that the IP address assigned to the new user from a remote address pool or by the RADIUS server is the same as the IP address of the online user.

Verifying the DHCPv4 Parameter Configuration: After adjusting DHCPv4 parameters, verify DHCPv4 server information and the storage path of the DHCPv4 data.