1

Recently encountered issue of Rogue DHCP, so wanted to protect my network by implementing DHCP snooping. Have HP 2510 Switches installed, but after searching the internet i found that HP 2510 switches does not support DHCP Snooping. Is there any other technique to protect network from un authorised DHCP servers,

Thanks

  • 3
    You may have to upgrade your switches... someone has been in your situation before: community.spiceworks.com/topic/… – user4565 May 16 '16 at 19:26
  • Upgraded HP 2510 switches from SW version 11.67 to 11.74, btu still the same it does not support DHCP-SNOOPING – Asim Ali May 19 '16 at 10:28
  • Capture a DHCP offer, and check which switch port lists the MAC address of the server. – Zac67 Jun 15 '17 at 15:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 13 '17 at 20:27
2

Since this is still open: the 2510 doesn't support DHCP snooping nor ACLs that could be used in a similar way.

protected-ports can be used to prevent communication between client ports, seemingly stopping rogue DHCP servers - but this will only work on a single switch. Interconnecting 2510 switches through (obviously) unprotected ports opens the opportunity for rogue DHCP servers across this interconnect. You'll need an uplink/interconnecting switch with better filtering capabilities.

| improve this answer | |
0

In a test environment you will have to try a multi layered solution.

  1. On your L2 2510 switches try the "protected-port" feature available for the 2510 series

https://serverfault.com/questions/539077/hp-procurve-2512-2524-protected-port-source-port-filter-or-similar

https://serverfault.com/questions/539077/hp-procurve-2512-2524-protected-port-source-port-filter-or-similar

  1. On your L3 cores update/create ACLs that permits "ip helpers" to your legit dhcp servers and denies rogues.

If all fails, upgrade your switches for newer models that supports the feature sets you require?

| improve this answer | |
  • You should point out that while protected-port may be able to protect from rogue DHCP servers, its function is completely different. – Zac67 Oct 13 '17 at 17:49
0

DHCP Snooping is what you need.

HP ProCurve LAN products software feature matrix indicates your HP 2510 switch doesn't support it.

enter image description here

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.