On Thursday, 2005-08-25 at 11:48 MST, Martin Mkrtchian
<dotsecure@gmail.com> wrote:
We are migrating from Lucent QIP to MetaIP for DHCP services and so
far we have had two issues when MetaIP has been implemented for VLAN
that has an unauthorized Linksys router giving out IP addresses.
Is there a scanning tool out there that can determine if there are
unauthorized Linksys (type) routers in a specific VLAN?
First you say you have a problem with rogue dhcp servers (don't we all?),
then you way you're looking for routers.
For the rogue dhcp server problem, there are 2 types of this problem, but
unfortunately the solutions I've found aren't quite as specific to dhcp as
I would like.
Blocking at layer 3 (router) is relatively easy - you can block traffic to
68/udp except from your official dhcp servers.
Blocking at layer 2 is harder. Here is a suggestion for doing it on Cisco
switches (which might not work on low end equipment - haven't tried that -
the switches must support vlan filtering):
Using vlan filtering, define that rogue traffic is dropped and logged; all
other traffic is forwarded:
vlan access-map dhcpmap 10
match ip address rogue_dhcp
action drop log
vlan access-map dhcpmap 20
match ip address any_host
action forward
exit
An access list that matches all traffic:
ip access-list standard any_host
remark Provide a match (permit) for all traffic
permit any
exit
An access list that matches rogue dhcp traffic. (With Cisco's strange
vlan access mechanism, it requires that we appear to be blocking the valid
traffic and allowing the bad stuff. But, in conjunction with the
access-map, just the opposite occurs.)
ip access-list extended rogue_dhcp
remark Provide a match (permit) for dhcp responses from rogue servers
deny udp host 10.1.32.21 any eq bootpc ! these are my official dhcp
servers
deny udp host 10.1.32.22 any eq bootpc ! likewise
deny udp 10.1.0.0 0.0.252.7 any eq bootpc ! my routers, that might be
relaying legitimate dhcp
permit udp any any eq bootpc ! the match that will catch
the rogues
deny ip any any ! don't catch anything
else
exit
Apply this setup to the vlans supported by my dhcp servers:
vlan filter dhcpmap vlan-list 64-128,136-140,146,232
The way this works it could result in blocking some traffic that you
really don't want to (for example, if any of your users employ PIXIE to
load some of their machines). If so, you will need to add the addresses
of those server machines to the filter as though they were official dhcp
servers - so that their bootpc traffic is not blocked.
Tony Rall
