12/7/14

How to prevent rogue DHCP servers with DHCP snooping in an HP Procurve switch

This is cool.  I'm using an HP Procurve 2530 switch, running firmware YA.15.16.  These switches, by the way, come with a lifetime next-business-day warranty.

To learn how to configure this feature, I went to HP's support lookup tool, typed in J9777A, looked up the manuals, went into the general reference area, then opened the HP Switch Software Access Security Guide for YA/YB.15.16.

Here are the commands to run:
dhcp-snooping (this enables the feature)
dhcp-snooping trust 8 (this permits a DHCP server to operate on port 8)
dhcp-snooping vlan 1 (this enables the feature on the default VLAN of 1)

Here's a screenshot pre-DHCP-snooping (two DHCP servers respond to the request):



Here's a screenshot with DHCP replies permitted only on port 8 (server is 192.168.100.254):



Here's a screenshot with DHCP replies permitted only on port 1 (server is 192.168.100.110):


The switch also keeps track of what IP address(es) and MAC address(es) are connected to each untrusted port - show dhcp-snooping binding.  If you see a bunch of IP addresses on a port, that could indicate someone has added a downstream switch.


It appears (per this post) that if you have multiple HP switches, you'd want to use no dhcp-snooping option 82.