Cisco IOS CMTS Cable Software Configuration Guide, Release 12.2SC - Filtering Cable DHCP Lease Queries on Cisco CMTS Routers [Cisco uBR10000 Series Universal Broadband Routers]

Table Of Contents

Filtering Cable DHCP Lease Queries

Contents

Prerequisites for Filtering Cable DHCP Lease Queries

Restrictions for Filtering Cable DHCP Lease Queries

Information About Filtering Cable DHCP Lease Queries

How to Configure Filtering Cable DHCP LEASEQUERY Requests

Enabling DHCP LEASEQUERY Filtering on Downstreams

Enabling DHCP LEASEQUERY Filtering on Upstreams

How to Configure the DHCP MAC Address Exclusion List for the cable-source verify dhcp Command

Configuration Examples for Filtering Cable DHCP Lease Queries

DHCP Downstream and Upstream DHCP LEASEQUERY Filtering Configuration on an Individual Cable Interface: Example

Additional References

Related Documents

Standards

MIBs

RFCs

Technical Assistance

Command Reference

Filtering Cable DHCP Lease Queries

Document Revision History

Date

Revision

Reason

02/13/2006

OL-2818-06

Added Document Revision History table. Incorporated Cisco IOS Release 12.3(17a)BC enhancements.

This document describes the Dynamic Host Configuration Protocol (DHCP) LEASEQUERY filter feature, which enables the Cisco Cable Modem Termination System (CMTS) router to filter excessive numbers of DHCP LEASEQUERY messages on either the upstream or the downstream cable interface, or both.

Release

Modification

Release 12.2(15)BC1d, Release 12.2(15)BC2b

This feature was introduced for the Cisco uBR7100 series, Cisco uBR7246VXR, and Cisco uBR10012 universal broadband routers.

Release 12.3(13)BC

Support for the MAC Address Exclusion List added for the cable-source verify dhcp command.

Release 12.3(17a)BC

Support for Configurable Leasequery Server using the cable source-verify dhcp server ipaddress command.

Feature History for Filtering Cable DHCP Lease Queries

Finding Support Information for Platforms and Cisco IOS Software Images

Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.

Contents

•Prerequisites for Filtering Cable DHCP Lease Queries

•Restrictions for Filtering Cable DHCP Lease Queries

•Information About Filtering Cable DHCP Lease Queries

•How to Configure Filtering Cable DHCP LEASEQUERY Requests

•How to Configure the DHCP MAC Address Exclusion List for the cable-source verify dhcp Command

•Configuration Examples for Filtering Cable DHCP Lease Queries

•Additional References

•Command Reference

Prerequisites for Filtering Cable DHCP Lease Queries

•The Cisco uBR7100 series, Cisco uBR7246VXR, or Cisco uBR10012 router must be running Cisco IOS Release 12.2(15)BC1d, 12.2(15)BC2b, or later release.

•You must configure a cable interface with the cable source-verify dhcp command and the no cable arp command before the Cisco CMTS router can begin filtering DHCP lease queries. Lease queries will be sent to the DHCP server (or configured alternate server).

To divert DHCP lease queries to a server other than the DHCP server, you must use the cable source-verify dhcp server ipaddress command and the no cable arp command before the Cisco CMTS router can begin filtering DHCP lease queries. Only one alternate server may be configured.

Restrictions for Filtering Cable DHCP Lease Queries

•Lease queries are sent to the DHCP server unless an alternate server is configured.

•Only one alternate server may be configured.

•Users are responsible for the synchronization of the DHCP server and configured alternate server.

•If the configured alternate server fails, lease query requests will not be diverted back to the DHCP server.

Information About Filtering Cable DHCP Lease Queries

To configure the Cisco CMTS router to send DHCP LEASEQUERY requests to the DHCP server, use the cable source-verify dhcp and no cable arp commands. Unknown IP addresses that are found in packets for customer premises equipment (CPE) devices that use the cable modems on the cable interface will be verified. The DHCP server returns a DHCP ACK message with the MAC address of the CPE device that has been assigned this IP address, if any.

To configure the Cisco CMTS router to divert DHCP LEASEQUERY requests to a server other than the DHCP server, use the cable source-verify dhcp server ipaddress and no cable arp commands.

Regardless of which server is configured, the router can then use this information to verify that this CPE device is authorized to use this IP address. This prevents users from assigning unauthorized IP addresses to their CPE devices, without interfering with valid traffic on the upstream or downstream.

Problems can occur, though, when viruses, denial of service (DoS) attacks, and theft-of-service attacks begin scanning a range of IP addresses, in an attempt to find unused addresses. When the Cisco CMTS router is verifying unknown IP addresses, this type of scanning generates a large volume of DHCP lease queries, which can result in the following problems:

•High CPU utilization on the Cisco CMTS router

•High utilization on the DHCP server (or configured alternate server), resulting in a slow response time or no response at all

•Packets can be dropped by the Cisco CMTS router or DHCP server (or configured alternate server)

•Lack of available bandwidth for other customers on the cable interface

To prevent such a large volume of LEASEQUERY requests on cable interfaces, you can enable filtering of these requests on upstream interfaces, downstream interfaces, or both. When this feature is enabled, the Cisco CMTS allows only a certain number of DHCP LEASEQUERY requests for each service ID (SID) on an interface within the configured interval time period. If a SID generates more lease queries than the maximum, the router drops the excess number of requests until the next interval period begins.

You can configure both the number of allowable DHCP LEASEQUERY requests and the interval time period, so as to match the capabilities of your DHCP server (or configured alternate server) and cable network.

How to Configure Filtering Cable DHCP LEASEQUERY Requests

Use the following procedures to configure the filtering of DHCP LEASEQUERY requests on both the downstreams and upstreams of a cable interface:

•Enabling DHCP LEASEQUERY Filtering on Downstreams

•Enabling DHCP LEASEQUERY Filtering on Upstreams

Enabling DHCP LEASEQUERY Filtering on Downstreams

Use the following procedure to start filtering DHCP lease queries on all downstreams in a Cisco CMTS router.

SUMMARY STEPS

1. enable

2. configure terminal

3. cable source-verify leasequery-filter downstream threshold interval

4. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode. Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

cable source-verify leasequery-filter downstream threshold interval
Example:

Router(config)# cable source-verify leasequery-filter downstream 5 10
Router(config)#

Enables leasequery filtering on all downstreams on the Cisco CMTS router, using the specified threshold and interval values:

•threshold—Maximum number of DHCP lease queries allowed per SID for each interval period. The valid range is 0 to 255 lease queries.

•interval—Time period, in seconds, over which lease queries should be monitored. The valid range is 1 to 10 seconds.

Step 4

end
Example:

Router(config-if)# end
Router#

Exits interface configuration mode and returns to privileged EXEC mode.

Enabling DHCP LEASEQUERY Filtering on Upstreams

Use the following procedure to start filtering DHCP lease queries on all upstreams on a particular cable interface.

SUMMARY STEPS

1. enable

2. configure terminal

3. interface cable x/y
or
interface cable x/y/z

4. cable source-verify leasequery-filter upstream threshold interval

5. end

DETAILED STEPS

Command or Action

Purpose

Step 1

enable
Example:

Router> enable

Enables privileged EXEC mode. Enter your password if prompted.

Step 2

configure terminal
Example:

Router# configure terminal

Enters global configuration mode.

Step 3

interface cable x/y
or
interface cable x/y/z
Example:

Router(config)# interface cable 5/1
Router(config-if)#

Enters interface configuration mode for the specified cable interface.

Step 4

cable source-verify leasequery-filter upstream threshold interval
Example:

Router(config-if)# cable source-verify leasequery-filter upstream 2 5
Router(config-if)#

Enables leasequery filtering on all upstreams on the specified cable interface, using the specified threshold and interval values:

•threshold—Maximum number of DHCP lease queries allowed per SID for each interval period. The valid range is 0 to 20 lease queries.

•interval—Time period, in seconds, over which lease queries should be monitored. The valid range is 1 to 5 seconds.

Note Repeat Step 3 through Step 4 to enable the filtering of DHCP lease queries on the upstreams for other cable interfaces. Master and slave interfaces in a cable bundle must be configured separately.

Step 5

end
Example:

Router(config-if)# end

Exits interface configuration mode and returns to privileged EXEC mode.

How to Configure the DHCP MAC Address Exclusion List for the cable-source verify dhcp Command

Cisco IOS Release 12.3(13)BC introduces the ability to exclude trusted MAC addresses from standard DHCP source verification checks, as supported in previous Cisco IOS releases for the Cisco CMTS. This feature enables packets from trusted MAC addresses to pass when otherwise packets would be rejected with standard DHCP source verification. This feature overrides the cable source-verify command on the Cisco CMTS for the specified MAC address, yet maintains overall support for standard and enabled DHCP source verification processes. This feature is supported on Performance Routing Engine 1 (PRE1) and PRE2 modules on the Cisco uBR10012 router chassis.

To enable packets from trusted source MAC addresses in DHCP, use the cable trust command in global configuration mode. To remove a trusted MAC address from the MAC exclusion list, use the no form of this command. Removing a MAC address from the exclusion list subjects all packets from that source to standard DHCP source verification.

cable trust mac-address

no cable trust mac-address

Syntax Description

mac-address

The MAC address of a trusted DHCP source, and from which packets will not be subject to standard DHCP source verification.

Usage Guidelines

This command and capability are only supported in circumstances in which the Cable Source Verify feature is first enabled on the Cisco CMTS.

When this feature is enabled in addition to cable source verify, a packet's source must belong to the MAC Exclude list on the Cisco CMTS. If the packet succeeds this exclusionary check, then the source IP address is verified against Address Resolution Protocol (ARP) tables as per normal and previously supported source verification checks. The service ID (SID) and the source IP address of the packet must match those in the ARP host database on the Cisco CMTS. If the packet check succeeds, the packet is allowed to pass. Rejected packets are discarded in either of these two checks.

Any trusted source MAC address in the optional exclusion list may be removed at any time. Removal of a MAC address returns previously trusted packets to non-trusted status, and subjects all packets to standard source verification checks on the Cisco CMTS.

Note When the cable source-verify dhcp feature is enabled, and a statically-defined IP address has been added to the CMTS for a CM using the cable trust command to override the cable source-verify dhcp checks for this device, packets from this CM will continue to be dropped until an entry for this CM is added to the ARP database of the CMTS. To achieve this, disable the cable source-verify dhcp feature, ping the CMTS from the CM to add an entry to the ARP database, and re-enable the cable source-verify dhcp feature.

For additional information about the enhanced Cable Source Verify DHCP feature, and general guidelines for its use, refer to the following documents on Cisco.com:

•IP Address Verification for the Cisco uBR7200 Series Cable Router

http://www.cisco.com/en/US/docs/ios/12_0t/12_0t7/feature/guide/sourcver.html

•Filtering Cable DHCP Lease Queries

http://www.cisco.com/en/US/docs/cable/cmts/feature/cblsrcvy.html

•Cisco IOS CMTS Cable Command Reference Guide

http://www.cisco.com/en/US/docs/ios/cable/command/reference/cbl_book.html

•CABLE SECURITY, Cable Source-Verify and IP Address Security, White Paper

http://www.cisco.com/en/US/tech/tk86/tk803/technologies_tech_note09186a00800a7828.shtml

Configuration Examples for Filtering Cable DHCP Lease Queries

This section provides the following examples of how to configure the DHCP lease query filtering feature:

•DHCP Downstream and Upstream DHCP LEASEQUERY Filtering Configuration on an Individual Cable Interface: Example

DHCP Downstream and Upstream DHCP LEASEQUERY Filtering Configuration on an Individual Cable Interface: Example

The following example shows an excerpt from a typical configuration of a cable interface that is configured for filtering DHCP LEASEQUERY requests on both its upstream and downstream interfaces:

Note If an alternate server has been configured to receive lease query requests, cable source-verify dhcp server ipaddress would display in place of cable source-verify dhcp below.
!
cable source-verify leasequery-filter downstream 5 20 
! 
interface Cable8/1/0
...
 cable source-verify dhcp 
 cable source-verify leasequery-filter upstream 1 5 
 no cable arp 
... 
Additional References

The following sections provide references related to the DHCP LEASEQUERY filtering feature.

Related Documents

Related Topic

Document Title

CMTS Command Reference

Cisco IOS CMTS Cable Command Reference Guide, at the following URL:

http://www.cisco.com/en/US/docs/ios/cable/command/reference/cbl_book.html

Cisco IOS Release 12.2 Command Reference

Cisco IOS Release 12.2 Configuration Guides and Command References, at the following URL:

http://www.cisco.com/en/US/docs/ios/12_2/security/command/reference/fsecur_r.html

Standards

Standards

Title

SP-RFIv1.1-I09-020830

Data-over-Cable Service Interface Specifications Radio Frequency Interface Specification, version 1.1 (http://www.cablemodem.com)

MIBs

MIBs

MIBs Link

No new or modified MIBs are supported by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

RFCs

Title

RFC 826

An Ethernet Address Resolution Protocol (ARP)

Technical Assistance

Description

Link

Technical Assistance Center (TAC) home page, containing 30,000 pages of searchable technical content, including links to products, technologies, solutions, technical tips, and tools. Registered Cisco.com users can log in from this page to access even more content.

http://www.cisco.com/cisco/web/support/index.html

Command Reference

The following commands are introduced or modified in the feature or features documented in this module. For information about these commands, see the Cisco IOS Cable Command Reference at http://www.cisco.com/en/US/docs/ios/cable/command/reference/cbl_book.html. For information about all Cisco IOS commands, go to the Command Lookup Tool at http://tools.cisco.com/Support/CLILookup or to the Cisco IOS Master Commands List.

•cable source-verify leasequery-filter downstream

•cable source-verify leasequery-filter upstream

•show cable leasequery-filter

CCDE, CCSI, CCENT, Cisco Eos, Cisco HealthPresence, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Stackpower, Cisco StadiumVision, Cisco TelePresence, Cisco WebEx, DCE, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn and Cisco Store are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries. All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0903R)

© 2009 Cisco Systems, Inc. All rights reserved.