Re: [dhcwg] DHCPv6 router option

[Frank Sweetser <fs at WPI.EDU>]

John Jason Brzozowski wrote:
> Frank,
>
> Are you suggesting we specify a way in DHC to prevent people from improperly
> configuring their DHCPv6 servers?

Not at all.  I run a network full of students, so I'm thoroughly aware of the 
futility of assuming that all of your clients are well behaved ones =)

My point simply was that, in any network full of untrusted hosts, there are 
multiple ways for a rogue DHCP server to cause network problems, regardless of 
the existence or lack of a router DHCPv6 option.  If you're at all concerned 
about rogue DHCPv6 servers, then you absolutely need some form of switch based 
"DHCP guard" - a filter applied to all edge ports which prevents them from 
sending out the rogue DHCP advertisements.

So in other words, with or without the DHCPv6 router option, you still have to 
spend the time on a DHCP guard or you're going to be vulnerable to rogue DHCP 
servers.

--
Frank Sweetser fs at wpi.edu  |  For every problem, there is a solution that
WPI Senior Network Engineer   |  is simple, elegant, and wrong. - HL Mencken
    GPG fingerprint = 6174 1257 129E 0D21 D8D4  E8A3 8E39 29E3 E2E8 8CEC