{"id":438,"date":"2024-03-24T22:15:15","date_gmt":"2024-03-24T21:15:15","guid":{"rendered":"https:\/\/pstrozniak.com\/?p=438"},"modified":"2024-03-24T22:17:22","modified_gmt":"2024-03-24T21:17:22","slug":"co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl","status":"publish","type":"post","link":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/","title":{"rendered":"Co zamiast DHCP Snooping? Alternatywa w postaci ACL"},"content":{"rendered":"\n<p>Podczas pracy z r\u00f3\u017cnymi prze\u0142\u0105cznikami sieciowymi mo\u017cemy natkn\u0105\u0107 si\u0119 te\u017c na ta\u0144sze urz\u0105dzenia tzw. &#8222;Smart Switch&#8221; czyli prze\u0142\u0105czniki zarz\u0105dzalne z du\u017co mniejszymi mo\u017cliwo\u015bciami ni\u017c ich w pe\u0142ni zarz\u0105dzalne odpowiedniki. Problemem, kt\u00f3ry mo\u017cemy napotka\u0107 jest brak funkcji DHCP Snooping bezpo\u015brednio zwi\u0105zanej z bezpiecze\u0144stwem sieci LAN. DHCP Snooping pozwala ochroni\u0107 Twoj\u0105 sie\u0107 LAN przed niepo\u017c\u0105danymi serwerami DHCP w sieci, cho\u0107 to nie jest jego jedyna funkcja. Co w przypadku gdy Tw\u00f3j prze\u0142\u0105cznik nie obs\u0142uguje takiego zabezpieczenia?<\/p>\n\n\n\n<!--more-->\n\n\n\n<p>Na pocz\u0105tek musimy upewni\u0107 si\u0119, \u017ce Tw\u00f3j prze\u0142\u0105cznik obs\u0142uguje konfiguracj\u0119 ACL (ang. Access Control List), je\u015bli ACL s\u0105 obs\u0142ugiwane to \u015bmia\u0142o mo\u017cesz przej\u015b\u0107 dalej. Ja natkn\u0105\u0142em si\u0119 na ten problem przy okazji konfiguracji prze\u0142\u0105cznika Cisco Business CBS250 Smart Switch. Prze\u0142\u0105cznik obs\u0142uguje ACL, wi\u0119c nie wszystko stracone. Konfiguracja, kt\u00f3r\u0105 musimy wykona\u0107, wygl\u0105da tak:<\/p>\n\n\n\n<p>Cisco Business np. seria CBS \/ SG:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip access-list extended DHCP-SRV-DROP\ndeny udp any 67 any any ace-priority 10\npermit ip any any ace-priority 20\n\ninterface gi1\/0\/1\nservice-acl input DHCP-SRV-DROP default-action permit-any<\/code><\/pre>\n\n\n\n<p>Powy\u017csza konfiguracja blokuje ca\u0142y ruch przychodz\u0105cy na interfejs gi1\/0\/1 z portu \u017ar\u00f3d\u0142owego 67\/udp, czyli odpowiedzi z serwera DHCP na danym porcie prze\u0142\u0105cznika. Musisz przypisa\u0107 ACL na ka\u017cdy port prze\u0142\u0105cznika, kt\u00f3ry ma by\u0107 chroniony przed obcymi serwerami DHCP w sieci. Urz\u0105dzenie ko\u0144cowe np. komputer, telefon lub drukarka b\u0119dzie mog\u0142o nadal poprawnie pobra\u0107 prawid\u0142owy adres IP z serwera DHCP pod\u0142\u0105czonego do portu bez takiej ACL.<br><br>A jak taka konfiguracja wygl\u0105da\u0142aby dla Cisco IOS?<\/p>\n\n\n\n<p>Cisco IOS:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ip access-list extended DHCP-SRV-DROP\n10 deny udp any eq 67 any\n20 permit ip any any\n\ninterface GigabitEthernet1\/1\nip access-group DHCP-SRV-DROP in\n\n<\/code><\/pre>\n\n\n\n<p>Jak mo\u017cesz zauwa\u017cy\u0107, wygl\u0105da to prawie identycznie z minimalnymi zmianami w sk\u0142adni polece\u0144. Prawdopodobnie zdecydowana wi\u0119kszo\u015b\u0107 prze\u0142\u0105cznik\u00f3w z Cisco IOS, obs\u0142uguje jednak DHCP Snooping i t\u0119 funkcj\u0119 proponuj\u0119 u\u017cy\u0107 w pierwszej kolejno\u015bci. Dla innych prze\u0142\u0105cznik\u00f3w konfiguracja b\u0119dzie identyczna, mo\u017ce tylko r\u00f3\u017cni\u0107 si\u0119 sk\u0142adnia polece\u0144 lub ca\u0142o\u015b\u0107 trzeba b\u0119dzie wykona\u0107 z GUI. Mo\u017ce si\u0119 te\u017c zdarzy\u0107 tak, \u017ce Tw\u00f3j prze\u0142\u0105cznik nie obs\u0142uguje ACL, w takim przypadku nie da si\u0119 ju\u017c nic z tym zrobi\u0107.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Podczas pracy z r\u00f3\u017cnymi prze\u0142\u0105cznikami sieciowymi mo\u017cemy natkn\u0105\u0107 si\u0119 te\u017c na ta\u0144sze urz\u0105dzenia tzw. &#8222;Smart Switch&#8221; czyli prze\u0142\u0105czniki zarz\u0105dzalne z du\u017co mniejszymi mo\u017cliwo\u015bciami ni\u017c ich w&#46;&#46;&#46;<\/p>\n","protected":false},"author":1,"featured_media":441,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[42,26],"tags":[55,59,54,58,57,56,53],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Co zamiast DHCP Snooping? Alternatywa w postaci ACL - Przemys\u0142aw Str&oacute;\u017cniak<\/title>\n<meta name=\"description\" content=\"ACL jako alternatywna dla DHCP Snoping metoda zabezpieczania sieci LAN. Dowiedz si\u0119, jak skutecznie blokowa\u0107 niepo\u017c\u0105dane serwery DHCP.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\" \/>\n<meta property=\"og:locale\" content=\"pl_PL\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Co zamiast DHCP Snooping? Alternatywa w postaci ACL - Przemys\u0142aw Str&oacute;\u017cniak\" \/>\n<meta property=\"og:description\" content=\"ACL jako alternatywna dla DHCP Snoping metoda zabezpieczania sieci LAN. Dowiedz si\u0119, jak skutecznie blokowa\u0107 niepo\u017c\u0105dane serwery DHCP.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\" \/>\n<meta property=\"og:site_name\" content=\"Przemys\u0142aw Str&oacute;\u017cniak\" \/>\n<meta property=\"article:published_time\" content=\"2024-03-24T21:15:15+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-03-24T21:17:22+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"720\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Przemys\u0142aw Str\u00f3\u017cniak\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Napisane przez\" \/>\n\t<meta name=\"twitter:data1\" content=\"Przemys\u0142aw Str\u00f3\u017cniak\" \/>\n\t<meta name=\"twitter:label2\" content=\"Szacowany czas czytania\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minuty\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\"},\"author\":{\"name\":\"Przemys\u0142aw Str\u00f3\u017cniak\",\"@id\":\"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499\"},\"headline\":\"Co zamiast DHCP Snooping? Alternatywa w postaci ACL\",\"datePublished\":\"2024-03-24T21:15:15+00:00\",\"dateModified\":\"2024-03-24T21:17:22+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\"},\"wordCount\":361,\"publisher\":{\"@id\":\"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499\"},\"image\":{\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png\",\"keywords\":[\"acl\",\"dhcp\",\"dhcp snooping\",\"lan\",\"ochrona lan\",\"prze\u0142\u0105cznik\",\"switch\"],\"articleSection\":[\"dhcp\",\"sieci komputerowe\"],\"inLanguage\":\"pl-PL\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\",\"url\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\",\"name\":\"Co zamiast DHCP Snooping? Alternatywa w postaci ACL - Przemys\u0142aw Str&oacute;\u017cniak\",\"isPartOf\":{\"@id\":\"https:\/\/pstrozniak.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png\",\"datePublished\":\"2024-03-24T21:15:15+00:00\",\"dateModified\":\"2024-03-24T21:17:22+00:00\",\"description\":\"ACL jako alternatywna dla DHCP Snoping metoda zabezpieczania sieci LAN. Dowiedz si\u0119, jak skutecznie blokowa\u0107 niepo\u017c\u0105dane serwery DHCP.\",\"breadcrumb\":{\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#breadcrumb\"},\"inLanguage\":\"pl-PL\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage\",\"url\":\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png\",\"contentUrl\":\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png\",\"width\":1280,\"height\":720},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Strona g\u0142\u00f3wna\",\"item\":\"https:\/\/pstrozniak.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Co zamiast DHCP Snooping? Alternatywa w postaci ACL\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/pstrozniak.com\/#website\",\"url\":\"https:\/\/pstrozniak.com\/\",\"name\":\"Przemys\u0142aw Str&oacute;\u017cniak\",\"description\":\"Specjalista IT\",\"publisher\":{\"@id\":\"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499\"},\"inLanguage\":\"pl-PL\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499\",\"name\":\"Przemys\u0142aw Str\u00f3\u017cniak\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"pl-PL\",\"@id\":\"https:\/\/pstrozniak.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2020\/05\/pstrozniak.jpg\",\"contentUrl\":\"https:\/\/pstrozniak.com\/wp-content\/uploads\/2020\/05\/pstrozniak.jpg\",\"width\":600,\"height\":800,\"caption\":\"Przemys\u0142aw Str\u00f3\u017cniak\"},\"logo\":{\"@id\":\"https:\/\/pstrozniak.com\/#\/schema\/person\/image\/\"},\"sameAs\":[\"https:\/\/www.pstrozniak.com\"],\"url\":\"https:\/\/pstrozniak.com\/author\/admin\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Co zamiast DHCP Snooping? Alternatywa w postaci ACL - Przemys\u0142aw Str&oacute;\u017cniak","description":"ACL jako alternatywna dla DHCP Snoping metoda zabezpieczania sieci LAN. Dowiedz si\u0119, jak skutecznie blokowa\u0107 niepo\u017c\u0105dane serwery DHCP.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/","og_locale":"pl_PL","og_type":"article","og_title":"Co zamiast DHCP Snooping? Alternatywa w postaci ACL - Przemys\u0142aw Str&oacute;\u017cniak","og_description":"ACL jako alternatywna dla DHCP Snoping metoda zabezpieczania sieci LAN. Dowiedz si\u0119, jak skutecznie blokowa\u0107 niepo\u017c\u0105dane serwery DHCP.","og_url":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/","og_site_name":"Przemys\u0142aw Str&oacute;\u017cniak","article_published_time":"2024-03-24T21:15:15+00:00","article_modified_time":"2024-03-24T21:17:22+00:00","og_image":[{"width":1280,"height":720,"url":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png","type":"image\/png"}],"author":"Przemys\u0142aw Str\u00f3\u017cniak","twitter_card":"summary_large_image","twitter_misc":{"Napisane przez":"Przemys\u0142aw Str\u00f3\u017cniak","Szacowany czas czytania":"2 minuty"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#article","isPartOf":{"@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/"},"author":{"name":"Przemys\u0142aw Str\u00f3\u017cniak","@id":"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499"},"headline":"Co zamiast DHCP Snooping? Alternatywa w postaci ACL","datePublished":"2024-03-24T21:15:15+00:00","dateModified":"2024-03-24T21:17:22+00:00","mainEntityOfPage":{"@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/"},"wordCount":361,"publisher":{"@id":"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499"},"image":{"@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage"},"thumbnailUrl":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png","keywords":["acl","dhcp","dhcp snooping","lan","ochrona lan","prze\u0142\u0105cznik","switch"],"articleSection":["dhcp","sieci komputerowe"],"inLanguage":"pl-PL"},{"@type":"WebPage","@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/","url":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/","name":"Co zamiast DHCP Snooping? Alternatywa w postaci ACL - Przemys\u0142aw Str&oacute;\u017cniak","isPartOf":{"@id":"https:\/\/pstrozniak.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage"},"image":{"@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage"},"thumbnailUrl":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png","datePublished":"2024-03-24T21:15:15+00:00","dateModified":"2024-03-24T21:17:22+00:00","description":"ACL jako alternatywna dla DHCP Snoping metoda zabezpieczania sieci LAN. Dowiedz si\u0119, jak skutecznie blokowa\u0107 niepo\u017c\u0105dane serwery DHCP.","breadcrumb":{"@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#breadcrumb"},"inLanguage":"pl-PL","potentialAction":[{"@type":"ReadAction","target":["https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/"]}]},{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#primaryimage","url":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png","contentUrl":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2024\/03\/dhcp-snooping.png","width":1280,"height":720},{"@type":"BreadcrumbList","@id":"https:\/\/pstrozniak.com\/co-zamiast-dhcp-snooping-alternatywa-w-postaci-acl\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Strona g\u0142\u00f3wna","item":"https:\/\/pstrozniak.com\/"},{"@type":"ListItem","position":2,"name":"Co zamiast DHCP Snooping? Alternatywa w postaci ACL"}]},{"@type":"WebSite","@id":"https:\/\/pstrozniak.com\/#website","url":"https:\/\/pstrozniak.com\/","name":"Przemys\u0142aw Str&oacute;\u017cniak","description":"Specjalista IT","publisher":{"@id":"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499"},"inLanguage":"pl-PL"},{"@type":["Person","Organization"],"@id":"https:\/\/pstrozniak.com\/#\/schema\/person\/a920dd37cd2a1cb9092ed31d62d23499","name":"Przemys\u0142aw Str\u00f3\u017cniak","image":{"@type":"ImageObject","inLanguage":"pl-PL","@id":"https:\/\/pstrozniak.com\/#\/schema\/person\/image\/","url":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2020\/05\/pstrozniak.jpg","contentUrl":"https:\/\/pstrozniak.com\/wp-content\/uploads\/2020\/05\/pstrozniak.jpg","width":600,"height":800,"caption":"Przemys\u0142aw Str\u00f3\u017cniak"},"logo":{"@id":"https:\/\/pstrozniak.com\/#\/schema\/person\/image\/"},"sameAs":["https:\/\/www.pstrozniak.com"],"url":"https:\/\/pstrozniak.com\/author\/admin\/"}]}},"_links":{"self":[{"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/posts\/438"}],"collection":[{"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/comments?post=438"}],"version-history":[{"count":4,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/posts\/438\/revisions"}],"predecessor-version":[{"id":443,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/posts\/438\/revisions\/443"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/media\/441"}],"wp:attachment":[{"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/media?parent=438"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/categories?post=438"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pstrozniak.com\/wp-json\/wp\/v2\/tags?post=438"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}