Policy Framework Configuration Guide - Juniper Networks

Junos 10.4 Policy Framework Configuration Guide
Configuring a Regular Expression for Lines to Be Logged
By default, the trace operation output includes all lines relevant to the logged events.
You can refine the output by including the match option with the file statement at the
[edit forwarding-options helpers traceoptions] hierarchy level and specifying a regular
expression (regex) to be matched:
[edit forwarding-options helpers traceoptions]
file filename match regular-expression;
Example: Configuring DNS Packet Forwarding
Enable DNS packet request forwarding to all interfaces on a router except t1-1/1/2 and
t1-1/1/3:
[edit forwarding-options helpers]
dns {
server 10.10.10.30;
interface {
t1-1/1/2 {
no-listen;
server 10.10.10.9;
}
t1-1/1/3 {
no-listen;
server 10.10.10.4;
}
}
}
Preventing DHCP Spoofing on MX Series Ethernet Services Routers
A problem that sometimes occurs with DHCP is DHCP spoofing. in which an untrusted
client floods a network with DHCP messages. Often these attacks utilize source IP address
spoofing to conceal the true source of the attack.
DHCP snooping helps prevent DHCP spoofing by copying DHCP messages to the control
plane and using the information in the packets to create anti-spoofing filters. The
anti-spoofing filters bind a client’s MAC address to its DHCP-assigned IP address and
use this information to filter spoofed DHCP messages. In a typical topology, a carrier
edge router (in this function also referred to as the broadband services router [BSR])
connects the DHCP server and the MX Series router (or broadband services aggregator
[BSA]) performing the snooping. The MX Series router connects to the client and the
BSR.
DHCP snooping works as follows in the network topology mentioned above:
1. The client sends a DHCP discover message to obtain an IP address from the DHCP
server.
2. The BSA intercepts the message and might add option 82 information specifying the
slot, port, VPI/VCI, and so on.
374
Copyright © 2010, Juniper Networks, Inc.