DHCP Advertisement

[raceman3]

We recently had our internet router scanned by a network security company and one of the potential security issues they saw was port 67 "dhcp" being advertised. I'm not sure why it is being advertised since I don't have it enabled anywhere in the config and bootp is specifically disabled. Any idea how to eliminate it ?

 

[ADB100]

Its not 'advertised' as such - what they mean is they did a port scan on your IP network or IP address (if you have a single device connected such as a firewall etc). When they tried to send a packet to UDP port 67 it was 'open' on your device; i.e. your device is 'listening' on that port. I assume you have a server connected and it is running DHCP but you haven't disabled that service on the ISP facing NIC.

Andy

 

[raceman3]

Thanks for the reply, unfortunately a seperate department handles the firewall & servers, is there a way I can tell the router not to respond

 

[ADB100]

You could add an ACL to deny access to this (these) ports:

ip access list extended STOP-DHCP
deny udp any any range 67 68
permit ip any any

I would assume thought that you already have an ACL attached to your ISP facing router, in which case you would need to add the deny statement to this ACL.

Andy

 

[NetEng631]

Did you specifically disable the DHCP service on the router

No Service DHCP.

Its on by defualt.

 

[raceman3]

Thanks, that's what I was trying to find. The only DHCP options I was able to locate before was under config ip and there wasn't an option to turn it off. This works