The Authentication Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Option

Abstract

This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited.

DHCP Server Identifier Override Suboption

“…The DHCP Relay Agent Information option depends on a trusted relationship between the DHCP relay agent and the DHCP server, as described in Section 5 of RFC 3046. While the introduction of fraudulent DHCP relay agent information options can be prevented by a perimeter defense that blocks these options unless the DHCP relay agent is trusted, a deeper defense using the authentication suboption for DHCP relay agent information option [8] SHOULD be deployed as well.…”

“…It could also allow the rogue relay to change, insert, or delete DHCP options in DHCPACK messages and extend leases beyond what the server has allowed. DHCP authentication [6] and/or DHCP Relay Agent Information option authentication [8] would address this case. (Note that, as is always the case, lack of DHCP authentication would allow a rogue DHCP relay agent to change the Server Identifier Override option in the DHCPOFFER and DHCPACK messages without detection.…”

Remote Authentication Dial-In User Service (RADIUS) Attributes Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Information Option

“…Although the introduction of fraudulent relay-agent options can be prevented by a perimeter defense that blocks these options unless the relay agent is trusted, a deeper defense using the authentication option for relay agent options [9] or IPsec [10] SHOULD be deployed as well. …”

Subscriber-ID Suboption for the Dynamic Host Configuration Protocol (DHCP) Relay Agent Option

“…While the introduction of fraudulent relay agent options can be prevented by a perimeter defense that blocks these options unless the relay agent is trusted, a deeper defense using authentication for relay agent options via the Authentication Suboption [6] or IPSec [7] SHOULD be deployed as well.…”