Information
Disables the DHCP service
Rationale:
The ASA can act as a DHCP or DHCP Relay server. However, on untrusted interface, attacker can get the opportunity of the availability of the service to perform DoS attacks such as DHCP starvation that will exhaust not only the IP addresses' space but also the memory and CPU resources of the security appliance and bring it down.
NOTE: This check requires manual review. Please review the results to ensure DHCP services are disabled for untrusted interfaces.
Solution
* Step 1: Acquire the name of the untrusted interface <untrusted_interface_name>
* Step 2: Run the following command to disable DHCP service on the untrusted interface
HOSTNAME(CONFIG)# NO DHCPD ENABLE _<untrusted_interface_name> _
* Step 3: Run the following command to disable DHCP Relay service on the untrusted interface
HOSTNAME(CONFIG)# NO DHCPRELAY ENABLE _<untrusted_interface_name> _