DHCP hardening Meraki configuration

[CedricMX]

Hello team

I would like to enforce our DHCP security policy on our Meraki network.

We have several MX and several MS.

On a test site i blocked all IPv4 and IPv6 DHCP servers except my 2 MX firewalls (primary and backup) based on their mac adress.

From what i understand, only the 2 MX will be allowed to send DHCP responses ?

Do you know if others parameter can be activated to improve our security posture (Dynamic ARP inspection ??)

Many thanks !

[RaphaelL]

Regarding DHCP you are pretty much limited to DAI , mandatory DHCP and DHCP server blacklist / whitelist

[oliviaaaaa]

Probably the best way to tighten it up is to enable DHCP snooping and mark only MX ports as trusted. Alternatively, you can also use Dynamic ARP Inspection to stop ARP spoofing and monitor for unexpected DHCP activity. In my opinion, this combination covers most of the risks associated with rogue servers.