In this video, I'd like to chat with you about a few
of the ingredients and commands that you and I are
going to use to implement DHCP snooping
and also reinforce where in our enterprise
we're going to implement this feature.
So let's consider where a rogue or malicious DHCP
server might be injected.
And it's very likely going to be injected where users
can connect to the network.
And that's to the access layers.
So if we have access layer switches with wiring
that goes over to the offices and cubes,
it's really here, the access layer
and the access layer switches, where WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and the access layer switches, where
you'd want to implement the feature of DHCP snooping.
So let's imagine that, for this network up here--
let's say this is VLAN 30 that's being supported up here.
And these are trunks going down to the core and distribution
layer.
And let's imagine our DHCP server is right here,
our legitimate one.
So to implement DHCP snooping on this access layer switch,
here's the command we'd use.
We'd use the command ip dhcp-- WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'd use the command ip dhcp--
put my little spaces in there--
snooping-- Enter.
Boom, now that enables DHCP snooping, the feature,
on the switch.
But it doesn't apply the feature to this VLAN.
So we need to add one more command.
That is ip space dhcp space snooping space vlan space--
and then if it's VLAN 30, we'd put a 30 right there.
So now, with this one-two punch, the feature's enabled.
And it's applied to VLAN 30.
So with this in place, let's consider this machine WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So with this in place, let's consider this machine
right here.
We'll call it PC--
one, two, three, four, five, PC 5.
It boots up.
It's a DHCP client.
It does a DHCP discover message.
So in the discover message, it's going
to send out a broadcast frame.
And for the source layer two address,
it's going to use its MAC address.
And then inside the DHCP message, the discover message,
it's going to include its layer two address.
If those two MAC addresses, the one that's
in the layer two header and the one that's in the DHCP
discover message itself, if those are not the same,
this port right here says, eh, I'm not letting that go in. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
this port right here says, eh, I'm not letting that go in.
It's not congruent.
Something funny is going on.
And that's because all the ports in this VLAN--
VLAN 30-- by default are considered untrusted.
And so there's some extra inspections
that are going to go on as a result of that.
Also, if Bob or somebody else plugs into an access port here
and they have a DHCP server, meaning
they have a device that is trying to do DHCP offer
messages or acknowledgment messages, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
messages or acknowledgment messages,
if the switch with DHCP snooping sees
any of those server-type DHCP messages
trying to enter the network on a non-trusted or untrusted DHCP
snooping port, it's going to drop those.
And then we were protecting our network
from having unauthorized DHCP servers added or connected
to our network.
So if this client does a discover message,
and that discover is broadcast, and it's forwarded down
the trunk, and this DHCP server sees it, my question is,
what's a really good DHCP server going
to do if it gets a discover message?
Well, you might be saying, well, Keith, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, you might be saying, well, Keith,
it's going to respond with an offer.
Exactly, and that's where the problem comes in
if we have DHCP snooping enabled for the entire VLAN.
Check this out.
When the server responds with the offer,
saying, hey, I've got a beautiful IP address.
You're going to love it.
And it tries to send it into the switch.
It goes in here to core 2, because core 2 does not
have DHCP snooping enabled.
That gets forwarded up the trunk and up to the access layer
switch.
But right here, on this trunk port, guess what?
DHCP snooping is enabled for VLAN 30. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
DHCP snooping is enabled for VLAN 30.
So that's tagged VLAN 30.
It's a DHCP offer coming in.
And the access switch says untrusted port, eh, and kills
it, which is not the intent.
So what we would also want to do is we'd also want to specify,
from the access layer's switches perspective, which ports
are to be trusted, meaning which ports lead to legitimate DHCP
servers.
So on the access layer switch, if this
is port 0/1 that goes down to core 1 and 0/2 that goes down
the core 2, we'd want to configure both of those trunk WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the core 2, we'd want to configure both of those trunk
ports as being trusted--
IP DHCP snooping trusted ports.
And the syntax to do that would be
to go into interface configuration
mode for these two trunk interfaces on the access layer
switch.
And we'd use the command ip dhcp snooping--
I'll put a snoop for short-- space trust.
And if we did that for each of these two trunk ports,
that would make them trusted ports.
And, as a result, when the DHCP server sends its offer,
and its acknowledgments and messages from the server back WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and its acknowledgments and messages from the server back
up into that access layer switch,
the access layer switch will allow it,
because it's coming in on a trusted port.
So in this example, all of the access ports
would be untrusted from a DHCP snooping perspective.
And the trunk ports would both be configured as trusted ports.
And there's one more element that
often causes DHCP snooping to be so
good at what it does it doesn't allow any DHCP
services to work.
And that is option 82.
In many networks, there's DHCP relay agents
that listen for DHCP discoverers on a given broadcast network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
that listen for DHCP discoverers on a given broadcast network.
And then they unicast that, or they route it,
over to the DHCP server.
Well, option 82 includes information
about that DHCP relay agent.
If we're using DHCP snooping, it can add that option 82
information as part of the DHCP request.
We don't need that added information.
In fact, if we add that information,
it might cause DHCP services not to function correctly.
So this command right here, no ip dhcp snooping information
option says don't--
please don't include the option 82 information WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
please don't include the option 82 information
to the DHCP messages.
And sometimes, if that information is left on
and DHCP snooping injects it, it causes DHCP services to fail.
So please be aware of that command as well.
In our next video, join me as we take a look
at building a small network where
we can implement DHCP snooping and verify its results.
So I'll see you there in just a few moments.
Meanwhile, I hope this has been informative for you.
And I'd like to thank you for viewing.