In this video, you and I have the opportunity
to design a small network, where we
can play with the HP snooping.
We'll then apply the commands, and then
verify that it's working.
So here's what I propose we do as our plan,
and it's simply this.
We'll have a switch, an access later switch.
And let's plug in a couple of DHCP servers.
So, there's going to be DHCP server 1 and 2.
And we'll make this the good guy,
and we'll make this one the bad guy.
Maybe I should use red for that.
All right.
Mad and evil. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Mad and evil.
OK.
And then we'll put a couple of clients over here.
So we have PCP 1 and PCP 2.
And if we just bring up a new switch,
all the ports will be in VLAN 1 by default.
So they're all going to be in the same VLAN.
And then for our plan, for this DHCP server,
let's go ahead and use the IP address space of 10.16.20.0
with a 24-bit mask.
And for this DHCP server, let's have it handle IP addresses
from the 10.99.99 network, so it's very obvious WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
from the 10.99.99 network, so it's very obvious
which clients get what.
And we'll make PCP 1 and PCP 2 both DHCP clients.
So here's some fun news.
We have many options, as we create, in a lab environment,
DHCP servers.
We could take Cisco routers, we can enable DHCP
by making the pools, assigning the networks,
and the default gateways, and everything else.
Or we could use a simulator.
In fact, I did a series of videos on Packet Tracer.
And Packet Tracer is an amazing tool, at both the CCNA
level and, for much of the CCNP, for regarding WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
level and, for much of the CCNP, for regarding
routing and switching.
So here's what I propose we do.
Let's take the design we just talked about,
and let's build that live inside of Packet Tracer.
Then we can follow it up by implementing DHCP snooping
on top of that, to verify it works.
And if you haven't yet taken a look at the Packet Tracer
videos, right here at CBT Nuggets,
please take a moment to look at those.
This is a fantastic and easy tool to use.
So lets together start with a blank canvas,
and let's build a simple network.
Let's start with the switch.
Down here on the bottom left, we'll
click on Network Devices, click on Switch. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
click on Network Devices, click on Switch.
And let's just go ahead and grab the 2960 switch,
and drag and drop it.
Boom!
Done.
Next, let's grab a couple of DHCP servers.
So we'll click on the End Devices icon here.
And then over here, we'll grab the server icon.
Grab the server.
And then we'll grab another server.
We can change the labels on those if you want to.
And then let's grab some PCs.
So we'll grab a PC, drag it up.
And let's grab a laptop and drag it up.
And let's connect them all together.
So to connect them all together, we grab a connection tool.
And then we use the Automatic Connection Tool, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And then we use the Automatic Connection Tool,
and just click, and click, Automatic Connection Tool,
click, click.
Automatic connection tool, click, click.
Automatic Connection Tool click, click.
And in the Packet Tracer videos, I
walk you through how you can change the options
to show the labels, or not show the labels, and the LED
indicators, and so forth.
Lots of fun to be had.
So now I'm going to stretch these out just a little bit.
And let me rename a few of these things.
So I'm going to call this top server,
I'm going to call it DHCP good.
And we'll call the bottom one DHCP bad. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll call the bottom one DHCP bad.
There we go.
That way we can identify both of them.
And we'll call this top device PC 1.
And we'll call this device PC 2.
Fantastic.
So for the switch, let's just verify that all the ports are
associated with VLAN 1 by default.
So we'll click on the switch, and we'll go to the CLI tab.
Press Enter a few times.
Go into privileged mode, to show VLAN brief.
And I'm going to expand this a little bit,
so it's a little easier to read. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
so it's a little easier to read.
There we go.
And sure enough, all the ports, by default, are in VLAN 1.
So we're good to go from that perspective.
Next, since we're here at the switch,
let's go ahead and enable IP DHCP snooping, with the command
IP DHP snooping.
Just like that.
So do a do show IP DHCP snooping.
Press Enter.
And this says that DHCP snooping is enabled, but is currently
not applied to any VLANs.
So we'll take care of that in a moment.
It's also saying that the insertion of option A2 WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
It's also saying that the insertion of option A2
is enabled, which we want to disable,
because we're not using a relay agent for DHCP.
So the next command we'll do is IP DHCP snooping, VLANs space,
and then we'll apply this to VLAN 1,
because that's where all of our ports are.
Boom.
Now if we do a show IP DHCP snooping in the center,
now it's showing that DHCP snooping is enabled,
and it's also configured for VLAN 1.
Next, let's take care of this bad boy, insertion of option 82
is enabled.
So we'll do a no IP DHCP snooping, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we'll do a no IP DHCP snooping,
and say information option.
Press Enter.
Then a couple up arrow keys, to do a show IP DHCP snooping.
Press enter.
And now the insertion of option 82 is disabled.
So if you do a do show History, plus Enter,
here are the commands that we've issued,
IP DHCP snooping, IP DHCP stooping for VLAN 1,
and no IP DHCP snooping information option.
Now we have one other little problem that's going to arise. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we have one other little problem that's going to arise.
When we tell these clients to be DHCP clients,
and they do their discover messages,
and then those discover messages are
sent to all other ports in the same VLAN,
because they're broadcast, DHCP good, and DHCP bad,
once configured, are both going to do offers.
So we'll get an offer from DHCP good and an offer from DHCP
bad.
And because all of these four ports
are all untrusted by default, once we enable DHCP snooping,
the switch ports, FA0/1 and FA0/2
are going to drop those offers. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
are going to drop those offers.
And these clients are not going to get their responses.
So we also need to tell the switch that this port, FA0/1,
which leads to the real DHCP server that we want to use,
that this port is a trusted port.
So let's do that also.
So we'll go back to the switch.
And here at the switch, we'll go into Interface,
and take a peek at what that interface is.
It is fast FA0/1.
So that interface, FA0/1, and we'll
say IP DHCP snooping, space, and trust. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
say IP DHCP snooping, space, and trust.
Enter.
Boom.
That's now a trusted port.
And we can verify that with a show IP DHCP snooping.
Press enter, and there, it shows that FA0/1 is trusted.
It also shows that DHCP snooping is enabled.
And it's also enabled for VLAN 1.
Fantastic.
All right.
Now, to actually test this and make it work,
we've got to do a little bit of work on the two DHCP servers,
to make sure they're up and active.
And then we all see it turn on some clients,
to make sure they're DHCP clients. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to make sure they're DHCP clients.
So let's start with DHCP good here, in Packet Tracer.
We'll go ahead and click on it, to open up the window for that.
And here, on the window for DHCP good, we'll click on Config.
We'll click on fast Ethernet 0.
We'll specify it has a static address of 10.16,
let's see here.
Let's use 20 for that subnet.
Let me look at our plan.
So our plan was 10.16.20, will be
the network it's handing out.
So we'll put in 10.16.20 dot, and let's use the first IP
address in that range, with a mask of 255.255.255.0. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address in that range, with a mask of 255.255.255.0.
Fantastic.
So now it has an IP address.
Next, let's make sure it's enabled for DHCP services.
So here for this machine, we'll go to services.
We'll go to DHCP here on the left.
And with DHCP selected, we'll specify
that we want DHCP services on.
And we can specify the range.
So let's go ahead and start the range at 101
the first valid IP address, in the 10.16.20 network. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the first valid IP address, in the 10.16.20 network.
Fantastic.
All right.
So it is done.
Let's go ahead and close that.
Let's also configured DHCP bad.
And on DHCP bad, we'll bring that window
in the viewing space here.
And on DHCP bad, we'll go to Config,
we'll go to its interface.
And let's go ahead and use 10.99.99.1.
We'll take the first IP address, with a 24-bit mask.
That's great.
And let's go to Services, and DHCP, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go to Services, and DHCP,
and say that we want to enable it.
And let's start at 101.
So 10.99.99.1 will be the starting address
for the pool of addresses that the DHCP bad server
is going to try to hand out.
So now, with DHCP good set up with an IP address,
and DHCP services enabled, and DHCP bad also
set up, with a different IP address, and different range
of addresses.
Let's go ahead and enable the two clients to be DHCP clients,
and see which IP addresses they pull from,
the good DHCP server or the bad. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the good DHCP server or the bad.
Now, our intention is that, because DHCP snooping
is enabled, and it's also set up for VLAN 1,
and the port that's connected to the bad DHCP server
is not trusted, anytime that server tries to do offers,
those should be rejected, and not make it into the network.
Let's test it.
So here on the PC, we'll just click on it
to bring up the console for that.
And we'll go to Config.
We'll go to fast Ethernet 0.
And we'll simply click on this radio button,
and watch this field right here.
10.16.20, oh, dot 2. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
10.16.20, oh, dot 2.
Didn't we tell it to start at 100?
Let's go check the DHCP server.
So it got the IP address from the correct DHCP server.
But I think the range isn't quite what I expected.
So let's go back to the DHCP server.
Go back to Services, DHCP.
Oh, OK.
So for some reason, the starting address,
I thought I put in a higher number, like 101 or something,
and it didn't take.
That's OK.
I can live with that.
And let's go to PC 2, and make it a DHCP client as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's go to PC 2, and make it a DHCP client as well.
So we'll go to Config, fast Ethernet the 0.
DHCP.
And survey says, 3!
All right.
So I must have mucked up the starting range.
Here's the server again.
I mean, I am curious.
So DHCP, yes.
It's not keeping that.
So start address, it just didn't want to keep the start address.
Fair enough.
All right.
So it's not starting off at 101, or 100.
It's starting off with the first next available address, which
is OK.
The goal here is to verify that we're getting the IP
addresses from the correct server, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
addresses from the correct server,
and not from the DHCP bad server.
So let's go back to the switch, and let's
verify what's going on.
So if you do an up arrow key, show IP DHCP snooping,
press Enter.
It's showing us here that fast Ethernet 0/1 is a trusted port,
that O2, 03, 04, all untrusted.
And as a result, that's why the bad DHCP server
didn't have the opportunity to respond and get any
of its offers into the switch.
And if we else did one other command,
show IP DHCP snipping binding, this WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
show IP DHCP snipping binding, this
is going to give us information about the layer 2 addresses,
and the corresponding IP addresses, that have
been learned via DHCP snooping.
So this says that the client at 10.16.20.2
has this Mac address, and the client with this IP address
has this corresponding Mac address.
In this video, we did three basic things.
Number one, we designed a network.
Two, we put that network in place inside of Packet Tracer.
And third, we implemented and verified
DHCP snooping, to protect the network against rogue DHCP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
DHCP snooping, to protect the network against rogue DHCP
servers, that otherwise may be accidentally or intentionally
added to our network.
And this can protect us against those types of attacks.
And here's the reason why this is important.
It's because in production networks,
rogue DHCP servers do get introduced all the time.
And lot of times, it's accidental.
People bringing stuff from home.
They don't realize DHCP services were enabled on it,
and there's a disruption of network services.
So it's important to understand the concept, to practice it,
to see the results, verify it.
And that way, when it comes time for us WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And that way, when it comes time for us
to either implement this, or verify this, or troubleshoot
this in a production environment,
we'll be that much more ready to help defend and protect
our networks.
So I'm glad you joined me in this video.
I hope this has been informative for you,
and I'd like to thank you for viewing.