I'm a big fan for a deal.
Like if we buy something, and they say, oh, by the way,
for just this little bit more, you
get these additional features or functions--
I'm a sucker for that almost every time.
Well, in the world of security, for our switches,
if we've implemented DHCP snooping,
our switches are listening to all the DHCP traffic.
They're keeping the rogue DHCP servers out.
But, at the same time, they're also
learning the IP addresses that have
been assigned to our clients.
And they know their associated layer 2 addresses.
And that's in a binding table.
What we can do is we can enable another feature WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What we can do is we can enable another feature
called Source Guard.
And what this does, it helps protect the network
against those hosts that are now connected to the network
from lying--
lying about their source IP addresses
or lying about their source MAC addresses.
Let's take a closer look.
So let's use this scenario where we have an access layer switch.
DHCP snooping is already enabled.
Here's a DHCP client.
It did a discover, offer, acknowledgement, request
acknowledgment process with the DHCP server.
So in addition to what the switch normally knows,
which is the layer 2 address and what port it's on, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
which is the layer 2 address and what port it's on,
the switch also now knows-- because of the DHCP snooping,
it now knows the IP address and the MAC address that
are associated with this port.
Now, what we could do with that-- and this is really,
really cool--
is called Source Guard.
And with Source Guard, we can go to this interface,
this port on the switch.
And we can say, dear Mr. Switch, if traffic coming
in on this port, if it does not have the source
address of this IP address and it does not
have this source MAC address of this coming in,
go ahead and deny the traffic. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
go ahead and deny the traffic.
So that way, if the client is running some kind of software
or malware that is trying to trick the network and spoof
source addresses or source MAC addresses,
the switch can go ahead and drop it right here
just by using Source Guard.
And so let me take you to a network where we already
have DHCP snooping installed.
It's working and functioning.
And what we'll do is we'll simply
add on the command for Source Guard on this port.
In fact, let me show you what that command is.
In interface configuration mode, the command
is ip verify source.
Now we could press Enter right there after we type in source. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now we could press Enter right there after we type in source.
And that would verify that the source IP address is correct.
But if we want to include the source IP
address and the source MAC address,
we can add on the next keyword, which is port security.
So if you're like me, when I saw that keyword, port security,
for the first time, I thought, port security?
Wait a sec, port security is the feature
where we're controlling the number of MAC addresses
on a port.
So it's very likely, when these commands and these security
techniques were created, it was probably two separate teams.
And they both didn't realize they
were using the same kind of concept or term WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
were using the same kind of concept or term
of port security.
So here, as used as part of Source Guard, when
we use the port security option, is simply means,
besides the IP address verification of the source IP,
also, let's verify the source MAC address
associated with that IP.
And that's what it means in this context.
So this is a one-liner command to add
in interface configuration mode on a port.
Let me go ahead and demonstrate that for you.
So here on the access switch, let's just
confirm that DHCP snooping is working.
We'll do a show ip dhcp snooping--
Enter.
And it is. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And it is.
And if we do a show ip dhcp snooping binding,
it can show us what it already knows about.
So in the binding table, it says, yep,
I know about this IP address with
this associated MAC address.
And it's in VLAN 30.
I learned about it via DHCP snooping.
And it's also possible for us to manually enter IP addresses
and MAC addresses to become part of this table.
This is just showing us how this entry right here
was learned via DHCP snooping.
And it was learned on gig 0/1.
That's where our client is.
So if we wanted to add Source Guard, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if we wanted to add Source Guard,
we could simply go into interface configuration mode
and use the command ip verify source space port-security.
And then going forward on this port, any traffic
that is sourced from an IP address other than this one,
or if it's sent from a layer 2 address other this one,
the switch will drop the packet right there
at that switch port.
So let's go into configuration mode.
We'll go into to interface gig 0/1.
And we'll issue the command ip verify source. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And we'll issue the command ip verify source.
And then, if we wanted to, this is
implying that we could press Enter right here, a carriage
return.
And that would just verify the source IP address.
Or we could add on the keyword of port security.
And that's now also going to verify the source layer two
information in each of the frames coming in on that port.
And then we can do the command show ip source binding.
This is just simply showing us the table
that it's going to be pulling from.
So right now, we only have one entry that
was learned via DHCP snooping.
It's for that client.
Then if we do the command show ip verify source and press WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Then if we do the command show ip verify source and press
Enter, it'll give us the details on what it's controlling.
So the show ip verify source says, OK, I'm gig 0/1.
I'm going to be watching for the source IP address
and the source MAC address.
And then, regarding what source IP address and layer 2
address to compare against and allow,
it's using and leveraging the information that
was gained via DHCP snooping.
So if the client spits out a source MAC
address other than this one or it spits out a source IP
address other than this one, the packet WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
address other than this one, the packet
will be dropped based on this add-on feature that we just
put in called Source Guard.
In this video, we've taken a look
at how we can improve our security
by adding on Source Guard.
So since we already have, from DHCP snooping, information
about the layer 2 address and associated IP address,
with Source Guard, we're simply training that interface
that, hey, if any traffic comes into this port
and the source address for the layer 2 or the source address
for IP is wrong or doesn't match up, go ahead and drop it
right there, which is an awesome security measure. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right there, which is an awesome security measure.
So thanks for joining me in this video.
I hope this has been informative for you.
And I'd like to thank you for viewing.