We're going to finish up this section with a quick review
regarding DHCP snooping.
Let's begin with question number one,
how does DHCP snooping protect the network?
Take a look at these answers, we'll be back in just a moment.
[MUSIC PLAYING]
And let's take a moment and consider the answers.
Answer A says switch denies inbound DHCP server
messages, which would be true if DHCP snooping was enabled, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
messages, which would be true if DHCP snooping was enabled,
on half-duplex ports.
Now the reality is it would do that
on full-duplex ports or half-duplex ports,
if it was an untrusted DHCP snooping port.
So let's just consider answer A, and look at the rest.
Answer B says switch denies frames
if the maximum MAC address count is exceeded.
That would be an example of port security,
so that's not DHCP snooping.
C, switch denies frames if the user hasn't been authenticated.
That's not applicable here.
We certainly have other features in Cisco that will do that, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We certainly have other features in Cisco that will do that,
but it's not DHCP snooping that's checking
for authenticated users.
Answer D, switch denies inbound DHCP server messages
on untrusted DHCP ports.
That's our winner, right here, answer D. So up here, answer
A kind of looks almost OK, but it's
referring to half-duplex ports.
Answer D is the best answer here, because it's correct.
And it's on to question number two.
Which feature can leverage the information learned via DHCP
snooping and use that to prevent IP address spoofing as well? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
snooping and use that to prevent IP address spoofing as well?
Take a look at the answers and we'll be back in a moment.
[MUSIC PLAYING]
And the answer to this question is source guard.
We can add that on top, using the information
in the DHCP snooping binding table,
to go ahead and also prevent.
If we implement source guard, we can
prevent IP spoofing at layer 3.
And let's do one more question together, and that's this one. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And let's do one more question together, and that's this one.
What is the default for a port when DHCP snooping is applied?
Meaning it's enabled for the VLAN,
what is the default status for a port, regarding DHCP snooping?
[MUSIC PLAYING]
And the answer here is, by default
that port would be an untrusted, DHCP snooping, untrusted port,
meaning no DHCP server type messages would be
allowed to enter into the port. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
allowed to enter into the port.
And if we do have a real DHCP server on our network,
we'd want to go ahead and specify
those ports that lead to the real, authorized DHCP server.
We'd want to hard code those as trusted ports
so that those servers on those trusted ports
could indeed respond.
But the default is untrusted.
So thanks for joining me in these videos,
and in this review section regarding DHCP snooping.
And I'll see you, my friend, in our next video.
Meanwhile, I hope this has been informative for you,
and I'd like to thank you for viewing.
WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000