All language subtitles for Free-CCNA-DHCP-Snooping-Day-50-CCNA-200-301-Complete-Course_en

This is a free, complete course for the CCNA.

If you like these videos, please subscribe\n

Also, please like and leave a comment, and\n

In this video we will talk about DHCP snooping.

DHCP snooping is a security feature available\n

attacks which take advantage of DHCP.

DHCP snooping is covered in exam topic 5.7,\n

layer 2 security features including DHCP snooping,\n

We already covered port security, and dynamic\n

But for this video, let’s focus on DHCP\nsnooping.

Here’s what we’ll cover in this video.

Basically, it will be similar in structure\n

I’ll introduce what DHCP snooping is, how\n

to configure it on Cisco switches.

And make sure to watch until the end of the\n

Software’s ExSim for CCNA, my recommended\n

Okay, let’s take a look at the basics of\nDHCP snooping.

DHCP snooping is a security feature of switches\n

I’ll tell you more about untrusted ports\nin a minute.

Note that DHCP snooping only filters DHCP\nmessages.

Any other non-DHCP messages aren’t affected.

All ports are untrusted by default.

It’s then up to you to configure which ports\nwill be trusted.

Usually, uplink ports are configured as trusted\n

I’ll use this diagram to explain.

So, R1 is either a DHCP server or a DHCP relay\nagent.

The end hosts, the PCs, will use DHCP to receive\n

The downlink ports on the switches, the interfaces\n

The network admin doesn’t have direct control\n

A malicious user could initiate a DHCP-based\n

best to leave these ports in the default untrusted\nstate.

So, which interfaces are downlink ports?

These ones, because they point toward the\nend hosts.

However the uplink ports point toward the\n

We can be pretty sure, for example, that R1\n

So, we can configure these interfaces as trusted\nports.

DHCP snooping won’t inspect any messages\n

So, which ports are uplink ports?

These ones, because they point away from the\n

DHCP snooping won’t inspect DHCP messages\non these ports.

Now let’s look at an example of DHCP snooping.

PC1 sends a DHCP message, for example a DISCOVER\nmessage.

SW1 receives the message on an untrusted port,\n

It determines that the message is fine, so\n

Then SW2 receives it, again on an untrusted\ninterface.

It checks the message and determines that\n

R1 then sends the reply, and it goes straight\n

Why don’t the switches inspect the message\nfrom R1?

It’s because they received it on their trusted\n

This time PC2 sends a DHCP message.

SW1 receives it on an untrusted port, so it\n

However, this time it determines that the\n

Later in this video I’ll go over exactly\n

is OK or not, so I won’t get into the details\nnow.

But perhaps the user of PC2 was trying to\n

Okay, next let’s look at a couple examples\n

First up, let’s quickly review a type of\n

also called DHCP exhaustion, attack.

In this attack, an attacker uses spoofed MAC\n

And what’s the purpose of that?

The target server’s DHCP pool becomes full,\n

They won’t be able to get an IP address\nfrom the server.

You already know this by now, but here’s\na review.

The attacker sends DHCP discover messages\n

Now, something I didn’t mention before is\n

message, written as CHADDR, which stands for\n

Why is this field needed, when the server\n

Well, in a network like this where the DHCP\n

But if the DHCP server is in a remote network\n

relay agent, when the server receives the\n

of the frame will not be the client’s MAC\naddress.

So, that’s why the client hardware address\n

The attacker sends countless fake DHCP Discover\n

Then, when the other devices in the network\n

is not able to assign them addresses, resulting\n

And here’s one more example of a DHCP-based\nattack.

Similar to ARP poisoning, DHCP poisoning can\n

A spurious DHCP server, that just mean an\n

DHCP Discover messages and assigns them IP\naddresses.

But it makes the clients use the spurious\n

So, in the network below the attacker is running\n

R1 is the legitimate DHCP server, and also\nthe default gateway.

Both of these DHCP servers will respond to\n

usually accept the first Offer message they\nreceive.

Now, in a situation like this it’s hard\n

clients first, the attacker’s Offer or R1’s\nOffer.

But, if the legitimate DHCP server is actually\n

as a DHCP relay agent, then it’s almost\n

reach the clients first, because it’s in\nthe local network.

No need to forward traffic to a remote network.

So, if the clients use the attacker as their\n

networks they will send traffic to the attacker\n

The attacker can then examine and/or modify\n

Let’s walk through that process.

PC1 sends a DHCP Discover message and it is\n

So, both the attacker and R1 send Offer messages\nfor PC1.

However, in this case the attacker’s Offer\nreaches PC1 first.

Because it arrives first, PC1 will choose\n

So, PC1 will send a DECLINE message to R1.

I haven’t introduced this message type yet,\n

However, with the attacker it completes the\n

address, 172.16.1.10, and its default gateway\n

So, if PC1 wants to send traffic to an external\n

send the traffic to the attacker.

The attacker can then examine the traffic\n

it to the legitimate default gateway, which\n

Because the traffic does reach its destination,\n

traffic is being intercepted by the attacker.

So those were two examples of DHCP-based attacks\n

Now let’s continue looking at DHCP snooping\nitself.

Let’s review the DHCP message types you\n

When DHCP snooping filters messages, it differentiates\n

DHCP server messages received on an untrusted\n

DHCP client messages will be inspected, and\n

So, here are messages sent by DHCP servers.

OFFER and ACK you already know, they are used\n

NAK is a new one, it’s the opposite of ACK\n

And here are messages sent by DHCP clients.

You already know DISCOVER and REQUEST, again\n

RELEASE you already know too, I introduced\nit in the DHCP video.

But for review, it’s used to tell the server\n

And then there’s DECLINE, which I just showed\nearlier.

It’s used to decline the IP address offered\nby a DHCP server.

Make sure you learn which messages are sent\n

It’s an important part of understanding\nDHCP snooping.

Next, I’ll give you an outline of DHCP snooping\noperations.

By that I mean, how it works to filter DHCP\nmessages.

First of all, if a DHCP message is received\n

Messages received on trusted ports won’t\nbe dropped.

But, if a DHCP message is received on an untrusted\n

First, if it’s a DHCP server message, discard\nit.

DHCP servers should not be connected to untrusted\n

So, any OFFER, ACK, or NAK messages that are\n

However, if the message is a DHCP client message,\n

So, these checks depend on what kind of message\nit is.

First, for DISCOVER and REQUEST messages,\n

if the frame’s source MAC address and the\n

If they match, forward the frame.

This can protect against attacks when an attacker\n

However it’s not perfect, because the attacker\n

Then, for RELEASE and DECLINE messages, check\n

interface receiving the message match the\n

If they match, forward the message.

I haven’t mentioned the DHCP snooping binding\ntable yet.

When DHCP snooping is enabled, the switch\n

binding table when a client successfully leases\n

Let’s take a look at that in the next slide.

So let’s go over some basic DHCP snooping\nconfigurations.

First, on SW2 I used IP DHCP SNOOPING.

This enables DHCP snooping on the switch,\nbut it’s not enough.

I then used IP DHCP SNOOPING VLAN 1 to tell\n

So, you need to enable DHCP snooping globally,\n

on each VLAN necessary, with IP DHCP SNOOPING\nVLAN.

So, I enabled it for VLAN 1 because that’s\n

Then I used NO IP DHCP SNOOPING INFORMATION\nOPTION.

I’m going to explain this later, so we’ll\nskip it for now.

It’s not always necessary, but depending\n

Finally, I configure the G0/0 interface as\na trusted port.

As I said before, by default all ports will\n

G0/0 is connected to R1, which is the DHCP\n

Then I did the exact same configurations on\nSW1.

I configured SW1’s G0/0 as trusted, because\n

Then I checked the DHCP snooping binding table\n

As you can see, PC1, PC2, and PC3 were able\n

This table logs their MAC addresses, IP addresses,\n

As I mentioned in the previous slide, RELEASE\n

sure their IP address and interface ID match\n

This prevents attackers from sending these\n

network, causing the DHCP server to believe\n

Okay, next up another function of DHCP snooping,\n

DHCP snooping can limit the rate at which\n

If the rate of DHCP messages crosses the configured\n

Then, similar to port security, the interface\n

then NO SHUTDOWN, or automatically re-enabled\n

Here’s how to configure DHCP rate limiting.

I configured it on SW1’s G0/1, 2, and 3\n

This limits DHCP messages to 1 per second.

If the interface receives more than 1 DHCP\n

Now, this is too low for a real network.

If you set the limit to 1 DHCP message per\n

get disabled even by legitimate DHCP exchanges.

But, I set it to 1 so I could easily make\n

These log messages show that G0/1 received\n

So, we could manually re-enable it, but let’s\n

Here’s how to enable errdisable recovery\nfor DHCP rate limiting.

ERRDISABLE RECOVERY CAUSE DHCP-RATE-LIMIT.

I then checked SHOW ERRDISABLE RECOVERY, and\n

Also notice at the bottom that G0/1 is waiting\n

So, what’s the purpose of rate-limiting\nDHCP messages?

Well, it can be very useful to protect against\n

Remember, attackers can spoof both the frame’s\n

client hardware address field to bypass the\n

But, with rate limiting we can prevent them\n

of illegitimate DHCP DISCOVER messages.

If the attacker tries to flood the server\n

So, this is a very useful function of DHCP\nSnooping.

Okay, let’s go over that command that I\n

First, what is the information option?

Option 82, also known as the DHCP relay agent\n

In the DHCP video of this course I mentioned\n

Option 82 provides additional information\n

client’s message, on which interface, in\nwhich VLAN, etc.

DHCP relay agents can add Option 82 to messages\n

With DHCP snooping enabled, by default Cisco\n

they receive from clients, even if the switch\n

By default, Cisco switches will drop DHCP\n

PC1 sends a DISCOVER message, and SW1 forwards\n

Because SW2 receives it on an untrusted port,\n

You can see the syslog message here, indicating\n

So, the default settings work well if the\n

relay agent, but in a network like this one\nit won’t work.

So, that’s why I used this command I showed\n

PC1 sends a DISCOVER message, and SW1 forwards\nit to SW2.

This time it doesn’t add Option 82.

But let’s assume that I haven’t used the\n

So SW2 will add Option 82 and forward it to\nR1.

This will cause R1 to drop it.

You can see R1’s log messages below.

Basically, it means that R1 dropped the message\n

That’s what ‘inconsistent relay information’\n

If a DHCP message wasn’t sent by a relay\n

So, I added the command to SW2 also.

This time, neither SW1 or SW2 will add option\n

So, R1 trusts the message and responds as\nnormal.

I’m not sure if you’ll get any questions\n

good to know about because it can cause problems\n

Okay, here’s a review of the new commands\n

If you don’t remember any of these commands,\n

Before moving on to the quiz, let’s review\n

I first introduced what DHCP snooping is.

It’s a security feature of switches that\n

It works by inspecting DHCP messages that\n

It can also control the rate at which DHCP\n

It can prevent attacks like DHCP exhaustion\nand DHCP poisoning.

We also looked at how to configure DHCP snooping\n

Remember to enable it globally, enable it\n

Also keep option 82 in mind, you may need\n

As always, watch until the end of the quiz\n

ExSim, my recommended practice exams for the\nCCNA.

Okay, let’s go to question 1 of the quiz.

Which of the following DHCP message types\n

DHCP snooping untrusted interface?

(select three) Okay, pause the video now to\n

These DHCP message types will always be discarded\n

because they are sent from DHCP servers.

DHCP servers should not be connected to untrusted\ninterfaces.

Which of the following is NOT stored in the\n

Pause the video now to select the correct\nanswer.

Okay, the answer is D, default gateway.

Here you can see what the DHCP snooping binding\n

The default gateway is not displayed.

Okay, let’s go to question 3.

Which of the following are functions of DHCP\nsnooping?

(select two) Pause the video now to select\nthe best answers.

Okay, the answers are A, limiting the rate\n

DHCP snooping won’t filter messages on trusted\n

It will only filter those that are received\non untrusted ports.

Okay, let’s go to question 4.

When DHCP snooping inspects a DHCP DISCOVER\n

(select the two best answers) Pause the video\n

Okay, the answers are A, source MAC address,\n

Source MAC address refers to the source MAC\n

address is a field in the DHCP message itself.

If the two match, DHCP snooping permits the\nmessage.

If they don’t match, the message will be\ndiscarded.

DHCP snooping rate-limiting is configured\n

What happens if DHCP messages are received\n

Pause the video now to select the best answer.

The answer is B, the interface will be disabled.

To re-enable it, you can either SHUTDOWN and\n

configure errdisable recovery for the dhcp-rate-limit\ncause.

Okay, that’s all for the quiz.

Now let’s take a look at a bonus question\n