71. Configure DHCP Snooping
*DHCP Snooping
security feature that works in LAN switches
ports are defined as trusted on untrusted
a. trusted ports
where routers, switch and DHCP server is connected
b. untrusted ports
where client devices are connected
if dhcp snooping is turned on - the switch will check all DHCP messages
if ports is untrusted:
if dhcp message must be equal to client dhcp messages (discover, request) packet will be allowed
if dhcp message is equal to server dhcp messages (offer, ack) packet will be dropped
equivalent to dhcp snooping turned on
if ports is trusted
dhcp messages won't be checked
all dhcp messages will be allowed to pass
equivalent to dhcp snooping turned off
*How DHCP Snooping works
successful dhcp process between client and server will be recorded into the "dhcp snooping binding table"
the binding table contains: MAC Add, IP, Vlan, interface
protects against unauthorized dhcp server attack, dhcp release and DoS attack (discover message)
*Miscellanos DHCP Client Messages
a. DHCP Release
b. DHCP Decline
Configuring DHCP Snooping
*Step 1: Activate DHCP snooping feature globally
conf t
ip dhcp snooping
*Step 2: Configure untrusted ports (access ports)
conf t
'ip dhcp snooping vlan (vlan#) or
'ip dhcp snooping vlan (start of range) - (end of range) or
'ip dhcp snooping (vlan 1) (vlan 2)
ip dhcp snooping vlan 10,20
*Step 3: Confgure trusted ports (trunk ports)
conf t
int gi 0/1
ip dhcp snoorping trust
*Step 4: (optional) - turn off option 82 for DHCP snooping (dhcp relay)
conf t
no ip dhcp snooping information option //disable option on the switch not configure as relay
exit
*Step 5: Configure DHCP snooping to make sure the L2 encapsulation is always equal to the MAC addr inside the dhcp header. (counter DoS attack)
conf t
ip dhcp snooping verify mac-address //disabled by default as may cause slow on processing packets
*Verify
show ip dhcp snooping
Sw1
conf t
ip dhcp snooping
ip dhcp snooping vlan 10,20
int gi 0/1
ip dhcp snooping trust
exit
no ip dhcp snooping information option
ip dhcp snooping verify mac-address
exit
show ip dhcp snooping