WEBVTT

1
00:00.000 --> 00:00.443 align:middle line:84%


2
00:00.443 --> 00:02.610 align:middle line:90%
In this video, I'd like to
chat with you about a few

3
00:02.610 --> 00:04.890 align:middle line:90%
of the ingredients and
commands that you and I are

4
00:04.890 --> 00:07.380 align:middle line:90%
going to use to
implement DHCP snooping

5
00:07.380 --> 00:10.470 align:middle line:90%
and also reinforce
where in our enterprise

6
00:10.470 --> 00:12.410 align:middle line:90%
we're going to
implement this feature.

7
00:12.410 --> 00:15.958 align:middle line:90%
So let's consider where
a rogue or malicious DHCP

8
00:15.958 --> 00:17.000 align:middle line:84%
server might be injected.

9
00:17.000 --> 00:20.190 align:middle line:90%
And it's very likely going
to be injected where users

10
00:20.190 --> 00:21.370 align:middle line:84%
can connect to the network.

11
00:21.370 --> 00:22.703 align:middle line:84%
And that's to the access layers.

12
00:22.703 --> 00:25.590 align:middle line:90%
So if we have access
layer switches with wiring

13
00:25.590 --> 00:27.850 align:middle line:90%
that goes over to the
offices and cubes,

14
00:27.850 --> 00:29.460 align:middle line:90%
it's really here,
the access layer

15
00:29.460 --> 00:31.140 align:middle line:90%
and the access layer
switches, where
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

15
00:29.460 --> 00:31.140 align:middle line:90%
and the access layer
switches, where

16
00:31.140 --> 00:34.200 align:middle line:90%
you'd want to implement the
feature of DHCP snooping.

17
00:34.200 --> 00:38.230 align:middle line:84%


18
00:38.230 --> 00:40.830 align:middle line:90%
So let's imagine that,
for this network up here--

19
00:40.830 --> 00:44.860 align:middle line:90%
let's say this is VLAN 30
that's being supported up here.

20
00:44.860 --> 00:47.370 align:middle line:90%
And these are trunks going down
to the core and distribution

21
00:47.370 --> 00:48.260 align:middle line:84%
layer.

22
00:48.260 --> 00:50.760 align:middle line:90%
And let's imagine our
DHCP server is right here,

23
00:50.760 --> 00:52.950 align:middle line:84%
our legitimate one.

24
00:52.950 --> 00:56.073 align:middle line:90%
So to implement DHCP snooping
on this access layer switch,

25
00:56.073 --> 00:57.240 align:middle line:84%
here's the command we'd use.

26
00:57.240 --> 01:00.780 align:middle line:84%
We'd use the command ip dhcp--
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

26
00:57.240 --> 01:00.780 align:middle line:84%
We'd use the command ip dhcp--

27
01:00.780 --> 01:02.400 align:middle line:84%
put my little spaces in there--

28
01:02.400 --> 01:06.470 align:middle line:84%
snooping-- Enter.

29
01:06.470 --> 01:09.230 align:middle line:90%
Boom, now that enables
DHCP snooping, the feature,

30
01:09.230 --> 01:09.950 align:middle line:84%
on the switch.

31
01:09.950 --> 01:12.212 align:middle line:90%
But it doesn't apply the
feature to this VLAN.

32
01:12.212 --> 01:13.670 align:middle line:90%
So we need to add
one more command.

33
01:13.670 --> 01:21.480 align:middle line:90%
That is ip space dhcp space
snooping space vlan space--

34
01:21.480 --> 01:23.708 align:middle line:90%
and then if it's VLAN 30,
we'd put a 30 right there.

35
01:23.708 --> 01:26.000 align:middle line:90%
So now, with this one-two
punch, the feature's enabled.

36
01:26.000 --> 01:28.687 align:middle line:84%
And it's applied to VLAN 30.

37
01:28.687 --> 01:30.770 align:middle line:90%
So with this in place,
let's consider this machine
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

37
01:28.687 --> 01:30.770 align:middle line:90%
So with this in place,
let's consider this machine

38
01:30.770 --> 01:31.040 align:middle line:84%
right here.

39
01:31.040 --> 01:31.940 align:middle line:84%
We'll call it PC--

40
01:31.940 --> 01:34.520 align:middle line:90%
one, two, three,
four, five, PC 5.

41
01:34.520 --> 01:35.300 align:middle line:84%
It boots up.

42
01:35.300 --> 01:36.690 align:middle line:84%
It's a DHCP client.

43
01:36.690 --> 01:39.240 align:middle line:84%
It does a DHCP discover message.

44
01:39.240 --> 01:40.880 align:middle line:90%
So in the discover
message, it's going

45
01:40.880 --> 01:42.800 align:middle line:84%
to send out a broadcast frame.

46
01:42.800 --> 01:44.810 align:middle line:90%
And for the source
layer two address,

47
01:44.810 --> 01:46.340 align:middle line:90%
it's going to use
its MAC address.

48
01:46.340 --> 01:49.340 align:middle line:90%
And then inside the DHCP
message, the discover message,

49
01:49.340 --> 01:51.590 align:middle line:90%
it's going to include
its layer two address.

50
01:51.590 --> 01:53.480 align:middle line:90%
If those two MAC
addresses, the one that's

51
01:53.480 --> 01:56.420 align:middle line:90%
in the layer two header and
the one that's in the DHCP

52
01:56.420 --> 01:58.910 align:middle line:90%
discover message itself,
if those are not the same,

53
01:58.910 --> 02:02.750 align:middle line:90%
this port right here says, eh,
I'm not letting that go in.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
01:58.910 --> 02:02.750 align:middle line:90%
this port right here says, eh,
I'm not letting that go in.

54
02:02.750 --> 02:03.590 align:middle line:84%
It's not congruent.

55
02:03.590 --> 02:05.200 align:middle line:84%
Something funny is going on.

56
02:05.200 --> 02:07.880 align:middle line:90%
And that's because all
the ports in this VLAN--

57
02:07.880 --> 02:11.060 align:middle line:90%
VLAN 30-- by default are
considered untrusted.

58
02:11.060 --> 02:13.958 align:middle line:84%


59
02:13.958 --> 02:15.500 align:middle line:90%
And so there's some
extra inspections

60
02:15.500 --> 02:17.620 align:middle line:90%
that are going to go
on as a result of that.

61
02:17.620 --> 02:21.610 align:middle line:90%
Also, if Bob or somebody else
plugs into an access port here

62
02:21.610 --> 02:24.010 align:middle line:90%
and they have a
DHCP server, meaning

63
02:24.010 --> 02:26.860 align:middle line:90%
they have a device that
is trying to do DHCP offer

64
02:26.860 --> 02:30.070 align:middle line:90%
messages or
acknowledgment messages,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

64
02:26.860 --> 02:30.070 align:middle line:90%
messages or
acknowledgment messages,

65
02:30.070 --> 02:32.080 align:middle line:90%
if the switch with
DHCP snooping sees

66
02:32.080 --> 02:35.020 align:middle line:90%
any of those server-type
DHCP messages

67
02:35.020 --> 02:38.710 align:middle line:90%
trying to enter the network on
a non-trusted or untrusted DHCP

68
02:38.710 --> 02:41.260 align:middle line:90%
snooping port, it's
going to drop those.

69
02:41.260 --> 02:42.940 align:middle line:90%
And then we were
protecting our network

70
02:42.940 --> 02:46.450 align:middle line:90%
from having unauthorized DHCP
servers added or connected

71
02:46.450 --> 02:47.540 align:middle line:84%
to our network.

72
02:47.540 --> 02:49.450 align:middle line:90%
So if this client does
a discover message,

73
02:49.450 --> 02:52.000 align:middle line:90%
and that discover is broadcast,
and it's forwarded down

74
02:52.000 --> 02:55.280 align:middle line:90%
the trunk, and this DHCP
server sees it, my question is,

75
02:55.280 --> 02:57.280 align:middle line:90%
what's a really good
DHCP server going

76
02:57.280 --> 02:59.585 align:middle line:90%
to do if it gets a
discover message?

77
02:59.585 --> 03:01.210 align:middle line:90%
Well, you might be
saying, well, Keith,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

77
02:59.585 --> 03:01.210 align:middle line:90%
Well, you might be
saying, well, Keith,

78
03:01.210 --> 03:02.710 align:middle line:90%
it's going to respond
with an offer.

79
03:02.710 --> 03:05.320 align:middle line:90%
Exactly, and that's where
the problem comes in

80
03:05.320 --> 03:08.805 align:middle line:90%
if we have DHCP snooping
enabled for the entire VLAN.

81
03:08.805 --> 03:09.430 align:middle line:84%
Check this out.

82
03:09.430 --> 03:11.860 align:middle line:90%
When the server
responds with the offer,

83
03:11.860 --> 03:13.830 align:middle line:90%
saying, hey, I've got
a beautiful IP address.

84
03:13.830 --> 03:14.830 align:middle line:84%
You're going to love it.

85
03:14.830 --> 03:16.600 align:middle line:90%
And it tries to send
it into the switch.

86
03:16.600 --> 03:19.300 align:middle line:90%
It goes in here to core
2, because core 2 does not

87
03:19.300 --> 03:21.130 align:middle line:84%
have DHCP snooping enabled.

88
03:21.130 --> 03:23.920 align:middle line:90%
That gets forwarded up the
trunk and up to the access layer

89
03:23.920 --> 03:24.510 align:middle line:84%
switch.

90
03:24.510 --> 03:28.300 align:middle line:90%
But right here, on this
trunk port, guess what?

91
03:28.300 --> 03:31.090 align:middle line:90%
DHCP snooping is
enabled for VLAN 30.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

91
03:28.300 --> 03:31.090 align:middle line:90%
DHCP snooping is
enabled for VLAN 30.

92
03:31.090 --> 03:32.520 align:middle line:84%
So that's tagged VLAN 30.

93
03:32.520 --> 03:34.450 align:middle line:84%
It's a DHCP offer coming in.

94
03:34.450 --> 03:37.540 align:middle line:90%
And the access switch says
untrusted port, eh, and kills

95
03:37.540 --> 03:39.700 align:middle line:84%
it, which is not the intent.

96
03:39.700 --> 03:43.150 align:middle line:90%
So what we would also want to
do is we'd also want to specify,

97
03:43.150 --> 03:47.140 align:middle line:90%
from the access layer's switches
perspective, which ports

98
03:47.140 --> 03:51.520 align:middle line:90%
are to be trusted, meaning which
ports lead to legitimate DHCP

99
03:51.520 --> 03:52.267 align:middle line:84%
servers.

100
03:52.267 --> 03:53.850 align:middle line:90%
So on the access
layer switch, if this

101
03:53.850 --> 03:58.030 align:middle line:90%
is port 0/1 that goes down to
core 1 and 0/2 that goes down

102
03:58.030 --> 04:01.300 align:middle line:90%
the core 2, we'd want to
configure both of those trunk
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

102
03:58.030 --> 04:01.300 align:middle line:90%
the core 2, we'd want to
configure both of those trunk

103
04:01.300 --> 04:03.400 align:middle line:84%
ports as being trusted--

104
04:03.400 --> 04:06.633 align:middle line:84%
IP DHCP snooping trusted ports.

105
04:06.633 --> 04:08.050 align:middle line:90%
And the syntax to
do that would be

106
04:08.050 --> 04:09.610 align:middle line:90%
to go into interface
configuration

107
04:09.610 --> 04:12.100 align:middle line:90%
mode for these two trunk
interfaces on the access layer

108
04:12.100 --> 04:12.910 align:middle line:84%
switch.

109
04:12.910 --> 04:17.870 align:middle line:90%
And we'd use the command
ip dhcp snooping--

110
04:17.870 --> 04:21.089 align:middle line:90%
I'll put a snoop for
short-- space trust.

111
04:21.089 --> 04:23.362 align:middle line:90%
And if we did that for each
of these two trunk ports,

112
04:23.362 --> 04:24.820 align:middle line:90%
that would make
them trusted ports.

113
04:24.820 --> 04:28.475 align:middle line:90%
And, as a result, when the
DHCP server sends its offer,

114
04:28.475 --> 04:30.850 align:middle line:90%
and its acknowledgments and
messages from the server back
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

114
04:28.475 --> 04:30.850 align:middle line:90%
and its acknowledgments and
messages from the server back

115
04:30.850 --> 04:32.740 align:middle line:90%
up into that access
layer switch,

116
04:32.740 --> 04:34.570 align:middle line:90%
the access layer
switch will allow it,

117
04:34.570 --> 04:36.980 align:middle line:90%
because it's coming
in on a trusted port.

118
04:36.980 --> 04:38.920 align:middle line:90%
So in this example,
all of the access ports

119
04:38.920 --> 04:42.110 align:middle line:90%
would be untrusted from a
DHCP snooping perspective.

120
04:42.110 --> 04:45.885 align:middle line:90%
And the trunk ports would both
be configured as trusted ports.

121
04:45.885 --> 04:47.260 align:middle line:90%
And there's one
more element that

122
04:47.260 --> 04:50.080 align:middle line:90%
often causes DHCP
snooping to be so

123
04:50.080 --> 04:52.720 align:middle line:90%
good at what it does it
doesn't allow any DHCP

124
04:52.720 --> 04:54.110 align:middle line:84%
services to work.

125
04:54.110 --> 04:56.050 align:middle line:84%
And that is option 82.

126
04:56.050 --> 04:58.900 align:middle line:90%
In many networks,
there's DHCP relay agents

127
04:58.900 --> 05:02.800 align:middle line:90%
that listen for DHCP discoverers
on a given broadcast network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

127
04:58.900 --> 05:02.800 align:middle line:90%
that listen for DHCP discoverers
on a given broadcast network.

128
05:02.800 --> 05:04.930 align:middle line:90%
And then they unicast
that, or they route it,

129
05:04.930 --> 05:06.520 align:middle line:84%
over to the DHCP server.

130
05:06.520 --> 05:09.220 align:middle line:90%
Well, option 82
includes information

131
05:09.220 --> 05:11.560 align:middle line:84%
about that DHCP relay agent.

132
05:11.560 --> 05:14.380 align:middle line:90%
If we're using DHCP snooping,
it can add that option 82

133
05:14.380 --> 05:17.218 align:middle line:90%
information as part
of the DHCP request.

134
05:17.218 --> 05:18.760 align:middle line:90%
We don't need that
added information.

135
05:18.760 --> 05:20.260 align:middle line:90%
In fact, if we add
that information,

136
05:20.260 --> 05:23.600 align:middle line:90%
it might cause DHCP services
not to function correctly.

137
05:23.600 --> 05:26.710 align:middle line:90%
So this command right here, no
ip dhcp snooping information

138
05:26.710 --> 05:27.820 align:middle line:84%
option says don't--

139
05:27.820 --> 05:31.120 align:middle line:90%
please don't include the
option 82 information
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

139
05:27.820 --> 05:31.120 align:middle line:90%
please don't include the
option 82 information

140
05:31.120 --> 05:33.040 align:middle line:84%
to the DHCP messages.

141
05:33.040 --> 05:35.290 align:middle line:90%
And sometimes, if that
information is left on

142
05:35.290 --> 05:39.760 align:middle line:90%
and DHCP snooping injects it,
it causes DHCP services to fail.

143
05:39.760 --> 05:42.580 align:middle line:90%
So please be aware of
that command as well.

144
05:42.580 --> 05:44.470 align:middle line:90%
In our next video, join
me as we take a look

145
05:44.470 --> 05:46.150 align:middle line:90%
at building a
small network where

146
05:46.150 --> 05:49.657 align:middle line:90%
we can implement DHCP snooping
and verify its results.

147
05:49.657 --> 05:51.490 align:middle line:90%
So I'll see you there
in just a few moments.

148
05:51.490 --> 05:54.130 align:middle line:90%
Meanwhile, I hope this has
been informative for you.

149
05:54.130 --> 05:57.450 align:middle line:90%
And I'd like to thank
you for viewing.