WEBVTT

1
00:00.000 --> 00:01.195 align:middle line:84%


2
00:01.195 --> 00:03.070 align:middle line:90%
In this video, you and
I have the opportunity

3
00:03.070 --> 00:04.570 align:middle line:90%
to design a small
network, where we

4
00:04.570 --> 00:06.484 align:middle line:84%
can play with the HP snooping.

5
00:06.484 --> 00:08.109 align:middle line:90%
We'll then apply the
commands, and then

6
00:08.109 --> 00:09.910 align:middle line:84%
verify that it's working.

7
00:09.910 --> 00:12.400 align:middle line:90%
So here's what I propose
we do as our plan,

8
00:12.400 --> 00:13.330 align:middle line:84%
and it's simply this.

9
00:13.330 --> 00:15.910 align:middle line:90%
We'll have a switch,
an access later switch.

10
00:15.910 --> 00:19.510 align:middle line:90%
And let's plug in a
couple of DHCP servers.

11
00:19.510 --> 00:22.510 align:middle line:90%
So, there's going to
be DHCP server 1 and 2.

12
00:22.510 --> 00:24.850 align:middle line:90%
And we'll make
this the good guy,

13
00:24.850 --> 00:26.427 align:middle line:90%
and we'll make this
one the bad guy.

14
00:26.427 --> 00:27.760 align:middle line:84%
Maybe I should use red for that.

15
00:27.760 --> 00:29.010 align:middle line:84%
All right.

16
00:29.010 --> 00:30.370 align:middle line:84%
Mad and evil.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.010 --> 00:30.370 align:middle line:84%
Mad and evil.

17
00:30.370 --> 00:30.908 align:middle line:84%
OK.

18
00:30.908 --> 00:32.950 align:middle line:90%
And then we'll put a couple
of clients over here.

19
00:32.950 --> 00:37.880 align:middle line:84%
So we have PCP 1 and PCP 2.

20
00:37.880 --> 00:39.580 align:middle line:90%
And if we just bring
up a new switch,

21
00:39.580 --> 00:42.297 align:middle line:90%
all the ports will be
in VLAN 1 by default.

22
00:42.297 --> 00:44.130 align:middle line:90%
So they're all going
to be in the same VLAN.

23
00:44.130 --> 00:46.900 align:middle line:90%
And then for our plan,
for this DHCP server,

24
00:46.900 --> 00:53.110 align:middle line:90%
let's go ahead and use the IP
address space of 10.16.20.0

25
00:53.110 --> 00:54.950 align:middle line:84%
with a 24-bit mask.

26
00:54.950 --> 00:58.150 align:middle line:90%
And for this DHCP server, let's
have it handle IP addresses

27
00:58.150 --> 01:00.760 align:middle line:90%
from the 10.99.99 network,
so it's very obvious
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

27
00:58.150 --> 01:00.760 align:middle line:90%
from the 10.99.99 network,
so it's very obvious

28
01:00.760 --> 01:02.440 align:middle line:84%
which clients get what.

29
01:02.440 --> 01:06.270 align:middle line:90%
And we'll make PCP 1 and
PCP 2 both DHCP clients.

30
01:06.270 --> 01:07.270 align:middle line:84%
So here's some fun news.

31
01:07.270 --> 01:10.720 align:middle line:90%
We have many options, as we
create, in a lab environment,

32
01:10.720 --> 01:11.900 align:middle line:84%
DHCP servers.

33
01:11.900 --> 01:14.200 align:middle line:90%
We could take Cisco
routers, we can enable DHCP

34
01:14.200 --> 01:16.070 align:middle line:90%
by making the pools,
assigning the networks,

35
01:16.070 --> 01:17.987 align:middle line:90%
and the default gateways,
and everything else.

36
01:17.987 --> 01:20.140 align:middle line:84%
Or we could use a simulator.

37
01:20.140 --> 01:23.620 align:middle line:90%
In fact, I did a series of
videos on Packet Tracer.

38
01:23.620 --> 01:27.190 align:middle line:90%
And Packet Tracer is an
amazing tool, at both the CCNA

39
01:27.190 --> 01:30.070 align:middle line:90%
level and, for much of
the CCNP, for regarding
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

39
01:27.190 --> 01:30.070 align:middle line:90%
level and, for much of
the CCNP, for regarding

40
01:30.070 --> 01:31.238 align:middle line:84%
routing and switching.

41
01:31.238 --> 01:32.530 align:middle line:84%
So here's what I propose we do.

42
01:32.530 --> 01:34.500 align:middle line:90%
Let's take the design
we just talked about,

43
01:34.500 --> 01:38.020 align:middle line:90%
and let's build that live
inside of Packet Tracer.

44
01:38.020 --> 01:40.870 align:middle line:90%
Then we can follow it up by
implementing DHCP snooping

45
01:40.870 --> 01:43.277 align:middle line:90%
on top of that, to
verify it works.

46
01:43.277 --> 01:45.610 align:middle line:90%
And if you haven't yet taken
a look at the Packet Tracer

47
01:45.610 --> 01:47.290 align:middle line:90%
videos, right here
at CBT Nuggets,

48
01:47.290 --> 01:48.880 align:middle line:90%
please take a moment
to look at those.

49
01:48.880 --> 01:51.790 align:middle line:90%
This is a fantastic
and easy tool to use.

50
01:51.790 --> 01:54.220 align:middle line:90%
So lets together start
with a blank canvas,

51
01:54.220 --> 01:55.720 align:middle line:90%
and let's build
a simple network.

52
01:55.720 --> 01:56.680 align:middle line:84%
Let's start with the switch.

53
01:56.680 --> 01:58.138 align:middle line:90%
Down here on the
bottom left, we'll

54
01:58.138 --> 02:00.310 align:middle line:90%
click on Network
Devices, click on Switch.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

54
01:58.138 --> 02:00.310 align:middle line:90%
click on Network
Devices, click on Switch.

55
02:00.310 --> 02:03.040 align:middle line:90%
And let's just go ahead
and grab the 2960 switch,

56
02:03.040 --> 02:04.470 align:middle line:84%
and drag and drop it.

57
02:04.470 --> 02:05.140 align:middle line:84%
Boom!

58
02:05.140 --> 02:05.740 align:middle line:84%
Done.

59
02:05.740 --> 02:08.289 align:middle line:90%
Next, let's grab a
couple of DHCP servers.

60
02:08.289 --> 02:11.330 align:middle line:90%
So we'll click on the
End Devices icon here.

61
02:11.330 --> 02:13.900 align:middle line:90%
And then over here, we'll
grab the server icon.

62
02:13.900 --> 02:14.950 align:middle line:84%
Grab the server.

63
02:14.950 --> 02:16.660 align:middle line:90%
And then we'll grab
another server.

64
02:16.660 --> 02:18.860 align:middle line:90%
We can change the labels
on those if you want to.

65
02:18.860 --> 02:20.440 align:middle line:84%
And then let's grab some PCs.

66
02:20.440 --> 02:22.480 align:middle line:84%
So we'll grab a PC, drag it up.

67
02:22.480 --> 02:25.240 align:middle line:90%
And let's grab a
laptop and drag it up.

68
02:25.240 --> 02:26.830 align:middle line:90%
And let's connect
them all together.

69
02:26.830 --> 02:29.440 align:middle line:90%
So to connect them all together,
we grab a connection tool.

70
02:29.440 --> 02:31.357 align:middle line:90%
And then we use the
Automatic Connection Tool,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

70
02:29.440 --> 02:31.357 align:middle line:90%
And then we use the
Automatic Connection Tool,

71
02:31.357 --> 02:34.180 align:middle line:90%
and just click, and click,
Automatic Connection Tool,

72
02:34.180 --> 02:35.950 align:middle line:84%
click, click.

73
02:35.950 --> 02:38.470 align:middle line:90%
Automatic connection
tool, click, click.

74
02:38.470 --> 02:40.760 align:middle line:90%
Automatic Connection
Tool click, click.

75
02:40.760 --> 02:42.250 align:middle line:90%
And in the Packet
Tracer videos, I

76
02:42.250 --> 02:44.208 align:middle line:90%
walk you through how you
can change the options

77
02:44.208 --> 02:46.750 align:middle line:90%
to show the labels, or not
show the labels, and the LED

78
02:46.750 --> 02:47.830 align:middle line:84%
indicators, and so forth.

79
02:47.830 --> 02:49.067 align:middle line:84%
Lots of fun to be had.

80
02:49.067 --> 02:51.400 align:middle line:90%
So now I'm going to stretch
these out just a little bit.

81
02:51.400 --> 02:53.090 align:middle line:90%
And let me rename a
few of these things.

82
02:53.090 --> 02:54.670 align:middle line:90%
So I'm going to call
this top server,

83
02:54.670 --> 02:58.550 align:middle line:84%
I'm going to call it DHCP good.

84
02:58.550 --> 03:02.900 align:middle line:90%
And we'll call the
bottom one DHCP bad.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

84
02:58.550 --> 03:02.900 align:middle line:90%
And we'll call the
bottom one DHCP bad.

85
03:02.900 --> 03:03.400 align:middle line:84%
There we go.

86
03:03.400 --> 03:05.320 align:middle line:90%
That way we can
identify both of them.

87
03:05.320 --> 03:08.770 align:middle line:90%
And we'll call this
top device PC 1.

88
03:08.770 --> 03:12.280 align:middle line:84%
And we'll call this device PC 2.

89
03:12.280 --> 03:13.840 align:middle line:84%
Fantastic.

90
03:13.840 --> 03:16.390 align:middle line:90%
So for the switch, let's just
verify that all the ports are

91
03:16.390 --> 03:18.440 align:middle line:90%
associated with
VLAN 1 by default.

92
03:18.440 --> 03:21.950 align:middle line:90%
So we'll click on the switch,
and we'll go to the CLI tab.

93
03:21.950 --> 03:23.020 align:middle line:84%
Press Enter a few times.

94
03:23.020 --> 03:26.410 align:middle line:90%
Go into privileged mode,
to show VLAN brief.

95
03:26.410 --> 03:28.857 align:middle line:90%
And I'm going to expand
this a little bit,

96
03:28.857 --> 03:30.190 align:middle line:84%
so it's a little easier to read.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

96
03:28.857 --> 03:30.190 align:middle line:84%
so it's a little easier to read.

97
03:30.190 --> 03:31.100 align:middle line:84%
There we go.

98
03:31.100 --> 03:34.340 align:middle line:90%
And sure enough, all the ports,
by default, are in VLAN 1.

99
03:34.340 --> 03:36.940 align:middle line:90%
So we're good to go
from that perspective.

100
03:36.940 --> 03:38.980 align:middle line:90%
Next, since we're
here at the switch,

101
03:38.980 --> 03:42.850 align:middle line:90%
let's go ahead and enable IP
DHCP snooping, with the command

102
03:42.850 --> 03:45.400 align:middle line:84%
IP DHP snooping.

103
03:45.400 --> 03:46.550 align:middle line:84%
Just like that.

104
03:46.550 --> 03:50.290 align:middle line:90%
So do a do show
IP DHCP snooping.

105
03:50.290 --> 03:51.240 align:middle line:84%
Press Enter.

106
03:51.240 --> 03:56.050 align:middle line:90%
And this says that DHCP snooping
is enabled, but is currently

107
03:56.050 --> 03:57.545 align:middle line:84%
not applied to any VLANs.

108
03:57.545 --> 03:59.170 align:middle line:90%
So we'll take care
of that in a moment.

109
03:59.170 --> 04:01.330 align:middle line:90%
It's also saying that the
insertion of option A2
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

109
03:59.170 --> 04:01.330 align:middle line:90%
It's also saying that the
insertion of option A2

110
04:01.330 --> 04:03.490 align:middle line:90%
is enabled, which
we want to disable,

111
04:03.490 --> 04:06.460 align:middle line:90%
because we're not using
a relay agent for DHCP.

112
04:06.460 --> 04:10.930 align:middle line:90%
So the next command we'll do is
IP DHCP snooping, VLANs space,

113
04:10.930 --> 04:12.670 align:middle line:90%
and then we'll apply
this to VLAN 1,

114
04:12.670 --> 04:14.540 align:middle line:90%
because that's where
all of our ports are.

115
04:14.540 --> 04:15.040 align:middle line:84%
Boom.

116
04:15.040 --> 04:18.940 align:middle line:90%
Now if we do a show IP DHCP
snooping in the center,

117
04:18.940 --> 04:21.190 align:middle line:90%
now it's showing that
DHCP snooping is enabled,

118
04:21.190 --> 04:24.590 align:middle line:90%
and it's also
configured for VLAN 1.

119
04:24.590 --> 04:27.310 align:middle line:90%
Next, let's take care of this
bad boy, insertion of option 82

120
04:27.310 --> 04:28.260 align:middle line:84%
is enabled.

121
04:28.260 --> 04:32.140 align:middle line:90%
So we'll do a no
IP DHCP snooping,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

121
04:28.260 --> 04:32.140 align:middle line:90%
So we'll do a no
IP DHCP snooping,

122
04:32.140 --> 04:34.340 align:middle line:84%
and say information option.

123
04:34.340 --> 04:35.260 align:middle line:84%
Press Enter.

124
04:35.260 --> 04:38.540 align:middle line:90%
Then a couple up arrow keys,
to do a show IP DHCP snooping.

125
04:38.540 --> 04:39.370 align:middle line:84%
Press enter.

126
04:39.370 --> 04:43.220 align:middle line:90%
And now the insertion of
option 82 is disabled.

127
04:43.220 --> 04:47.320 align:middle line:90%
So if you do a do show
History, plus Enter,

128
04:47.320 --> 04:49.030 align:middle line:90%
here are the commands
that we've issued,

129
04:49.030 --> 04:53.800 align:middle line:90%
IP DHCP snooping, IP
DHCP stooping for VLAN 1,

130
04:53.800 --> 04:58.142 align:middle line:90%
and no IP DHCP snooping
information option.

131
04:58.142 --> 05:00.600 align:middle line:90%
Now we have one other little
problem that's going to arise.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

131
04:58.142 --> 05:00.600 align:middle line:90%
Now we have one other little
problem that's going to arise.

132
05:00.600 --> 05:02.850 align:middle line:90%
When we tell these clients
to be DHCP clients,

133
05:02.850 --> 05:04.800 align:middle line:90%
and they do their
discover messages,

134
05:04.800 --> 05:06.300 align:middle line:90%
and then those
discover messages are

135
05:06.300 --> 05:08.730 align:middle line:90%
sent to all other
ports in the same VLAN,

136
05:08.730 --> 05:12.120 align:middle line:90%
because they're broadcast,
DHCP good, and DHCP bad,

137
05:12.120 --> 05:14.460 align:middle line:90%
once configured, are
both going to do offers.

138
05:14.460 --> 05:17.010 align:middle line:90%
So we'll get an offer from DHCP
good and an offer from DHCP

139
05:17.010 --> 05:18.000 align:middle line:84%
bad.

140
05:18.000 --> 05:21.030 align:middle line:90%
And because all of
these four ports

141
05:21.030 --> 05:25.010 align:middle line:90%
are all untrusted by default,
once we enable DHCP snooping,

142
05:25.010 --> 05:28.440 align:middle line:90%
the switch ports,
FA0/1 and FA0/2

143
05:28.440 --> 05:30.390 align:middle line:84%
are going to drop those offers.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

143
05:28.440 --> 05:30.390 align:middle line:84%
are going to drop those offers.

144
05:30.390 --> 05:32.770 align:middle line:90%
And these clients are not
going to get their responses.

145
05:32.770 --> 05:37.350 align:middle line:90%
So we also need to tell the
switch that this port, FA0/1,

146
05:37.350 --> 05:40.610 align:middle line:90%
which leads to the real DHCP
server that we want to use,

147
05:40.610 --> 05:42.550 align:middle line:90%
that this port is
a trusted port.

148
05:42.550 --> 05:44.500 align:middle line:84%
So let's do that also.

149
05:44.500 --> 05:46.320 align:middle line:84%
So we'll go back to the switch.

150
05:46.320 --> 05:48.510 align:middle line:90%
And here at the switch,
we'll go into Interface,

151
05:48.510 --> 05:50.430 align:middle line:90%
and take a peek at
what that interface is.

152
05:50.430 --> 05:52.650 align:middle line:84%
It is fast FA0/1.

153
05:52.650 --> 05:56.110 align:middle line:90%
So that interface,
FA0/1, and we'll

154
05:56.110 --> 06:01.340 align:middle line:90%
say IP DHCP snooping,
space, and trust.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

154
05:56.110 --> 06:01.340 align:middle line:90%
say IP DHCP snooping,
space, and trust.

155
06:01.340 --> 06:02.100 align:middle line:84%
Enter.

156
06:02.100 --> 06:02.607 align:middle line:84%
Boom.

157
06:02.607 --> 06:03.690 align:middle line:84%
That's now a trusted port.

158
06:03.690 --> 06:07.280 align:middle line:90%
And we can verify that with
a show IP DHCP snooping.

159
06:07.280 --> 06:11.670 align:middle line:90%
Press enter, and there, it
shows that FA0/1 is trusted.

160
06:11.670 --> 06:14.220 align:middle line:90%
It also shows that DHCP
snooping is enabled.

161
06:14.220 --> 06:17.650 align:middle line:90%
And it's also
enabled for VLAN 1.

162
06:17.650 --> 06:19.270 align:middle line:84%
Fantastic.

163
06:19.270 --> 06:19.770 align:middle line:84%
All right.

164
06:19.770 --> 06:21.910 align:middle line:90%
Now, to actually test
this and make it work,

165
06:21.910 --> 06:24.540 align:middle line:90%
we've got to do a little bit of
work on the two DHCP servers,

166
06:24.540 --> 06:26.350 align:middle line:90%
to make sure they're
up and active.

167
06:26.350 --> 06:28.200 align:middle line:90%
And then we all see it
turn on some clients,

168
06:28.200 --> 06:30.030 align:middle line:90%
to make sure they're
DHCP clients.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

168
06:28.200 --> 06:30.030 align:middle line:90%
to make sure they're
DHCP clients.

169
06:30.030 --> 06:32.670 align:middle line:90%
So let's start with DHCP
good here, in Packet Tracer.

170
06:32.670 --> 06:35.760 align:middle line:90%
We'll go ahead and click on it,
to open up the window for that.

171
06:35.760 --> 06:40.770 align:middle line:90%
And here, on the window for DHCP
good, we'll click on Config.

172
06:40.770 --> 06:43.050 align:middle line:84%
We'll click on fast Ethernet 0.

173
06:43.050 --> 06:47.026 align:middle line:90%
We'll specify it has a
static address of 10.16,

174
06:47.026 --> 06:48.140 align:middle line:84%
let's see here.

175
06:48.140 --> 06:49.680 align:middle line:84%
Let's use 20 for that subnet.

176
06:49.680 --> 06:51.070 align:middle line:84%
Let me look at our plan.

177
06:51.070 --> 06:53.430 align:middle line:90%
So our plan was
10.16.20, will be

178
06:53.430 --> 06:55.310 align:middle line:84%
the network it's handing out.

179
06:55.310 --> 06:58.860 align:middle line:90%
So we'll put in 10.16.20 dot,
and let's use the first IP

180
06:58.860 --> 07:04.200 align:middle line:90%
address in that range, with
a mask of 255.255.255.0.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

180
06:58.860 --> 07:04.200 align:middle line:90%
address in that range, with
a mask of 255.255.255.0.

181
07:04.200 --> 07:05.340 align:middle line:84%
Fantastic.

182
07:05.340 --> 07:07.140 align:middle line:84%
So now it has an IP address.

183
07:07.140 --> 07:10.600 align:middle line:90%
Next, let's make sure it's
enabled for DHCP services.

184
07:10.600 --> 07:14.010 align:middle line:90%
So here for this machine,
we'll go to services.

185
07:14.010 --> 07:16.710 align:middle line:90%
We'll go to DHCP
here on the left.

186
07:16.710 --> 07:19.200 align:middle line:90%
And with DHCP
selected, we'll specify

187
07:19.200 --> 07:22.110 align:middle line:84%
that we want DHCP services on.

188
07:22.110 --> 07:24.080 align:middle line:84%
And we can specify the range.

189
07:24.080 --> 07:26.850 align:middle line:90%
So let's go ahead and
start the range at 101

190
07:26.850 --> 07:31.170 align:middle line:90%
the first valid IP address,
in the 10.16.20 network.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

190
07:26.850 --> 07:31.170 align:middle line:90%
the first valid IP address,
in the 10.16.20 network.

191
07:31.170 --> 07:32.080 align:middle line:84%
Fantastic.

192
07:32.080 --> 07:32.580 align:middle line:84%
All right.

193
07:32.580 --> 07:33.830 align:middle line:84%
So it is done.

194
07:33.830 --> 07:35.080 align:middle line:84%
Let's go ahead and close that.

195
07:35.080 --> 07:37.640 align:middle line:84%
Let's also configured DHCP bad.

196
07:37.640 --> 07:39.930 align:middle line:90%
And on DHCP bad, we'll
bring that window

197
07:39.930 --> 07:41.550 align:middle line:84%
in the viewing space here.

198
07:41.550 --> 07:44.730 align:middle line:90%
And on DHCP bad,
we'll go to Config,

199
07:44.730 --> 07:46.050 align:middle line:84%
we'll go to its interface.

200
07:46.050 --> 07:49.140 align:middle line:90%
And let's go ahead
and use 10.99.99.1.

201
07:49.140 --> 07:55.300 align:middle line:90%
We'll take the first IP
address, with a 24-bit mask.

202
07:55.300 --> 07:56.170 align:middle line:84%
That's great.

203
07:56.170 --> 08:00.180 align:middle line:90%
And let's go to
Services, and DHCP,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

203
07:56.170 --> 08:00.180 align:middle line:90%
And let's go to
Services, and DHCP,

204
08:00.180 --> 08:02.050 align:middle line:90%
and say that we
want to enable it.

205
08:02.050 --> 08:04.950 align:middle line:84%
And let's start at 101.

206
08:04.950 --> 08:07.770 align:middle line:90%
So 10.99.99.1 will be
the starting address

207
08:07.770 --> 08:11.700 align:middle line:90%
for the pool of addresses
that the DHCP bad server

208
08:11.700 --> 08:13.920 align:middle line:84%
is going to try to hand out.

209
08:13.920 --> 08:16.950 align:middle line:90%
So now, with DHCP good
set up with an IP address,

210
08:16.950 --> 08:19.867 align:middle line:90%
and DHCP services
enabled, and DHCP bad also

211
08:19.867 --> 08:22.200 align:middle line:90%
set up, with a different IP
address, and different range

212
08:22.200 --> 08:23.200 align:middle line:84%
of addresses.

213
08:23.200 --> 08:26.730 align:middle line:90%
Let's go ahead and enable the
two clients to be DHCP clients,

214
08:26.730 --> 08:29.010 align:middle line:90%
and see which IP
addresses they pull from,

215
08:29.010 --> 08:31.230 align:middle line:84%
the good DHCP server or the bad.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

215
08:29.010 --> 08:31.230 align:middle line:84%
the good DHCP server or the bad.

216
08:31.230 --> 08:33.630 align:middle line:90%
Now, our intention is
that, because DHCP snooping

217
08:33.630 --> 08:36.299 align:middle line:90%
is enabled, and it's
also set up for VLAN 1,

218
08:36.299 --> 08:39.299 align:middle line:90%
and the port that's connected
to the bad DHCP server

219
08:39.299 --> 08:43.140 align:middle line:90%
is not trusted, anytime that
server tries to do offers,

220
08:43.140 --> 08:46.150 align:middle line:90%
those should be rejected, and
not make it into the network.

221
08:46.150 --> 08:47.010 align:middle line:84%
Let's test it.

222
08:47.010 --> 08:48.840 align:middle line:90%
So here on the PC,
we'll just click on it

223
08:48.840 --> 08:50.770 align:middle line:90%
to bring up the
console for that.

224
08:50.770 --> 08:52.670 align:middle line:84%
And we'll go to Config.

225
08:52.670 --> 08:54.690 align:middle line:84%
We'll go to fast Ethernet 0.

226
08:54.690 --> 08:56.670 align:middle line:90%
And we'll simply click
on this radio button,

227
08:56.670 --> 08:58.810 align:middle line:84%
and watch this field right here.

228
08:58.810 --> 09:02.400 align:middle line:84%
10.16.20, oh, dot 2.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

228
08:58.810 --> 09:02.400 align:middle line:84%
10.16.20, oh, dot 2.

229
09:02.400 --> 09:05.460 align:middle line:90%
Didn't we tell it
to start at 100?

230
09:05.460 --> 09:07.060 align:middle line:84%
Let's go check the DHCP server.

231
09:07.060 --> 09:09.810 align:middle line:90%
So it got the IP address
from the correct DHCP server.

232
09:09.810 --> 09:12.370 align:middle line:90%
But I think the range isn't
quite what I expected.

233
09:12.370 --> 09:14.370 align:middle line:90%
So let's go back
to the DHCP server.

234
09:14.370 --> 09:16.670 align:middle line:84%
Go back to Services, DHCP.

235
09:16.670 --> 09:17.970 align:middle line:84%
Oh, OK.

236
09:17.970 --> 09:20.023 align:middle line:90%
So for some reason,
the starting address,

237
09:20.023 --> 09:22.440 align:middle line:90%
I thought I put in a higher
number, like 101 or something,

238
09:22.440 --> 09:23.232 align:middle line:84%
and it didn't take.

239
09:23.232 --> 09:24.030 align:middle line:84%
That's OK.

240
09:24.030 --> 09:25.080 align:middle line:84%
I can live with that.

241
09:25.080 --> 09:30.610 align:middle line:90%
And let's go to PC 2, and
make it a DHCP client as well.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

241
09:25.080 --> 09:30.610 align:middle line:90%
And let's go to PC 2, and
make it a DHCP client as well.

242
09:30.610 --> 09:34.200 align:middle line:90%
So we'll go to Config,
fast Ethernet the 0.

243
09:34.200 --> 09:35.370 align:middle line:84%
DHCP.

244
09:35.370 --> 09:37.530 align:middle line:84%
And survey says, 3!

245
09:37.530 --> 09:38.280 align:middle line:84%
All right.

246
09:38.280 --> 09:40.480 align:middle line:90%
So I must have mucked
up the starting range.

247
09:40.480 --> 09:41.630 align:middle line:84%
Here's the server again.

248
09:41.630 --> 09:42.505 align:middle line:84%
I mean, I am curious.

249
09:42.505 --> 09:44.820 align:middle line:84%
So DHCP, yes.

250
09:44.820 --> 09:46.390 align:middle line:84%
It's not keeping that.

251
09:46.390 --> 09:49.320 align:middle line:90%
So start address, it just didn't
want to keep the start address.

252
09:49.320 --> 09:49.990 align:middle line:84%
Fair enough.

253
09:49.990 --> 09:50.490 align:middle line:84%
All right.

254
09:50.490 --> 09:53.277 align:middle line:90%
So it's not starting
off at 101, or 100.

255
09:53.277 --> 09:55.860 align:middle line:90%
It's starting off with the first
next available address, which

256
09:55.860 --> 09:56.620 align:middle line:84%
is OK.

257
09:56.620 --> 09:58.890 align:middle line:90%
The goal here is to verify
that we're getting the IP

258
09:58.890 --> 10:00.660 align:middle line:90%
addresses from the
correct server,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

258
09:58.890 --> 10:00.660 align:middle line:90%
addresses from the
correct server,

259
10:00.660 --> 10:03.610 align:middle line:90%
and not from the
DHCP bad server.

260
10:03.610 --> 10:05.490 align:middle line:90%
So let's go back to
the switch, and let's

261
10:05.490 --> 10:07.390 align:middle line:84%
verify what's going on.

262
10:07.390 --> 10:10.080 align:middle line:90%
So if you do an up arrow
key, show IP DHCP snooping,

263
10:10.080 --> 10:11.050 align:middle line:84%
press Enter.

264
10:11.050 --> 10:15.310 align:middle line:90%
It's showing us here that fast
Ethernet 0/1 is a trusted port,

265
10:15.310 --> 10:18.990 align:middle line:84%
that O2, 03, 04, all untrusted.

266
10:18.990 --> 10:21.780 align:middle line:90%
And as a result, that's
why the bad DHCP server

267
10:21.780 --> 10:24.060 align:middle line:90%
didn't have the opportunity
to respond and get any

268
10:24.060 --> 10:26.118 align:middle line:84%
of its offers into the switch.

269
10:26.118 --> 10:27.660 align:middle line:90%
And if we else did
one other command,

270
10:27.660 --> 10:30.420 align:middle line:90%
show IP DHCP snipping
binding, this
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

270
10:27.660 --> 10:30.420 align:middle line:90%
show IP DHCP snipping
binding, this

271
10:30.420 --> 10:32.925 align:middle line:90%
is going to give us information
about the layer 2 addresses,

272
10:32.925 --> 10:34.800 align:middle line:90%
and the corresponding
IP addresses, that have

273
10:34.800 --> 10:37.810 align:middle line:84%
been learned via DHCP snooping.

274
10:37.810 --> 10:41.580 align:middle line:90%
So this says that the
client at 10.16.20.2

275
10:41.580 --> 10:45.240 align:middle line:90%
has this Mac address, and the
client with this IP address

276
10:45.240 --> 10:47.660 align:middle line:90%
has this corresponding
Mac address.

277
10:47.660 --> 10:49.720 align:middle line:90%
In this video, we did
three basic things.

278
10:49.720 --> 10:51.300 align:middle line:90%
Number one, we
designed a network.

279
10:51.300 --> 10:54.510 align:middle line:90%
Two, we put that network in
place inside of Packet Tracer.

280
10:54.510 --> 10:56.910 align:middle line:90%
And third, we
implemented and verified

281
10:56.910 --> 11:00.990 align:middle line:90%
DHCP snooping, to protect the
network against rogue DHCP
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

281
10:56.910 --> 11:00.990 align:middle line:90%
DHCP snooping, to protect the
network against rogue DHCP

282
11:00.990 --> 11:04.950 align:middle line:90%
servers, that otherwise may be
accidentally or intentionally

283
11:04.950 --> 11:06.190 align:middle line:84%
added to our network.

284
11:06.190 --> 11:08.607 align:middle line:90%
And this can protect us
against those types of attacks.

285
11:08.607 --> 11:10.440 align:middle line:90%
And here's the reason
why this is important.

286
11:10.440 --> 11:12.690 align:middle line:90%
It's because in
production networks,

287
11:12.690 --> 11:16.230 align:middle line:90%
rogue DHCP servers do get
introduced all the time.

288
11:16.230 --> 11:17.700 align:middle line:90%
And lot of times,
it's accidental.

289
11:17.700 --> 11:19.050 align:middle line:84%
People bringing stuff from home.

290
11:19.050 --> 11:21.630 align:middle line:90%
They don't realize DHCP
services were enabled on it,

291
11:21.630 --> 11:24.460 align:middle line:90%
and there's a disruption
of network services.

292
11:24.460 --> 11:27.900 align:middle line:90%
So it's important to understand
the concept, to practice it,

293
11:27.900 --> 11:29.890 align:middle line:84%
to see the results, verify it.

294
11:29.890 --> 11:31.590 align:middle line:90%
And that way, when
it comes time for us
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

294
11:29.890 --> 11:31.590 align:middle line:90%
And that way, when
it comes time for us

295
11:31.590 --> 11:34.710 align:middle line:90%
to either implement this, or
verify this, or troubleshoot

296
11:34.710 --> 11:36.150 align:middle line:90%
this in a production
environment,

297
11:36.150 --> 11:39.390 align:middle line:90%
we'll be that much more ready
to help defend and protect

298
11:39.390 --> 11:40.510 align:middle line:84%
our networks.

299
11:40.510 --> 11:42.250 align:middle line:90%
So I'm glad you joined
me in this video.

300
11:42.250 --> 11:44.010 align:middle line:90%
I hope this has been
informative for you,

301
11:44.010 --> 11:47.420 align:middle line:90%
and I'd like to thank
you for viewing.