WEBVTT

1
00:00.000 --> 00:01.410 align:middle line:84%


2
00:01.410 --> 00:02.840 align:middle line:84%
I'm a big fan for a deal.

3
00:02.840 --> 00:05.470 align:middle line:90%
Like if we buy something,
and they say, oh, by the way,

4
00:05.470 --> 00:06.900 align:middle line:90%
for just this
little bit more, you

5
00:06.900 --> 00:08.743 align:middle line:90%
get these additional
features or functions--

6
00:08.743 --> 00:10.410 align:middle line:90%
I'm a sucker for that
almost every time.

7
00:10.410 --> 00:12.990 align:middle line:90%
Well, in the world of
security, for our switches,

8
00:12.990 --> 00:15.270 align:middle line:90%
if we've implemented
DHCP snooping,

9
00:15.270 --> 00:18.120 align:middle line:90%
our switches are listening
to all the DHCP traffic.

10
00:18.120 --> 00:20.100 align:middle line:90%
They're keeping the
rogue DHCP servers out.

11
00:20.100 --> 00:21.810 align:middle line:90%
But, at the same
time, they're also

12
00:21.810 --> 00:23.520 align:middle line:90%
learning the IP
addresses that have

13
00:23.520 --> 00:24.750 align:middle line:84%
been assigned to our clients.

14
00:24.750 --> 00:27.730 align:middle line:90%
And they know their
associated layer 2 addresses.

15
00:27.730 --> 00:29.490 align:middle line:84%
And that's in a binding table.

16
00:29.490 --> 00:31.470 align:middle line:90%
What we can do is we can
enable another feature
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

16
00:29.490 --> 00:31.470 align:middle line:90%
What we can do is we can
enable another feature

17
00:31.470 --> 00:32.880 align:middle line:84%
called Source Guard.

18
00:32.880 --> 00:35.610 align:middle line:90%
And what this does, it
helps protect the network

19
00:35.610 --> 00:38.010 align:middle line:90%
against those hosts that are
now connected to the network

20
00:38.010 --> 00:39.020 align:middle line:84%
from lying--

21
00:39.020 --> 00:41.010 align:middle line:90%
lying about their
source IP addresses

22
00:41.010 --> 00:43.180 align:middle line:90%
or lying about their
source MAC addresses.

23
00:43.180 --> 00:45.190 align:middle line:84%
Let's take a closer look.

24
00:45.190 --> 00:47.910 align:middle line:90%
So let's use this scenario where
we have an access layer switch.

25
00:47.910 --> 00:50.250 align:middle line:90%
DHCP snooping is
already enabled.

26
00:50.250 --> 00:51.840 align:middle line:84%
Here's a DHCP client.

27
00:51.840 --> 00:54.510 align:middle line:90%
It did a discover, offer,
acknowledgement, request

28
00:54.510 --> 00:57.118 align:middle line:90%
acknowledgment process
with the DHCP server.

29
00:57.118 --> 00:59.160 align:middle line:90%
So in addition to what
the switch normally knows,

30
00:59.160 --> 01:01.620 align:middle line:90%
which is the layer 2 address
and what port it's on,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

30
00:59.160 --> 01:01.620 align:middle line:90%
which is the layer 2 address
and what port it's on,

31
01:01.620 --> 01:04.470 align:middle line:90%
the switch also now knows--
because of the DHCP snooping,

32
01:04.470 --> 01:07.470 align:middle line:90%
it now knows the IP address
and the MAC address that

33
01:07.470 --> 01:08.752 align:middle line:84%
are associated with this port.

34
01:08.752 --> 01:10.960 align:middle line:90%
Now, what we could do with
that-- and this is really,

35
01:10.960 --> 01:11.670 align:middle line:84%
really cool--

36
01:11.670 --> 01:13.820 align:middle line:84%
is called Source Guard.

37
01:13.820 --> 01:16.050 align:middle line:90%
And with Source Guard, we
can go to this interface,

38
01:16.050 --> 01:17.410 align:middle line:84%
this port on the switch.

39
01:17.410 --> 01:20.880 align:middle line:90%
And we can say, dear Mr.
Switch, if traffic coming

40
01:20.880 --> 01:23.790 align:middle line:90%
in on this port, if it
does not have the source

41
01:23.790 --> 01:26.250 align:middle line:90%
address of this IP
address and it does not

42
01:26.250 --> 01:28.770 align:middle line:90%
have this source MAC
address of this coming in,

43
01:28.770 --> 01:30.070 align:middle line:84%
go ahead and deny the traffic.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

43
01:28.770 --> 01:30.070 align:middle line:84%
go ahead and deny the traffic.

44
01:30.070 --> 01:32.310 align:middle line:90%
So that way, if the client is
running some kind of software

45
01:32.310 --> 01:34.680 align:middle line:90%
or malware that is trying to
trick the network and spoof

46
01:34.680 --> 01:36.870 align:middle line:90%
source addresses or
source MAC addresses,

47
01:36.870 --> 01:39.060 align:middle line:90%
the switch can go ahead
and drop it right here

48
01:39.060 --> 01:41.033 align:middle line:84%
just by using Source Guard.

49
01:41.033 --> 01:43.200 align:middle line:90%
And so let me take you to
a network where we already

50
01:43.200 --> 01:45.030 align:middle line:84%
have DHCP snooping installed.

51
01:45.030 --> 01:46.530 align:middle line:84%
It's working and functioning.

52
01:46.530 --> 01:47.905 align:middle line:90%
And what we'll do
is we'll simply

53
01:47.905 --> 01:50.430 align:middle line:90%
add on the command for
Source Guard on this port.

54
01:50.430 --> 01:52.410 align:middle line:90%
In fact, let me show you
what that command is.

55
01:52.410 --> 01:54.390 align:middle line:90%
In interface configuration
mode, the command

56
01:54.390 --> 01:58.140 align:middle line:84%
is ip verify source.

57
01:58.140 --> 02:01.260 align:middle line:90%
Now we could press Enter right
there after we type in source.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

57
01:58.140 --> 02:01.260 align:middle line:90%
Now we could press Enter right
there after we type in source.

58
02:01.260 --> 02:04.000 align:middle line:90%
And that would verify that the
source IP address is correct.

59
02:04.000 --> 02:06.030 align:middle line:90%
But if we want to
include the source IP

60
02:06.030 --> 02:07.980 align:middle line:90%
address and the
source MAC address,

61
02:07.980 --> 02:11.224 align:middle line:90%
we can add on the next keyword,
which is port security.

62
02:11.224 --> 02:13.888 align:middle line:84%


63
02:13.888 --> 02:16.430 align:middle line:90%
So if you're like me, when I
saw that keyword, port security,

64
02:16.430 --> 02:18.440 align:middle line:90%
for the first time, I
thought, port security?

65
02:18.440 --> 02:19.880 align:middle line:90%
Wait a sec, port
security is the feature

66
02:19.880 --> 02:21.590 align:middle line:90%
where we're controlling
the number of MAC addresses

67
02:21.590 --> 02:22.372 align:middle line:84%
on a port.

68
02:22.372 --> 02:24.830 align:middle line:90%
So it's very likely, when these
commands and these security

69
02:24.830 --> 02:27.775 align:middle line:90%
techniques were created, it was
probably two separate teams.

70
02:27.775 --> 02:29.150 align:middle line:90%
And they both
didn't realize they

71
02:29.150 --> 02:30.942 align:middle line:90%
were using the same
kind of concept or term
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

71
02:29.150 --> 02:30.942 align:middle line:90%
were using the same
kind of concept or term

72
02:30.942 --> 02:31.730 align:middle line:84%
of port security.

73
02:31.730 --> 02:33.850 align:middle line:90%
So here, as used as part
of Source Guard, when

74
02:33.850 --> 02:36.620 align:middle line:90%
we use the port security
option, is simply means,

75
02:36.620 --> 02:39.530 align:middle line:90%
besides the IP address
verification of the source IP,

76
02:39.530 --> 02:41.960 align:middle line:90%
also, let's verify
the source MAC address

77
02:41.960 --> 02:43.280 align:middle line:84%
associated with that IP.

78
02:43.280 --> 02:45.480 align:middle line:90%
And that's what it
means in this context.

79
02:45.480 --> 02:47.610 align:middle line:90%
So this is a one-liner
command to add

80
02:47.610 --> 02:49.880 align:middle line:90%
in interface configuration
mode on a port.

81
02:49.880 --> 02:51.755 align:middle line:90%
Let me go ahead and
demonstrate that for you.

82
02:51.755 --> 02:53.422 align:middle line:90%
So here on the access
switch, let's just

83
02:53.422 --> 02:55.080 align:middle line:90%
confirm that DHCP
snooping is working.

84
02:55.080 --> 02:57.980 align:middle line:90%
We'll do a show
ip dhcp snooping--

85
02:57.980 --> 02:58.880 align:middle line:84%
Enter.

86
02:58.880 --> 03:00.860 align:middle line:84%
And it is.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

86
02:58.880 --> 03:00.860 align:middle line:84%
And it is.

87
03:00.860 --> 03:04.430 align:middle line:90%
And if we do a show ip
dhcp snooping binding,

88
03:04.430 --> 03:06.600 align:middle line:90%
it can show us what it
already knows about.

89
03:06.600 --> 03:08.330 align:middle line:90%
So in the binding
table, it says, yep,

90
03:08.330 --> 03:09.950 align:middle line:90%
I know about this
IP address with

91
03:09.950 --> 03:11.690 align:middle line:84%
this associated MAC address.

92
03:11.690 --> 03:12.860 align:middle line:84%
And it's in VLAN 30.

93
03:12.860 --> 03:14.990 align:middle line:90%
I learned about it
via DHCP snooping.

94
03:14.990 --> 03:18.620 align:middle line:90%
And it's also possible for us
to manually enter IP addresses

95
03:18.620 --> 03:20.628 align:middle line:90%
and MAC addresses to
become part of this table.

96
03:20.628 --> 03:22.670 align:middle line:90%
This is just showing us
how this entry right here

97
03:22.670 --> 03:24.530 align:middle line:84%
was learned via DHCP snooping.

98
03:24.530 --> 03:27.110 align:middle line:84%
And it was learned on gig 0/1.

99
03:27.110 --> 03:28.550 align:middle line:84%
That's where our client is.

100
03:28.550 --> 03:33.610 align:middle line:90%
So if we wanted to
add Source Guard,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

100
03:28.550 --> 03:33.610 align:middle line:90%
So if we wanted to
add Source Guard,

101
03:33.610 --> 03:36.430 align:middle line:90%
we could simply go into
interface configuration mode

102
03:36.430 --> 03:41.110 align:middle line:90%
and use the command ip verify
source space port-security.

103
03:41.110 --> 03:44.620 align:middle line:90%
And then going forward
on this port, any traffic

104
03:44.620 --> 03:47.290 align:middle line:90%
that is sourced from an IP
address other than this one,

105
03:47.290 --> 03:50.450 align:middle line:90%
or if it's sent from a layer
2 address other this one,

106
03:50.450 --> 03:52.990 align:middle line:90%
the switch will drop
the packet right there

107
03:52.990 --> 03:54.240 align:middle line:84%
at that switch port.

108
03:54.240 --> 03:55.740 align:middle line:90%
So let's go into
configuration mode.

109
03:55.740 --> 03:58.690 align:middle line:90%
We'll go into to
interface gig 0/1.

110
03:58.690 --> 04:02.320 align:middle line:90%
And we'll issue the
command ip verify source.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

110
03:58.690 --> 04:02.320 align:middle line:90%
And we'll issue the
command ip verify source.

111
04:02.320 --> 04:04.325 align:middle line:90%
And then, if we
wanted to, this is

112
04:04.325 --> 04:06.700 align:middle line:90%
implying that we could press
Enter right here, a carriage

113
04:06.700 --> 04:07.418 align:middle line:84%
return.

114
04:07.418 --> 04:09.460 align:middle line:90%
And that would just verify
the source IP address.

115
04:09.460 --> 04:12.550 align:middle line:90%
Or we could add on the
keyword of port security.

116
04:12.550 --> 04:15.250 align:middle line:90%
And that's now also going to
verify the source layer two

117
04:15.250 --> 04:18.860 align:middle line:90%
information in each of the
frames coming in on that port.

118
04:18.860 --> 04:21.233 align:middle line:90%
And then we can do the command
show ip source binding.

119
04:21.233 --> 04:22.900 align:middle line:90%
This is just simply
showing us the table

120
04:22.900 --> 04:24.432 align:middle line:90%
that it's going to
be pulling from.

121
04:24.432 --> 04:26.140 align:middle line:90%
So right now, we only
have one entry that

122
04:26.140 --> 04:27.550 align:middle line:84%
was learned via DHCP snooping.

123
04:27.550 --> 04:28.660 align:middle line:84%
It's for that client.

124
04:28.660 --> 04:32.440 align:middle line:90%
Then if we do the command show
ip verify source and press
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

124
04:28.660 --> 04:32.440 align:middle line:90%
Then if we do the command show
ip verify source and press

125
04:32.440 --> 04:36.490 align:middle line:90%
Enter, it'll give us the details
on what it's controlling.

126
04:36.490 --> 04:40.690 align:middle line:90%
So the show ip verify source
says, OK, I'm gig 0/1.

127
04:40.690 --> 04:43.180 align:middle line:90%
I'm going to be watching
for the source IP address

128
04:43.180 --> 04:44.950 align:middle line:84%
and the source MAC address.

129
04:44.950 --> 04:47.470 align:middle line:90%
And then, regarding what
source IP address and layer 2

130
04:47.470 --> 04:49.530 align:middle line:90%
address to compare
against and allow,

131
04:49.530 --> 04:51.760 align:middle line:90%
it's using and leveraging
the information that

132
04:51.760 --> 04:53.600 align:middle line:84%
was gained via DHCP snooping.

133
04:53.600 --> 04:55.780 align:middle line:90%
So if the client
spits out a source MAC

134
04:55.780 --> 04:59.530 align:middle line:90%
address other than this one
or it spits out a source IP

135
04:59.530 --> 05:01.510 align:middle line:90%
address other than
this one, the packet
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

135
04:59.530 --> 05:01.510 align:middle line:90%
address other than
this one, the packet

136
05:01.510 --> 05:04.360 align:middle line:90%
will be dropped based on this
add-on feature that we just

137
05:04.360 --> 05:07.150 align:middle line:84%
put in called Source Guard.

138
05:07.150 --> 05:08.583 align:middle line:90%
In this video,
we've taken a look

139
05:08.583 --> 05:10.000 align:middle line:90%
at how we can
improve our security

140
05:10.000 --> 05:11.770 align:middle line:84%
by adding on Source Guard.

141
05:11.770 --> 05:14.650 align:middle line:90%
So since we already have, from
DHCP snooping, information

142
05:14.650 --> 05:17.278 align:middle line:90%
about the layer 2 address
and associated IP address,

143
05:17.278 --> 05:19.570 align:middle line:90%
with Source Guard, we're
simply training that interface

144
05:19.570 --> 05:22.450 align:middle line:90%
that, hey, if any traffic
comes into this port

145
05:22.450 --> 05:25.360 align:middle line:90%
and the source address for the
layer 2 or the source address

146
05:25.360 --> 05:28.570 align:middle line:90%
for IP is wrong or doesn't
match up, go ahead and drop it

147
05:28.570 --> 05:30.850 align:middle line:90%
right there, which is an
awesome security measure.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

147
05:28.570 --> 05:30.850 align:middle line:90%
right there, which is an
awesome security measure.

148
05:30.850 --> 05:32.870 align:middle line:90%
So thanks for joining
me in this video.

149
05:32.870 --> 05:34.660 align:middle line:90%
I hope this has been
informative for you.

150
05:34.660 --> 05:37.830 align:middle line:90%
And I'd like to thank
you for viewing.