WEBVTT

1
00:00.000 --> 00:00.150 align:middle line:84%


2
00:00.150 --> 00:02.525 align:middle line:90%
We're going to finish up this
section with a quick review

3
00:02.525 --> 00:04.140 align:middle line:84%
regarding DHCP snooping.

4
00:04.140 --> 00:06.600 align:middle line:90%
Let's begin with
question number one,

5
00:06.600 --> 00:09.218 align:middle line:90%
how does DHCP snooping
protect the network?

6
00:09.218 --> 00:11.760 align:middle line:90%
Take a look at these answers,
we'll be back in just a moment.

7
00:11.760 --> 00:15.592 align:middle line:84%
[MUSIC PLAYING]

8
00:15.592 --> 00:21.058 align:middle line:84%


9
00:21.058 --> 00:23.100 align:middle line:90%
And let's take a moment
and consider the answers.

10
00:23.100 --> 00:26.410 align:middle line:90%
Answer A says switch
denies inbound DHCP server

11
00:26.410 --> 00:30.070 align:middle line:90%
messages, which would be true
if DHCP snooping was enabled,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

11
00:26.410 --> 00:30.070 align:middle line:90%
messages, which would be true
if DHCP snooping was enabled,

12
00:30.070 --> 00:33.220 align:middle line:84%
on half-duplex ports.

13
00:33.220 --> 00:34.780 align:middle line:90%
Now the reality is
it would do that

14
00:34.780 --> 00:37.390 align:middle line:90%
on full-duplex ports
or half-duplex ports,

15
00:37.390 --> 00:41.240 align:middle line:90%
if it was an untrusted
DHCP snooping port.

16
00:41.240 --> 00:45.010 align:middle line:90%
So let's just consider answer
A, and look at the rest.

17
00:45.010 --> 00:46.930 align:middle line:90%
Answer B says
switch denies frames

18
00:46.930 --> 00:50.410 align:middle line:90%
if the maximum MAC
address count is exceeded.

19
00:50.410 --> 00:52.160 align:middle line:90%
That would be an example
of port security,

20
00:52.160 --> 00:54.200 align:middle line:84%
so that's not DHCP snooping.

21
00:54.200 --> 00:57.610 align:middle line:90%
C, switch denies frames if the
user hasn't been authenticated.

22
00:57.610 --> 00:59.440 align:middle line:84%
That's not applicable here.

23
00:59.440 --> 01:01.940 align:middle line:90%
We certainly have other features
in Cisco that will do that,
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

23
00:59.440 --> 01:01.940 align:middle line:90%
We certainly have other features
in Cisco that will do that,

24
01:01.940 --> 01:03.790 align:middle line:90%
but it's not DHCP
snooping that's checking

25
01:03.790 --> 01:05.379 align:middle line:84%
for authenticated users.

26
01:05.379 --> 01:08.680 align:middle line:90%
Answer D, switch denies
inbound DHCP server messages

27
01:08.680 --> 01:10.810 align:middle line:84%
on untrusted DHCP ports.

28
01:10.810 --> 01:14.010 align:middle line:90%
That's our winner, right here,
answer D. So up here, answer

29
01:14.010 --> 01:16.270 align:middle line:90%
A kind of looks
almost OK, but it's

30
01:16.270 --> 01:17.890 align:middle line:84%
referring to half-duplex ports.

31
01:17.890 --> 01:21.290 align:middle line:90%
Answer D is the best answer
here, because it's correct.

32
01:21.290 --> 01:24.340 align:middle line:90%
And it's on to
question number two.

33
01:24.340 --> 01:27.820 align:middle line:90%
Which feature can leverage the
information learned via DHCP

34
01:27.820 --> 01:31.965 align:middle line:90%
snooping and use that to prevent
IP address spoofing as well?
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

34
01:27.820 --> 01:31.965 align:middle line:90%
snooping and use that to prevent
IP address spoofing as well?

35
01:31.965 --> 01:34.340 align:middle line:90%
Take a look at the answers
and we'll be back in a moment.

36
01:34.340 --> 01:37.826 align:middle line:84%
[MUSIC PLAYING]

37
01:37.826 --> 01:43.810 align:middle line:84%


38
01:43.810 --> 01:46.630 align:middle line:90%
And the answer to this
question is source guard.

39
01:46.630 --> 01:49.180 align:middle line:90%
We can add that on top,
using the information

40
01:49.180 --> 01:51.550 align:middle line:90%
in the DHCP snooping
binding table,

41
01:51.550 --> 01:53.080 align:middle line:84%
to go ahead and also prevent.

42
01:53.080 --> 01:54.910 align:middle line:90%
If we implement
source guard, we can

43
01:54.910 --> 01:57.310 align:middle line:84%
prevent IP spoofing at layer 3.

44
01:57.310 --> 02:00.170 align:middle line:90%
And let's do one more question
together, and that's this one.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

44
01:57.310 --> 02:00.170 align:middle line:90%
And let's do one more question
together, and that's this one.

45
02:00.170 --> 02:04.940 align:middle line:90%
What is the default for a port
when DHCP snooping is applied?

46
02:04.940 --> 02:06.430 align:middle line:90%
Meaning it's enabled
for the VLAN,

47
02:06.430 --> 02:10.600 align:middle line:90%
what is the default status for
a port, regarding DHCP snooping?

48
02:10.600 --> 02:13.946 align:middle line:84%
[MUSIC PLAYING]

49
02:13.946 --> 02:20.170 align:middle line:84%


50
02:20.170 --> 02:22.120 align:middle line:90%
And the answer
here is, by default

51
02:22.120 --> 02:26.770 align:middle line:90%
that port would be an untrusted,
DHCP snooping, untrusted port,

52
02:26.770 --> 02:29.800 align:middle line:90%
meaning no DHCP server
type messages would be

53
02:29.800 --> 02:31.880 align:middle line:84%
allowed to enter into the port.
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

53
02:29.800 --> 02:31.880 align:middle line:84%
allowed to enter into the port.

54
02:31.880 --> 02:34.250 align:middle line:90%
And if we do have a real
DHCP server on our network,

55
02:34.250 --> 02:35.625 align:middle line:90%
we'd want to go
ahead and specify

56
02:35.625 --> 02:38.530 align:middle line:90%
those ports that lead to the
real, authorized DHCP server.

57
02:38.530 --> 02:41.140 align:middle line:90%
We'd want to hard code
those as trusted ports

58
02:41.140 --> 02:43.510 align:middle line:90%
so that those servers
on those trusted ports

59
02:43.510 --> 02:44.530 align:middle line:84%
could indeed respond.

60
02:44.530 --> 02:47.150 align:middle line:84%
But the default is untrusted.

61
02:47.150 --> 02:48.910 align:middle line:90%
So thanks for joining
me in these videos,

62
02:48.910 --> 02:52.000 align:middle line:90%
and in this review section
regarding DHCP snooping.

63
02:52.000 --> 02:54.260 align:middle line:90%
And I'll see you, my
friend, in our next video.

64
02:54.260 --> 02:56.890 align:middle line:90%
Meanwhile, I hope this has
been informative for you,

65
02:56.890 --> 02:59.832 align:middle line:90%
and I'd like to thank
you for viewing.

66
02:59.832 --> 03:00.332 align:middle line:84%
WEBVTT
X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000

66
02:59.832 --> 03:00.332 align:middle line:84%