DHCP Snooping: Basic Concepts and Configuration

 

DHCP Snooping: Basic Concepts and Configuration

Video Link:        https://youtu.be/eeeYQ8eERdc

 Let's start guys.

We will configure our Main DHCP server, which is a valid/Trusted DHCP server

DHCP-Server

R1(config)#hostname DHCP-Server DHCP-Server(config)#int f0/0 DHCP-Server(config-if)#ip add 10.1.1.1 255.255.255.0 DHCP-Server(config-if)#no sh DHCP-Server(config-if)#exit   DHCP-Server(config)#ip dhcp pool Trusted-Network DHCP-Server(dhcp-config)#network 10.1.1.0 255.255.255.0 DHCP-Server(dhcp-config)#default-router 10.1.1.1 DHCP-Server(dhcp-config)#dns-server 8.8.8.8 DHCP-Server(dhcp-config)#do wr

 

All Client PC will get IP info from 10.1.1.0 network of that DHCP Server’s pool.

Now, think, anyone has come with a rogue dhcp server, which is configured as below.

Rogue-DServer

R2(config)#hostname Rogue-DServer Rogue-DServer(config)#int f0/0 Rogue-DServer (config-if)#ip add 10.2.2.2 255.255.255.0 Rogue-DServer (config-if)#no sh Rogue-DServer (config-if)#exit   Rogue-DServer (config)#ip dhcp pool untrust-network Rogue-DServer (dhcp-config)#network 10.2.2.0 255.255.255.0 Rogue-DServer (dhcp-config)#default-router 10.2.2.2 Rogue-DServer(dhcp-config)#dns-server 8.8.8.8 Rogue-DServer(dhcp-config)#do wr

 

Now what will happen for the client PC’s?

Client will get from 2 DHCP server. They will from valid server as well as from rogue DHCP server. See below images

 

 

 It is a security problem. So now, we will solve it Insha-Allah. Ok dear.

!!!!!!!!!!!!!!!!!!!!!                                  Be cheerful                             !!!!!!!!!!!!!!!!!!!!!!

We will use a Layer-2 switch to configure snooping. So that, Switch will be allowed only trusted DHCP port, not any other ports unnecessarily.

L2-SW-1

L2-SW-1>en L2-SW-2#conf t L2-SW-1(config)#hostname snooping-sw snooping-sw (config)#ip dhcp snooping snooping-sw(config)#ip dhcp snooping  vlan 1   snooping-sw(config-if)#int g0/0    ; [Here e0 means g0/0, you can see your interface label] snooping-sw(config-if)# ip dhcp snooping trust snooping-sw(config-if)#ip dhcp snooping limit rate 100 snooping-sw(config-if)#do sh ip dhcp snooping

 

When we enable “ip dhcp snooping” command on the switch, it will insert option 82 information to provide additional information about the client to the server. As well as switch will make GIADDRESS as 0.0.0.0

The problem with this is, whenever the router, which is acting as DHCP server or DHCP Relay agent, receives any DHCP message with GIADDRESS value 0.0.0.0 it drops the packet.

In order to prevent this either remove option 82 information on the switch by using the following command

L2-Sw-1

snooping-sw(config) no  ip dhcp snooping information option

 

If you want to allow the DHCP packets with GIADDRESS 0.0.0.0 on DHCP server or Relay Agent, simply configure command

DHCP-Server

DHCP-Server (config)#ip dhcp relay information trust-all

 

Now, we can check our client’s IP information.

Now, our Problem is solved.

Alhamdulillah.