DHCP snooping

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

DHCP snooping is a network security feature that filters DHCP messages and builds trusted bindings between clients and assigned addresses.

DHCP snooping is a Layer 2 switch security feature that inspects DHCP messages and filters attacks such as rogue-server poisoning and DHCP exhaustion. It affects DHCP messages only; non-DHCP traffic is unaffected. section 13.0 section 13.3

Enable the feature globally, then activate it on every VLAN containing DHCP clients. It is disabled by default, and a VLAN can be configured but inactive when the VLAN itself is disabled. section 13.2

Apply the trusted-port model as follows:

• Keep ports toward end hosts untrusted; all ports are untrusted by default. section 13.2.1
• Configure ports toward the DHCP server or upstream DHCP path as trusted with ip dhcp snooping trust. section 13.2.1
• Allow all DHCP messages received on trusted ports, while filtering DHCP messages received on untrusted ports. section 13.2.1
• Discard server messages such as OFFER, ACK, and NAK on untrusted ports; process client messages such as DISCOVER, REQUEST, DECLINE, and RELEASE. section 13.3 section 13.2.1
• Check that the Ethernet source MAC address matches the DHCP chaddr in DISCOVER and REQUEST messages; discard mismatches. section 13.3
• Create a DHCP snooping binding-table entry after a client successfully leases an address. section 13.3

Configure and verify VLAN 1

SW2(config)# ip dhcp snooping SW2(config)# ip dhcp snooping vlan 1 SW2(config)# interface g0/1 SW2(config-if)# ip dhcp snooping trust SW2(config-if)# do show ip dhcp snooping Switch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 1 DHCP snooping is operational on following VLANs: 1 The first command enables snooping, the second activates it on VLAN 1, and the interface command trusts the server-facing port. Use show ip dhcp snooping to distinguish configured from operational VLANs. section 13.2 section 13.2.1

Figure 13.2 Configuring DHCP Snooping on Cisco switches. Ports leading toward the DHCP Server are trusted, and ports leading toward users are untrusted. Only SW1’s configurations are shown, but the same commands should be configured on SW2.

Use the topology figure to identify which switch ports lead toward the DHCP server and should be trusted, versus which lead toward users and should remain untrusted. section 13.2

Inspect learned clients with show ip dhcp snooping binding. The table maps MAC addresses to leased IP addresses, lease times, VLANs, and interfaces. Dynamic ARP Inspection uses this table to inspect ARP traffic, linking the two security features. section 13.2.1 section 14.2

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Explains activation, trust assignment, message filtering, MAC validation, bindings, and verification, while limiting detail on less-common DHCP message types.

Examples

Uses Cisco IOS commands, verification output, trusted-port topology, DHCP message categories, and a sample binding table.

What it assumes

Assumes familiarity with DHCP DORA while distinguishing client and server messages and reviewing additional message types.

What you can do after

Operate and verify DHCP snooping on Cisco IOS switches across selected VLANs and trusted interfaces.

How it connects

Connects DHCP snooping with DHCP, DHCP poisoning, DHCP exhaustion, Port Security, Dynamic ARP Inspection, and man-in-the-middle attacks.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

• DHCP snooping binding tableproduces · A DHCP snooping binding table is a switch-maintained table mapping leased IP addresses to client MAC addresses, VLANs, interfaces, and lease information.
• untrusted portuses · An untrusted port is a switch port whose received ARP messages are inspected by Dynamic ARP Inspection before forwarding or discard.
• DHCP-based attackaddresses · A DHCP-based attack is a network attack that exploits vulnerabilities in the Dynamic Host Configuration Protocol or its handling.
• ip dhcp snoopingconfigured by · ip dhcp snooping is a Cisco IOS global configuration command that enables DHCP snooping on a switch.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.