OK, so let's configure DHCP snooping before I do that once again.
On the clients or PCs, when I use the command IP config slash renew.
We can see that the PCs are getting IP addresses from the rogue DHCP server, in some cases they get
an IP address from the enterprise server, but in other cases they get an IP address from the rogue
DHCP server.
Here's PC 1
rouge DHCP server IP address has been allocated, typically it's the server that replies first, and here
you can see the PC got an IP address from the Enterprise DHCP server.
So in simulation mode, when I use the command IP config slash renew, we can see that the DHCP message is
sent to the switch is flooded to both servers.
A DHCP message is sent from the rogue server to the client, and the client receives this DHCP message
from the rogue server, we can see it's a broadcast from the rogue DHCP server.
IP addresses 10.1.100.201 on the rogue DHCP server.
We can see that that's the IP address of the rogue server.
My packet tracer simulation broke there, so let's do that again on PC 2 IP config slash renew
message is sent to the switch.
It's flooded out.
In this example, DHCP message from the enterprise server is sent to the PC, we can see that the source
IP address is 10.1 .1.200.
In the inbound PDU, we can see that as well.
Client sends a reply, but notice the
rouge server
is also sending
DHCP messages into the network.
So what we want to do is block DHCP offers and other DHCP server messages from the rogue DHCP server.
So let's configure the switch, here's the console.
Now, this is a bug in packet tracer, even though I change the font size of the CLI.
On 2960 switches the font remains small, so I'll have to zoom in on this video to make it clearer.
My apologies for that, but there's not much I can do about it.
It's a bug in packet
tracer, show ip interface brief,
we can see that interfaces FastEthernet 0,1 to 4 are currently up.
Show IP DHCP snooping at the moment DHCP snooping is disabled.
It's not configured on any VLANs at the moment and no interfaces are trusted.
So in global configuration mode, I'm simply going to type IP DHCP, snooping, and press enter.
So now show IP DHCP, snooping notice it's enabled.
We're told that it's not enabled for any VLANs, we'll need to configure that.
But let's see what happens at the moment on the PCs.
IPconfig slash renew on PC 2, does the PC get an IP address?
No, it doesn't.
Do that again, no IP address is received.
In simulation mode, in packet tracer, IP config slash renew
DHCP message is sent to the switch and notice it's simply dropped.
When I click on the message, Switch receives the frame, we've got an inbound PDU, but there's no
outbound PDU at all.
The PC is trying to get an IP address, but it's simply dropped.
We see other messages such as spanning tree
but notice when I run the simulation again, IP config slash renew.
DHCP message gets sent to the switch and is simply dropped by the switch.
So we've stopped PCs getting IP addresses from the rogue DHCP server, but we've effectively broken
the network at the moment.
Debug IP, DHCP snooping
and let's have a look at packets.
IP DHCP Snooping VLAN 1, in this case, the PCs are configured in VLAN 1, all ports are currently
in VLAN 1, so I'm gonna enable DHCP snooping on VLAN 1 and then on FastEthernet 02
I'm going to trust that port.
So we're going to trust messages from the enterprise server.
Again, I'm running the debug and notice at this point
we see the output of the debug, we received a packet on FastEthernet 04.
We can see that it was a broadcast, it's a DHCP request message.
We can see that a message was received on FastEthernet 02
and the switch is forwarding those messages.
So let's do that again.
IP config slash renew,
we've received a message on FastEthernet 04
but that's once again where PC 2 is, we can see it's a DHCP request, the DHCP reply has been sent back
out of FastEthernet04 after it was received on FastEthernet 02. So on FastEthernet 02
we received a message from source IP address 10.1.1.200 to a destination address of a broadcast,
IP address
to allocate it to the client is 10.1.1.1,
DHCP server IP address and default gateway information is shown here and on the client, we can see
that that's what was allocated to the client.
So that looks better
let's run the renew multiple times
and see if we receive any offers from the rogue DHCP server at the moment, we're not. In this lab the
Enterprise DHCP server has this IP address, 10.1.1.200
DHCP pool is 10.1.1.0.
So if our network is configured correctly, PCs should only get IP addresses in that range.
The rogue DHCP server has an IP address of 10.1.100.201.
It's offering IP addresses in the range 10.1.100.0.
What about PC 1?
It's also only receiving IP addresses in the 10.1.1.0 range, it's not receiving IP addresses
from the rogue DHCP server.