DHCP Snooping Configuration

1. The Threat: Rogue DHCP Servers

Before we configure the solution, let's clearly understand the problem. In our last module, we touched upon DHCP spoofing. This occurs when an attacker connects a rogue DHCP server to the network. Unsuspecting clients might receive IP address leases from this malicious server instead of the legitimate one.

This enables two primary attacks:

1. Man-in-the-Middle (MITM) Attack: The rogue server provides a valid IP address but sets its own IP as the client's default gateway. All of the client's off-net traffic now flows through the attacker's machine, where it can be inspected or modified.
2. Denial of Service (DoS) Attack: An attacker can launch a DHCP starvation attack, sending thousands of DHCP requests with spoofed MAC addresses to exhaust the legitimate server's entire pool of available IP addresses. This prevents legitimate clients from getting an IP and accessing the network.

To see how these attacks work in practice, please watch the following video segment.

2. The Solution: DHCP Snooping Logic

DHCP snooping solves these problems by validating DHCP messages as they pass through the switch. The core concept is simple: it classifies every port on the switch into one of two categories:

• Untrusted Ports: These are ports connected to end-user devices (PCs, printers, etc.). This is the default state for all ports. The switch assumes these ports are not a legitimate source of DHCP server messages.
• Trusted Ports: These ports are explicitly configured to connect to legitimate DHCP servers or to other switches that form an uplink path toward a legitimate server.

Based on this classification, the switch applies a set of rules:

• DHCP server messages (like OFFER and ACK) are dropped if they arrive on an untrusted port. This immediately blocks a rogue server.
• All DHCP messages are allowed on trusted ports without inspection.
• DHCP client messages from untrusted ports are inspected for consistency.

The following video segment explains this logic in more detail and introduces a critical component: the DHCP snooping binding table.

3. Configuring DHCP Snooping

Now that you understand the "why" and "how," let's move to the practical configuration. Setting up DHCP snooping involves a few required steps and some important optional features.

Step 1: Enable DHCP Snooping

First, you must enable the feature globally and then specify which VLANs it should be active on.

! Enable DHCP snooping globally
Switch(config)# ip dhcp snooping

! Enable DHCP snooping for a specific VLAN or range of VLANs
Switch(config)# ip dhcp snooping vlan 10,20

Step 2: Configure Trusted Interfaces

By default, all ports are untrusted. You must manually define the interfaces that connect to your legitimate DHCP server(s) or the uplinks leading to them.

! Enter interface configuration mode
Switch(config)# interface GigabitEthernet0/1

! Mark the interface as trusted
Switch(config-if)# ip dhcp snooping trust

Step 3: Handle DHCP Option 82

DHCP snooping, by default, inserts extra information called "Option 82" into client DHCP requests. While useful in complex topologies with DHCP relay agents, it can cause problems in simpler networks, as many DHCP servers will drop requests containing this option if they don't expect it. In most Layer 2 access switch deployments, it's best to disable this feature.

! Disable the insertion of Option 82 information
Switch(config)# no ip dhcp snooping information option

Failure to do this is a very common reason why DHCP snooping configurations don't work as expected.

Step 4 (Optional): Mitigate DHCP Starvation Attacks

To defend against DHCP starvation attacks, you can limit the rate of DHCP packets an untrusted interface is allowed to accept. If the limit is exceeded, the port is placed in an err-disabled state.

! Apply a rate limit on an untrusted access port
Switch(config)# interface GigabitEthernet0/5
Switch(config-if)# ip dhcp snooping limit rate 15

! (Optional) Configure automatic recovery from an err-disabled state
Switch(config)# errdisable recovery cause dhcp-rate-limit
Switch(config)# errdisable recovery interval 30

A rate of around 15 packets per second is a reasonable starting point, as a normal DHCP exchange involves only a few packets.

For a detailed walkthrough of these commands and concepts, the following resource is highly recommended.

4. Lab Demonstration and Verification

To see these commands in action, the following lab video walks through a complete DHCP snooping configuration in a simulated environment.

Verification Commands

As shown in the lab, you can verify your configuration and monitor the status of DHCP snooping with these key commands:

• show ip dhcp snooping: Displays global configuration, which VLANs are being snooped, and which interfaces are trusted.
• show ip dhcp snooping binding: Shows the DHCP snooping binding table, which contains the MAC address, IP address, lease time, VLAN, and interface for each legitimate client.

Conclusion

You have now learned how to implement DHCP snooping, a critical security feature that defends against rogue DHCP servers and DHCP starvation attacks. By creating a firewall for DHCP traffic at Layer 2, you can ensure the integrity of IP address assignment on your network.

Key Takeaways:

• Purpose: DHCP snooping validates DHCP messages to prevent attacks from malicious or misconfigured DHCP servers.
• Core Logic: It operates by classifying ports as trusted (for legitimate servers/uplinks) or untrusted (for clients). The default is untrusted.
• Key Rules: It drops DHCP server messages from untrusted ports and inspects client messages.
• Configuration Steps:
  1. Enable globally with ip dhcp snooping.
  2. Enable for specific VLANs with ip dhcp snooping vlan <vlan-id>.
  3. Define trusted ports with ip dhcp snooping trust.
  4. Disable Option 82 with no ip dhcp snooping information option in most access-layer deployments.
• Security Hardening: Use ip dhcp snooping limit rate on untrusted ports to prevent DoS attacks.
• Verification: Use show ip dhcp snooping to check configuration and show ip dhcp snooping binding to view the lease database.

In our next lesson, we will build directly upon the foundation laid here. We'll explore Dynamic ARP Inspection (DAI), another security feature that uses the information stored in the DHCP snooping binding table to prevent ARP spoofing and man-in-the-middle attacks.