- [Instructor] DHCP snooping is a method to prevent
rogue DHCP servers on a network.
A rogue is any unauthorized DHCP server on a network,
either accidentally, or one with malicious intent.
When snooping is enabled on a VLAN within a switch,
it will protect any ports configured for that VLAN
that are not designated as trusted ports.
An untrusted port is going to be one
facing end users, which is the default state,
while a trusted port is going to be
either the port that connects directly to the DHCP server
or an uplink to another switch or router
that terminates the DHCP server.
In short, untrusted ports will discard any packets
that would normally be sourced from a DHCP server,
so only DHCP client requests will be allowed.
On trusted ports, either client or server packets
can be sent.
As an untrusted port goes through the DHCP process,
the switch will add the MAC address of the client,
its assigned IP, the interface it was learned on,
and the VLAN it is in to the DHCP snooping binding table.
This table isn't used by just DHCP snooping,
it's also used by other tools,
like the upcoming dynamic ARP inspection.
Examine this diagram.
Port 24 has the DHCP server and port 22 has
one of my clients.
VLAN 10 is already configured on the requisite ports,
so I'll jump right into the snooping configuration.
First, I like to set my trusted ports.
Config T, interface fa0/24.
IP DHCP.
Snooping.
Trust.
The trust is set up directly into the interface.
The two main global commands required are,
IP DHCP snooping, which enables snooping,
and IP DHCP snooping VLAN 10, which enables
it on VLAN 10.
Another key command is no IP DHCP
snooping information option.
That is required.
If a switch isn't performing DHCP relay,
then it is a required option when enabling DHCP snooping.
By default, a switch will attempt to use option 82,
and this command disables this behavior.
Now that it's enabled, I can review it with show
IP DHCP snooping.
This shows state, VLANs that have it enabled,
and interfaces that it affects.
Also notice that it shows insertion
of option 82 is disabled.
Another mitigation snooping can help with
is to limit the number of DHCP requests
that enter a user port.
Too many requests can exhaust a switch or DHCP server.
To add rate limiting to an untrusted interface,
I would use config T interface fa0/22,
then IP DHCP snooping limit rate 15.
The number 15 is the DHCP packets per second allowed,
with 15 being the Cisco recommended option
for untrusted ports.
While it is possible to protect trusted ports,
it's not recommended.
The show IP DHCP snooping command
will show the configured rate limits on interfaces.
DHCP snooping is great for enterprise networks,
guest networks, and even portions of ISP infrastructure.