DHCP Snooping on Cisco Switches

DHCP protocol is widely used and have security issues as it was build long time ago before there was need for network security. Cisco have implemented several enhancements in IOS to (partially) protect and stop most of the DHCP attacks. Port Security, DHCP Snooping, IP Source Guard and Dynamic ARP Inspections are mostly used these days.

DHCP Snooping is a security feature which protect the network clients to receive IP settings from rogue DHCP servers. Ports can be classified into 2 types: trusted and untrusted. Ports which are connected to a authorized DHCP servers have to be configured as trusted. All the rest should be configured as untrusted (the default value). Trusted ports are bypassed from DHCP Snooping validation. DHCP Snooping feature can be enabled per Vlan.

Enabling this feature will create DHCP Snooping binding database  with support up to 8192 entries. In that database there are records for: IP address of the client, MAC Address of the client, DHCP lease time, Interface on which the client is connected and VLAN number (there are also checksums for each entry and one checksum for the file)

The switch is comparing Source MAC Address with DHCP CHADDR (Client Hardware Address). If those 2 addresses match, packet is forwarded. In other case, the packet is dropped.

The switch will drop the packet if:

1. Packet originated from DHCP server is received on untrusted port
2. The Source MAC Address is different then the CHADDR
3. The switch receive a DHCPRELEASE on interface for a MAC address which doesn't match the interface in the DHCP Snooping binding database
4. DHCP relay agent forwards a packet that includes option-82 information to an untrusted port. (this situation will be covered in another post, as I've experienced this in practice recently)

Example of DHCP Snooping configuration:

Switch(config)# ip dhcp snooping
Switch(config)ip dhcp snooping vlan 101-102,104,301,1000

Show commands:

show ip dhcp snooping

Switch#show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
101-102,104,301,1000
DHCP snooping is operational on following VLANs:
101-102,104,301,1000
DHCP snooping is configured on the following L3 Interfaces:

Insertion of option 82 is enabled
   circuit-id format: vlan-mod-port
    remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:

show ip dhcp snooping binding

Switch#show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:21:70:15:EA:8D   10.216.20.55     244958      dhcp-snooping   101   FastEthernet3/0/22
00:1C:23:4F:F3:DD   10.216.20.43     244166      dhcp-snooping   101   FastEthernet1/0/10
00:1C:23:4F:F3:10   10.216.20.37     246563      dhcp-snooping   101   FastEthernet4/0/16
00:1C:25:97:57:63   10.216.20.42     258392      dhcp-snooping   101   FastEthernet4/0/23
00:1C:23:4F:E6:E1   10.216.20.30     240567      dhcp-snooping   101   FastEthernet3/0/18
00:21:70:15:E9:14   10.216.20.26     152945      dhcp-snooping   101   FastEthernet3/0/2
00:1C:23:5A:F7:93   10.216.20.34     160704      dhcp-snooping   101   FastEthernet2/0/9
00:1C:23:4F:F6:4B   10.216.20.45     245043      dhcp-snooping   101   FastEthernet1/0/14
00:1C:23:4F:F4:24   10.216.20.48     97990       dhcp-snooping   101   FastEthernet3/0/12
00:1C:23:4F:F6:BF   10.216.20.36     244629      dhcp-snooping   101   FastEthernet1/0/21
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:24:E8:BC:FF:6E   10.216.20.54     252080      dhcp-snooping   101   FastEthernet2/0/12
00:22:68:13:55:A8   10.216.20.47     253335      dhcp-snooping   101   FastEthernet4/0/23
00:21:70:15:FC:F2   10.216.20.31     252408      dhcp-snooping   101   FastEthernet2/0/19
00:1E:C9:70:D4:F2   10.216.20.82     201709      dhcp-snooping   101   FastEthernet3/0/16
00:0F:1F:EA:23:04   10.216.20.69     226910      dhcp-snooping   101   FastEthernet4/0/14
00:21:70:15:F8:06   10.216.20.32     243896      dhcp-snooping   101   FastEthernet3/0/1
00:21:70:15:EA:0E   10.216.20.57     158323      dhcp-snooping   101   FastEthernet3/0/10
00:21:70:15:EB:78   10.216.20.41     248641      dhcp-snooping   101   FastEthernet2/0/21
00:21:70:16:00:9D   10.216.20.38     159319      dhcp-snooping   101   FastEthernet2/0/11
00:21:70:15:EB:15   10.216.20.59     247514      dhcp-snooping   101   FastEthernet2/0/18
00:1A:6B:D4:53:C5   10.216.20.52     248756      dhcp-snooping   101   FastEthernet4/0/23
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:1C:25:97:81:55   10.216.20.51     255468      dhcp-snooping   101   FastEthernet4/0/20
00:22:68:13:28:40   10.216.20.40     255690      dhcp-snooping   101   FastEthernet4/0/23
00:21:70:15:FC:C9   10.216.20.33     242025      dhcp-snooping   101   FastEthernet4/0/17
00:21:70:15:FF:E1   10.216.20.46     250732      dhcp-snooping   101   FastEthernet1/0/18
00:1C:23:5A:F7:EE   10.216.20.27     241494      dhcp-snooping   101   FastEthernet2/0/10
00:24:E8:D5:CF:9E   10.216.20.60     244181      dhcp-snooping   101   FastEthernet3/0/15
00:21:70:AF:C0:BF   10.216.20.53     243784      dhcp-snooping   101   FastEthernet4/0/19
00:21:70:B0:48:68   10.216.20.49     246445      dhcp-snooping   101   FastEthernet5/0/20
00:1C:23:4F:86:F4   10.216.20.44     242733      dhcp-snooping   101   FastEthernet1/0/15
00:1C:23:4F:F4:DB   10.216.20.35     239051      dhcp-snooping   101   FastEthernet2/0/2
00:21:70:15:FB:FF   10.216.20.87     243821      dhcp-snooping   101   FastEthernet3/0/6

show ip dhcp snooping statistics detail

Switch#show ip dhcp snooping statistics detail
Packets Processed by DHCP Snooping                    = 1823
Packets Dropped Because
   IDB not known                                       = 0
   Queue full                                          = 0
   Interface is in errdisabled                         = 0
   Rate limit exceeded                                 = 0
   Received on untrusted ports                         = 0
   Nonzero giaddr                                      = 0
   Source mac not equal to chaddr                      = 680
   Binding mismatch                                    = 0
   Insertion of opt82 fail                             = 0
   Interface Down                                      = 0
   Unknown output interface                            = 0
   Reply output port equal to input port               = 0
   Packet denied by platform                           = 0

And log messages when some PC are trying to use different MAC address then their hardware address:

Jan  6 09:55:47.405 UTC: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPDISCOVER, chaddr: 0021.6a31.a2ec, MAC sa: 001c.2597.802a
Jan  6 09:57:42.085 UTC: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPDISCOVER, chaddr: 0022.68e1.e669, MAC sa: 001c.2597.5763
Jan  6 10:01:29.406 UTC: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPDISCOVER, chaddr: 0021.6a31.a2ec, MAC sa: 001c.2597.802a
Jan  6 10:03:33.086 UTC: %DHCP_SNOOPING-5-DHCP_SNOOPING_MATCH_MAC_FAIL: DHCP_SNOOPING drop message because the chaddr doesn't match source mac, message type: DHCPDISCOVER, chaddr: 0022.68e1.e669, MAC sa: 001c.2597.5763

IPSec Source for the Written/Lab Exam

It is my 3rd time reading the IPSec chapter and each time I'm learning some new details. One day I'll go through whole book, although some of the chapters are bit outdated. The link to the book:

http://www.amazon.com/Security-Principles-Practices-Professional-Development/dp/1587050250

Also I had privilege to attend recorded session from 2008 Networkers named: "Advanced Topics in Encryption Standards and Protocols"

Both of them are highly recommended.

CCIE Security Written Exam, tracking my progress

I'm preparing for this exam, and I've decided to share a spreadsheet in which I'm tracking my progress and taking a note of the source that I'm using for the specific topic.

You can check my spreadsheet here:

http://spreadsheets.google.com/pub?key=tSdRewJTdEco1FVg2EgJznA&output=html

The plan is to take the exam in 30-45 days from now.

Recently I've read a good comments for this exams in IP Expert blog:

 http://blog.ipexpert.com/2009/11/30/ccie-security-written-overview/