In this packet tracer lab, you need to configure DHCP snooping, you need to configure the switch
so that a DHP office and other DHP messages from the rogue DHP server are blocked.
You want to configure the switch to only trust this DHCP server and not the rogue DHCP server.
At the moment on the PCs.
When we use ipconfig, we can see the address that was allocated via DHCP and we can get another address
by using ipconfig/renew.
So that looks good.
But notice, once I've done that enough times, an IP address from a different subnet is allocated the
rogue DHCP server
is configured with the DHCP pool in the 10.1.1.100 range.
The Enterprise DHCP server
is configured with a pool in the range, 10.1.1.0.
So initially PC 2 received an IP address from the Enterprise DHCP server, but then received an IP
address from the rogue DHCP server.
On PC 1
IP config, this PC has received an IP address from the rogue DHCP server.
So when PCs, boot up and send to DHCP requests
they may receive an IP address from the rogue DHCP server instead of the Enterprise DHCP server, as an
example, when I enable simulation mode in Packet Tracer
and the PC sends a DHCP request message.
That's going to go to the switch as a broadcast.
The destination address of the frame is Fs, it's a broadcast address, destination IP address is broadcast.
There's no source IP address at the moment.
The source Mac addresses is this.
Which is the Mac address of the client notice ending in 2189.
That DHCP message is flooded by the switch
and the DHCP servers will both send messages to the client.
Here's a message from 10.1.1.200.
That is the enterprise server
but here
is a message from the rogue DHCP server.
It's also a DHCP message.
So messages from both the DHCP servers are being sent to the client
and both servers will allocate an IP address to the client, here's the IP address from the enterprise
server and here's a message from the rogue DHCP server.
So those messages will be sent to the client and eventually the client will receive an IP address.
The IP address that was offered by the Enterprise DHCP server is the IP address used by the client
but that may not hold true in every case.
In this example, notice the client has got an IP address from the rogue DHCP server.
So once again, you need to enable DHCP snooping on this switch so that the switch trusts the Enterprise
DHCP server and not the rogue DHCP server for verification use debug to view the results and prove that
DHCP packets are not allowed from the rogue DHCP server.
In other words, use simulation mode to prove that a DHCP offers and other messages from the DHCP rogue
server are blocked by the switch.
So can you configure DHCP snooping? Download the packet tracer file and see if you can complete
this lab yourself.
Otherwise, watch the next video where I complete the lab.