So the PC is only getting IP addresses in the 10.1.1.0 range, and that is the range of addresses
on the Enterprise DHCP server.
The rogue DHP server is allocating IP addresses in the 10 one 100 range.
So again.
on both PC 1 and PC 2, we are only getting IP addresses in the 10.1.1.0 range.
Let's run simulation mode and see what happens, ipconfig slash renew
DHCP message is sent to the switch.
DHCP message from the server is sent to the client.
But notice DHCP messages from the rogue DHCP server, so this source IP address are going to be dropped.
There is no outbound PDU.
So going back.
Message from the rogue DHCP server is going to be dropped.
Messages from the Enterprise DHCP server are going to be forwarded.
So hence, the PC will get an IP address from the corporate DHCP server
and to make the point on the corporate DHCP server, I'll turn off the DHCP servers.
So what should happen now is.
The PCs won't get IP addresses because this server is not allocating IP addresses and DHCP messages
from the rogue server are blocked and there you go, DHCP request failed.
Do that in simulation mode.
DHCP message to the switch,
DHCP message from the rogue server is blocked, so again, DHCP message sent from the server is going
to be dropped.
The PC will not get an IP address
and we can see that here
but if I enable the DHCP servers on
the corporate server
run ipconfig slash renew again.
Notice the PC gets an IP address and can, for instance, ping PC 1.
PC 1 ipconfig slash renew can ping PC 2.
So there you go.
We've set up a basic DHCP snooping environment on a switch and we can see the output in the debugs.
Let's use some show commands now, so show IP DHCP snooping.
We can see that this port FastEthernet02 is trusted, show IP, DHCP snooping binding.
We can see our DHCP snooping bindings.
This IP address is allocated to this client, this IP address is allocated to this client.
So 10.1.1.1 has been allocated to a device with this Mac address on this port number in VLAN
1.
So on that PC,
ipconfig slash all shows us the Mac address of the PC, it's ending in 21a9 and that's what
we see here.
So that is the PCs Mac address.
So that is PC 2 this IP address was allocated to this client on fFastEthernet 01.
So on that client,
ipconfig slash all
this is the Mac address of PC 1, this is the IP address of PC 1, and that's what we see over here.
PC 1is connected to FastEthernet01, as we can see over here.
So that looks good.
Let's have a look at the database, we can see 20 attempts and 20 successful writes.
On PC 1, I'll use ipconfig slash renew again
and what you can see on the switch is output of the debug command and notice the writes have increased.
I'll clear the screen a bit do that again, ipconfig slash renew there's the output of the debug.
Look at the database
notice 22 successful writes show IP DHCP snooping once again, we've enabled DHCP snooping on the switch
for VLAN 1 the trusted
port is FastEthernet 02.
So there you go.
I've configured DHCP snooping on the switch.
We've verified using debugs.
We've verified using simulation mode in Packet Tracer.
So how did you do?
Were you able to complete the lab?
It's important that you understand DHCP snooping for the CCNA exam.