9.4 DHCP Snooping Explained
Key Concepts of DHCP Snooping
DHCP Snooping is a security feature that protects against rogue DHCP servers and ensures that only trusted DHCP servers can provide IP addresses to clients. Key concepts include:
- DHCP Snooping: A mechanism to filter and monitor DHCP traffic.
- Trusted and Untrusted Ports: Ports designated as trusted or untrusted for DHCP traffic.
- DHCP Snooping Database: A database that stores DHCP bindings.
- Dynamic ARP Inspection (DAI): A feature that uses DHCP Snooping bindings to validate ARP packets.
- IP Source Guard: A feature that restricts IP traffic based on DHCP Snooping bindings.
DHCP Snooping
DHCP Snooping is a security feature that filters and monitors DHCP traffic to prevent unauthorized DHCP servers from providing IP addresses to clients. It ensures that only trusted DHCP servers can respond to DHCP requests.
Example: In a corporate network, DHCP Snooping can be enabled on a switch to ensure that only the authorized DHCP server in the network can provide IP addresses to clients. This prevents rogue DHCP servers from disrupting network operations.
Trusted and Untrusted Ports
Trusted ports are designated as safe for DHCP traffic, meaning that DHCP responses from these ports are allowed. Untrusted ports are monitored for DHCP traffic, and any DHCP responses from these ports are blocked unless they come from a trusted DHCP server.
Example: On a MikroTik switch, you can configure port 1 as a trusted port connected to the authorized DHCP server and all other ports as untrusted. This ensures that only DHCP responses from the authorized server are accepted.
DHCP Snooping Database
The DHCP Snooping database stores DHCP bindings, which are records of IP addresses assigned to clients and their corresponding MAC addresses. This database is used to validate DHCP traffic and ensure that only legitimate DHCP bindings are allowed.
Example: When a client receives an IP address from the DHCP server, the switch records this binding in the DHCP Snooping database. This binding is then used to validate future DHCP traffic and ensure that the client's IP address is legitimate.
Dynamic ARP Inspection (DAI)
Dynamic ARP Inspection (DAI) is a security feature that uses DHCP Snooping bindings to validate ARP packets. It ensures that only ARP packets with legitimate IP-to-MAC bindings are allowed, preventing ARP spoofing attacks.
Example: In a network with DHCP Snooping enabled, DAI can be configured to check ARP packets against the DHCP Snooping database. If an ARP packet contains an invalid IP-to-MAC binding, it is dropped, preventing ARP spoofing attacks.
IP Source Guard
IP Source Guard is a feature that restricts IP traffic based on DHCP Snooping bindings. It ensures that only IP traffic with legitimate source IP addresses is allowed, preventing IP spoofing attacks.
Example: On a MikroTik switch, IP Source Guard can be configured to allow only IP traffic from clients with legitimate DHCP bindings. This ensures that clients cannot send traffic with spoofed IP addresses, enhancing network security.