Stop a rogue DHCP server with snooping, then lock a port with sticky port security

Steps

1. Place R1, S1, PC1, PC2 and SRV1 (leave Laptop1 aside until step 8) and cable them as the Topology lists. Use the automatic connection type (the lightning-bolt cable) for every link, so Packet Tracer picks straight-through or cross-over for you. Configure R1 as the gateway and the legitimate DHCP server (lesson 7):

Router> enable
Router# configure terminal
Router(config)# hostname R1
R1(config)# interface GigabitEthernet0/0/0
R1(config-if)# ip address 192.168.23.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# ip dhcp excluded-address 192.168.23.1 192.168.23.10
R1(config)# ip dhcp pool STAFF
R1(dhcp-config)# network 192.168.23.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.23.1
R1(dhcp-config)# end

2. Put the access ports and the uplink in VLAN 10 on S1 (lesson 9):

Switch> enable
Switch# configure terminal
Switch(config)# hostname S1
S1(config)# vlan 10
S1(config-vlan)# name STAFF
S1(config-vlan)# exit
S1(config)# interface range FastEthernet0/1 - 3
S1(config-if-range)# switchport mode access
S1(config-if-range)# switchport access vlan 10
S1(config-if-range)# exit
S1(config)# interface GigabitEthernet0/1
S1(config-if)# switchport mode access
S1(config-if)# switchport access vlan 10
S1(config-if)# end

3. Plant the rogue. On SRV1, set a static address of 192.168.99.1 with mask 255.255.255.0 in Desktop > IP Configuration. In Services > DHCP, set the pool's Default Gateway to 192.168.99.1, Start IP Address to 192.168.99.100 and Subnet Mask to 255.255.255.0, click Save, and set the service On. Then set PC1 and PC2 to DHCP, and on each renew a few times:

C:\> ipconfig /release
C:\> ipconfig /renew
C:\> ipconfig

Two servers now answer every request, and which one wins varies. Renew until at least one PC shows a 192.168.99 address: that client now sends everything to a gateway that leads nowhere, and nothing on S1 stops it. 4. Turn on DHCP snooping, globally and for VLAN 10, but deliberately trust no port yet. The third command matters with an IOS DHCP server on the same VLAN: by default the switch inserts option 82 with a zero relay address, and R1 would drop those requests, so stop the switch inserting it:

S1# configure terminal
S1(config)# ip dhcp snooping
S1(config)# ip dhcp snooping vlan 10
S1(config)# no ip dhcp snooping information option

Renew on PC1. It gets no lease at all and falls back to a 169.254 address. Every port is untrusted once snooping is on, including the uplink, so R1's OFFER is dropped as well as the rogue's. 5. Fix it by trusting the uplink towards the real server, never an access port. Add a rate limit on the access ports while you are there:

S1(config)# interface GigabitEthernet0/1
S1(config-if)# ip dhcp snooping trust
S1(config-if)# exit
S1(config)# interface range FastEthernet0/1 - 3
S1(config-if-range)# ip dhcp snooping limit rate 10
S1(config-if-range)# end

Release and renew on PC1 and PC2 as often as you like: every lease now comes from 192.168.23.0/24. SRV1 still hears the requests, but its OFFER and ACK arrive on an untrusted port and are dropped. 6. Read what snooping learned:

S1# show ip dhcp snooping binding

One binding per PC: its MAC address, its 192.168.23 address, the lease time, VLAN 10 and its port. This is the table that dynamic ARP inspection would check against. 7. Secure PC1's port with sticky port security. The port is already a static access port, which port security requires:

S1# configure terminal
S1(config)# interface FastEthernet0/1
S1(config-if)# switchport port-security
S1(config-if)# switchport port-security maximum 1
S1(config-if)# switchport port-security mac-address sticky
S1(config-if)# switchport port-security violation shutdown
S1(config-if)# end

From PC1, C:\> ping 192.168.23.1 so it sends a frame, then S1# show port-security address lists PC1's MAC address as SecureSticky on Fa0/1. The sticky address is now a line in the running configuration. 8. Break it: delete PC1's cable, place Laptop1, cable its Fa0 to S1 Fa0/1, and set Laptop1 to DHCP so it sends a frame. The port's link light turns red. Read why:

S1# show port-security interface FastEthernet0/1
S1# show interfaces FastEthernet0/1

Port Status reads Secure-shutdown and the Security Violation Count is 1; the interface is down and err-disabled. A second MAC address arrived on a port that allows one, and shutdown is the default violation mode. 9. Recover the port: delete Laptop1's cable, cable PC1 back to Fa0/1, then bounce the port, because removing the unknown device is not enough on its own. Save, or the sticky address is lost at the next reload:

S1# configure terminal
S1(config)# interface FastEthernet0/1
S1(config-if)# shutdown
S1(config-if)# no shutdown
S1(config-if)# end
S1# copy running-config startup-config

From PC1, run ipconfig /renew, then ping 192.168.23.1 gets replies again.