Cisco DHCP Snooping Configuration – What is DHCP Snooping?

Nowadays enterprises should deploy any available defenses they have available in order to eliminate, or at least minimize, possible attacks in their networks.

Security controls should start from the network itself and span the whole IT infrastructure up to the application level.

In this article I will describe a simple and effective security protection which is already available on all Cisco switches. This is DHCP snooping.

This feature can be enabled and configured on Cisco switches with a few commands and protects your network from attackers who might try to connect a rogue DHCP server to your network in order to assign fake IP addresses and DNS servers to your users.

In this article we will see how this attack works and how to configure DHCP Snooping on Cisco switches to block such attacks.

What is DHCP Snooping

Have a look at the following example network below. We have two Layer 2 Access Switches (SW1, SW2), a core switch (SW3) and a DHCP Server which is the official server installed by the administrator in order to provide IP addresses and other network settings to users (DNS, default gateway etc).

Let’s start first by describing the attack.

An attacker (bottom left in the diagram) connects a Rogue DHCP Server in the same VLAN 10 as the rest of the users. A user’s computer (“Victim” as shown on the top left) is configured to receive network settings from DHCP, thus the computer will send a “DHCP Discover” packet in the network as shown below:

Normally, the “Legitimate DHCP Server” on the right will respond to the request (with a “DHCP Offer” packet) and assign the correct network settings (IP, DNS, Gateway etc) to the client.

However, the Rogue DHCP Server of the attacker will also respond with a “DHCP Offer”. This will create a “race condition” and if the Rogue DHCP Server is a little faster, it will assign fake settings to the user before the legitimate server.

This means that the attacker can assign a fake default gateway and DNS server to the user which will be controlled by the attacker. From there on, the attacker can act as “man in the middle” or send the user to fake websites etc.  

With DHCP snooping enabled, the switch will listen for DHCP traffic in the network and will allow only “DHCP Offers” coming from trusted sources. Therefore, the DHCP Offer from the fake Rogue server will be blocked by the switch as shown below:

When DHCP Snooping is enabled on all the switches, by default all “DHCP Offer” packets will be blocked unless the switch is explicitly configured to “trust” certain ports which are facing the legitimate DHCP server.

Therefore, only interfaces configured as “trusted” will be allowed to forward “DHCP Offer” packets thus rogue packets will be blocked.

In our example above, the interfaces Ge0/1 of both SW1 and SW2 and also the interface Fe0/1 of SW3 will be configured to trust the “DHCP Offer” packets because these are coming from the Legitimate DHCP server.

How to Configure DHCP Snooping on Cisco Switches

Let’s now see a step-by-step configuration of this feature in our example topology shown above.

The general steps include:

• Enable DHCP Snooping globally on every switch.
• Enable the snooping feature on the specific VLAN you want to protect (e.g VLAN 10 in our example above).
• For better compatibility, disable the insertion of DHCP option 82 from the switch.
• Go to all switches and find the interfaces facing the legitimate DHCP server. These interfaces will receive legitimate DHCP Offer packets and must be configured as “trusted”. All other interfaces by default will block any DHCP Offer packets.
• Optional: You can place a limit on DHCP client requests (packets per second) so that to avoid an attacker from sending too many DHCP requests and thus deplete the resources of the server.

Let’s start with the configuration:

Step 1: Enable DHCP Snooping Globally

SW1(config)#ip dhcp snooping

SW2(config)#ip dhcp snooping

SW3(config)#ip dhcp snooping

Step 2: Enable DHCP Snooping on VLAN 10

SW1(config)#ip dhcp snooping vlan 10

SW2(config)#ip dhcp snooping vlan 10

SW3(config)#ip dhcp snooping vlan 10

Step 3: Disable the insertion of option 82 in the DHCP packets

SW1(config)#no ip dhcp snooping information option

SW2(config)#no ip dhcp snooping information option

SW3(config)#no ip dhcp snooping information option

NOTE: The above configuration will disable the switch from inserting option 82 in the DHCP packets. This will offer better compatibility with DHCP servers because some servers drop packets with option 82.

Step 4: Configure the trusted interfaces on switches (the ones facing the Legitimate DHCP Server)

SW1(config)# interface GigabitEthernet0/1
SW1(config-if)# ip dhcp snooping trust

SW2(config)# interface GigabitEthernet0/1
SW2(config-if)# ip dhcp snooping trust

SW3(config)# interface FastEthernet0/1
SW3(config-if)# ip dhcp snooping trust

Step 5 (Optional): Configure rate limit on DHCP requests from clients

SW1(config)# interface FastEthernet0/1
SW1(config-if)# ip dhcp snooping limit rate 20

SW2(config)# interface FastEthernet0/1
SW2(config-if)# ip dhcp snooping limit rate 20

Step 6: Verification

SW1#show ip dhcp snooping

Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10
Insertion of option 82 is disabled
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled

Interface                  Trusted    Rate limit (pps)

———————–    ——-    —————-

GigabitEthernet0/1         yes        unlimited      

FastEthernet0/1            no             20

SW2#show ip dhcp snooping

Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10
Insertion of option 82 is disabled
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled

Interface                  Trusted    Rate limit (pps)

———————–    ——-    —————-

GigabitEthernet0/1         yes        unlimited      

FastEthernet0/1            no         20        

SW3#show ip dhcp snooping

Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10
Insertion of option 82 is disabled
   circuit-id default format: vlan-mod-port
   remote-id: 0001.9641.6CBE (MAC)
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:

Interface                  Trusted    Allow option    Rate limit (pps)

———————–    ——-    ————    —————-

FastEthernet0/1            yes        yes             unlimited      

All Configurations

Switch 1

SW1#show run

hostname SW1
!
ip dhcp snooping vlan 10
no ip dhcp snooping information option
ip dhcp snooping
!
interface FastEthernet0/1
 switchport access vlan 10
 ip dhcp snooping limit rate 20
 switchport mode access
!
[output omitted] !
interface GigabitEthernet0/1
 ip dhcp snooping trust
 switchport mode trunk
!

Switch 2

SW2#show run
hostname SW2
!
ip dhcp snooping vlan 10
no ip dhcp snooping information option
ip dhcp snooping
!
spanning-tree mode pvst
spanning-tree extend system-id
!
interface FastEthernet0/1
 switchport access vlan 10
 ip dhcp snooping limit rate 20
 switchport mode access
!
[output omitted] !
interface GigabitEthernet0/1
 ip dhcp snooping trust
 switchport mode trunk
!

Switch 3

SW3# show run
!
ip dhcp snooping vlan 10
no ip dhcp snooping information option
ip dhcp snooping
!
interface FastEthernet0/1
 ip dhcp snooping trust
 switchport access vlan 10
 switchport mode access

interface GigabitEthernet0/1
 switchport trunk encapsulation dot1q
 switchport mode trunk
!
interface GigabitEthernet0/2
 switchport trunk encapsulation dot1q
 switchport mode trunk