1
00:00:13,210 --> 00:00:21,310
So the PC is only getting IP addresses in the 10.1.1.0 range, and that is the range of addresses

2
00:00:21,310 --> 00:00:24,120
on the Enterprise DHCP server.

3
00:00:24,700 --> 00:00:30,070
The rogue DHP server is allocating IP addresses in the 10 one 100 range.

4
00:00:31,260 --> 00:00:32,009
So again.

5
00:00:33,420 --> 00:00:40,080
on both PC 1 and PC 2, we are only getting IP addresses in the 10.1.1.0 range.

6
00:00:41,390 --> 00:00:48,500
Let's run simulation mode and see what happens, ipconfig slash renew

7
00:00:50,430 --> 00:00:52,890
DHCP message is sent to the switch.

8
00:00:54,080 --> 00:00:59,360
DHCP message from the server is sent to the client.

9
00:01:01,670 --> 00:01:10,250
But notice DHCP messages from the rogue DHCP server, so this source IP address are going to be dropped.

10
00:01:10,370 --> 00:01:12,200
There is no outbound PDU.

11
00:01:12,800 --> 00:01:14,030
So going back.

12
00:01:15,240 --> 00:01:19,320
Message from the rogue DHCP server is going to be dropped.

13
00:01:22,180 --> 00:01:26,560
Messages from the Enterprise DHCP server are going to be forwarded.

14
00:01:29,010 --> 00:01:35,460
So hence, the PC will get an IP address from the corporate DHCP server

15
00:01:37,830 --> 00:01:44,760
and to make the point on the corporate DHCP server, I'll turn off the DHCP servers.

16
00:01:45,180 --> 00:01:47,610
So what should happen now is.

17
00:01:48,790 --> 00:01:57,370
The PCs won't get IP addresses because this server is not allocating IP addresses and DHCP messages

18
00:01:57,370 --> 00:02:02,560
from the rogue server are blocked and there you go, DHCP request failed.

19
00:02:03,580 --> 00:02:05,140
Do that in simulation mode.

20
00:02:07,530 --> 00:02:09,750
DHCP message to the switch, 

21
00:02:13,400 --> 00:02:21,470
DHCP message from the rogue server is blocked, so again, DHCP message sent from the server is going

22
00:02:21,470 --> 00:02:22,100
to be dropped.

23
00:02:22,700 --> 00:02:24,950
The PC will not get an IP address

24
00:02:26,640 --> 00:02:28,380
and we can see that here

25
00:02:29,520 --> 00:02:33,420
but if I enable the DHCP servers on

26
00:02:34,410 --> 00:02:35,880
the corporate server

27
00:02:38,040 --> 00:02:40,230
run ipconfig slash renew again.

28
00:02:41,420 --> 00:02:47,450
Notice the PC gets an IP address and can, for instance, ping PC 1.

29
00:02:49,180 --> 00:02:55,090
PC 1 ipconfig slash renew can ping PC 2.

30
00:02:56,300 --> 00:02:57,030
So there you go.

31
00:02:57,050 --> 00:03:05,900
We've set up a basic DHCP snooping environment on a switch and we can see the output in the debugs.

32
00:03:06,190 --> 00:03:11,060
Let's use some show commands now, so show IP DHCP snooping.

33
00:03:12,170 --> 00:03:22,430
We can see that this port FastEthernet02 is trusted, show IP, DHCP snooping binding.

34
00:03:23,090 --> 00:03:26,240
We can see our DHCP snooping bindings.

35
00:03:27,660 --> 00:03:33,030
This IP address is allocated to this client, this IP address is allocated to this client.

36
00:03:33,980 --> 00:03:42,530
So 10.1.1.1 has been allocated to a device with this Mac address on this port number in VLAN

37
00:03:42,530 --> 00:03:42,960
1.

38
00:03:43,460 --> 00:03:45,200
So on that PC, 

39
00:03:48,950 --> 00:03:59,990
ipconfig slash all shows us the Mac address of the PC, it's ending in 21a9 and that's what

40
00:03:59,990 --> 00:04:00,920
we see here.

41
00:04:00,930 --> 00:04:05,300
So that is the PCs Mac address.

42
00:04:05,730 --> 00:04:13,580
So that is PC 2 this IP address was allocated to this client on fFastEthernet 01.

43
00:04:14,150 --> 00:04:15,500
So on that client, 

44
00:04:17,690 --> 00:04:21,950
ipconfig slash all

45
00:04:23,310 --> 00:04:30,380
this is the Mac address of PC 1, this is the IP address of PC 1, and that's what we see over here.

46
00:04:30,810 --> 00:04:35,940
PC 1is connected to FastEthernet01, as we can see over here.

47
00:04:37,110 --> 00:04:38,200
So that looks good.

48
00:04:39,540 --> 00:04:46,080
Let's have a look at the database, we can see 20 attempts and 20 successful writes.

49
00:04:47,120 --> 00:04:52,730
On PC 1, I'll use ipconfig slash renew again

50
00:04:56,220 --> 00:05:02,250
and what you can see on the switch is output of the debug command and notice the writes have increased.

51
00:05:03,720 --> 00:05:10,080
I'll clear the screen a bit do that again, ipconfig slash renew there's the output of the debug.

52
00:05:11,310 --> 00:05:12,510
Look at the database

53
00:05:12,550 --> 00:05:23,880
notice 22 successful writes show IP DHCP snooping once again, we've enabled DHCP snooping on the switch

54
00:05:24,390 --> 00:05:26,980
for VLAN 1 the trusted

55
00:05:27,030 --> 00:05:29,200
port is FastEthernet 02.

56
00:05:29,970 --> 00:05:30,870
So there you go.

57
00:05:31,300 --> 00:05:34,980
I've configured DHCP snooping on the switch.

58
00:05:35,700 --> 00:05:37,790
We've verified using debugs.

59
00:05:37,800 --> 00:05:42,270
We've verified using simulation mode in Packet Tracer.

60
00:05:43,160 --> 00:05:44,210
So how did you do?

61
00:05:44,540 --> 00:05:46,530
Were you able to complete the lab?

62
00:05:47,030 --> 00:05:53,960
It's important that you understand DHCP snooping for the CCNA exam.