DHCP SNOOPING
Configuring DHCP Snooping
conf t
ip dhcp snooping
ip dhcp snooping vlan 1
for trusted port
================
conf t
int f0/1
ip dhcp snooping trust
for untrusted ports limit Rates
===================
conf t
int Range f0/2 - 24
ip dhcp snooping limit rate 5
Switch to Switch DHCP Snooping Config
DHCP Information Option 82 (Agent Information)
disable Agent Information Option 82
no ip dhcp snooping information option
if you use Cisco Router as a DHCP
Server
conf t
int f0/0
ip dhcp relay information trusted
to Trust Agent Information
Option 82
Switch Port Security
Configuring Port Security
Configure Sticky Port Security:
–Dynamically learn MAC addresses.
–Add to MAC table and running configuration.
Configure the Interface
Enable Port Security
Specify a maximum Enable “sticky” learning
ITE PC v4.0
Chapter 1 © 2007 Cisco Systems, Inc. All rights reserved. Cisco Public 5
Verify Port Security
Sh port-security
Sh port-security int f0/1
Sh run int f0/1
Sh port-security address
Sh errdisable recovery
Sh int status
Sh int f0/1 status
Sh int status err-disabled
ITE PC v4.0
Chapter 1 © 2007 Cisco Systems, Inc. All rights reserved. Cisco Public 6
Mitigating ARP Attacks
Configuring Dynamic ARP Inspection
conf t
ip arp inspection vlan 1
int G0/1
ip arp inspection trust Disable DAI for G0/1
Disable DAI for
DHCP Snooping Trusted Port
DHCP Server Port
Ports between Switches
Static IP Devices Ports
Manual Entry in Switch DAI Table
Add Manual Entry in Binding Table
• ip dhcp snooping binding {mac} vlan {#} {IP} interface f0/0
xxx ip source binding {mac} vlan {#} {IP} int f0/0
Show ip dhcp snooping binding
or Use ARP ACL (Access control list)
verify
• sh ip arp inspection
• sh ip arp inspection int
• sh arp access-list
• sh ip dhcp snooping
• sh ip dhcp snooping binding
• sh errdisable recovery
• sh int status
• sh int status err-disabled
• sh int G0/1 status
LOGINs
Set minimum password length
config authentication local using username and password
Hint:
Authentication on vty lines must be configured to use a username and password
combination. If the vty lines are configured to use only a password, the enhanced
login features are not enabled.
Login success & failure
Failures --Displays information related only to failed login attempts.
SSH
Step 1 and 2: SSH ssh -l tharwat [Link]
STP
Password
Switch Password Recovery Using Mode Button
• Step 1: Connect the console cable to the
switch and start your terminal
program(Putty).
• Step 2: Hold the MODE button (on the front
of the switch) while you power on the
switch.
• Step 3: At this point, the switch should
be in Rommon mode.
• Step 4: From Rommon mode, type: flash_init
• Step 5: From Rommon mode, type: load
helper
• Step 6: From Rommon mode, type: dir flash:
Switch Password Recovery Using Mode Button
• Step 7: From Rommon mode, type:
rename flash:[Link]
flash:[Link]
• Step 8: From Rommon mode, type: boot
• Step 9: From Enable mode, type:
rename flash:[Link]
flash:[Link]
• Step 10: From Enable mode, type: copy
flash:[Link] system:running-
config
• Step 11: Change all passwords
• Step 12: wr