Cisco Certified Network Associate day 41 welcome back everyone I'm Imran Rafai
your trainer for this entire series today we're gonna look at two important
topics that will be DHCP snooping and default native VLAN without wasting much
time let's get straight into today's class and like always before we move
ahead please click on the subscribe button and click on that Bell icon to be
notified when we add a new video also please don't forget to hit on that like
button which would make us very very happy do you want to improve your memory
then click on that button on the top right hand corner now to visit our other
channel where our first video is how to improve your memory and I recommend you
to subscribe to that channel because that is a channel where we will be
having a lot of self-improvement videos so go subscribe to that channel right
away and like the video our social media contacts on the left you will find
networkingconsultant, networkingInc, networkingInc for Facebook, YouTube and
Twitter. On the right my personal social media contacts. If you want my email
that's imran.rafai (at) nwking.org. So what are we going to look at
today? Today we would be continuing from one point seven that we did last time we
looked at one point seven eight not 2.1 x which is one of the thread on access
layer right like you know one point seven talks about three access layer
threads and how to mitigate that so we discussed we ignore 2.1 x last video we
would be dealing with each snooping and non-default native VLAN in this video so
before we talk about DHCP snooping we need to revisit some of the topics that
we did in our whole video so we we discussed about DHCP so I would request
all of you to go back I think it was days six and then also day 24 I believe
where we had discussed about HD so day 6 is important when we discussed about
DHCP assignment of IP addresses that the
messages that they exchanged in like the doora process so what's that video if
you don't remember that watch these six and come back here so in
a typical scenario an end user comes to the network so when it gets connected to
the network it sends a Discoverer message so it's a broadcast message that
sends on to the network a discover message it's a broadcast everybody in
the network listens to that right so typically what would do is once it
reaches if there is a DHCP server in the network it would respond but if there's
no DHCP server if there's a DHCP relay in this case this router acts as a relay
so this router will forward that to the DHCP server DHCP server would then send
an offer with an IP address then this device would communicate with that
server and then that server would finally assign acknowledge that they
have accepted that IP address right so this is the normal process how it would
be so if this drill DHCP server assigns an IP address it would have an IP
address in that range let's say 192 168 10.10 right and it would have the
Gateway 2.1 right this would be the ideal gateway because this is exit point
for this network and then they can access the internet or other networks
through this device right that's the normal way what should be happening but
let's assume in the network there is a rogue attacker who is actually installed
a DHCP server on their computer so when an end-user comes in like last time and
since that broadcast message of course the relay agent would forward that to
the DHCP server but this DHCP server the rogue DHCP server which is already in
the network would listen to that broadcast and send an offer right so a
DHCP discover the DHCP offer would come from here and because he's already
received an offer the end-user would accept it right it would say ok I accept
it so it will request for that IP address and then
so the the doora process D o r ay D discount message o is offer message R is
request message is acknowledgment right so this would happen here and this end
you'll end user device would get an IP address so what an attacker would do is
he will give him genuine IP address so it will be like 192 168 10.2 which is
part of this network but if you see the Gateway would be dot 95 which is nothing
but this device's IP address so what it would do
let me just raise the board what it would do is all traffic henceforth from
the end user going to the internet would first come here because according to the
IP address given he is the gateway so he would send all
traffic to the Gateway and the attack is PC what it would do in turn is take the
traffic and send it to the real gateway and for the end user
there is no difference because he can access the engine and so they're trying
to reach the internet they can reach the internet but only problem is the traffic
is going through an intermediate device so return traffic would also come like
that and go to this device and then it would go here right this is called
man-in-the-middle attack right because every traffic that is going through the
network for this computer is going through the attackers computer and he
can actually read everything right so this is man-in-the-middle attack so this
is one of the attacks that can happen on a dhcp network right the second type of
attack that happens is called denial of service attacks so in this case what
happens is the DHCP server now he's not a server so he's an attacker what he
would do is he would send a discover packet right so the trill DHCP server
because he gets a discover message he would send an offer right so he would
accept it so he requests for that IP address and then he would send an ACK
right so this he does once after maybe about 2 minutes he would gain requested
2 3 so continuously keep asking for new IP
address now in typical world in DHCP when it leases
an IP address when an administrator configure you configure a pool right and
a pool typically you will have hundred IP address 200 IP address depending on
how we look on all the administrators configured you would have hundred 200 IP
addresses so attacker what they would do by doing a denial of service attack is
it keep requesting for an IP address so every time they lease an IP address then
IP address is valid for one day typically it's one day but you could
change that lease time so one day that's right for us so they would lease IP
address without 1.2.3.4 and it would exhaust that pool so once the pool is
exhausted he wouldn't have another IP address to give to a new client so if
there's another genuine user comes in they will not have this serf will not
have a free IP address it would assume that all the IP addresses given are
leased and that lease expiry is 20 fastly right so this is a way of doing
denial of service attack where they would exhaust or they would starve the
DHCP server of any usable IP address so these are the problems with DHCP now how
do we get out of this how do we mitigate this attack or these types of attacks we
use a concept called DHCP snooping so what is the HCP snooping DHCP snooping
for our practical purpose is like an ACL right the only thing is DHCP snooping is
a layer 2 function right so it works only on a switch to understand this if
stopping when you transcend two types of ports one is called a trusted port and
another is called as an untrusted port so what's the difference between trusted
port and untrusted put on a trusted port every type of DHCP message would be let
through write whatever message DHCP message would be let through because
it's trusted put on an untrusted port we will not write DHCP snooping
will not let any messages that is not supposed to come from end-users right so
basically if you remember the Dora process in Dora process D is from the
client all is from the server right so D goes from client to server or which is
offer comes from server to client then R goes from client to server it comes from
server to client right so from untrusted ports these messages D and R would be
accepted but if there is a Oh offer or acknowledge coming from untrusted board
that will get blocked if they will not send rule right so basically trusted
untrusted that's what it does when you enable DHCP snooping by default all the
ports of the switch is untrusted right it goes into on trestles minute
you can enable DHCP snooping either globally on all the ports or you can go
enable DHCP snooping wire wheel and right so if there are five ports in that
veil and like ten and if you enable DHCP snooping for wheel and then those ten
ports would be untrusted so you the DC snooping only is going to work on those
five or ten poles whatever ports are there part of the VLAN right now like I
said the minute you enable DHCP snooping all the ports are untrusted now as I
administrative what you would do is you would go and configure all the ports
that's connected to devices like a server right a server not DHCP any type
of server you would make that port as trusted or maybe if it's connected to
another switch that is also a trusted put or if it's connected to a router
that is also a trusted port right any port is connected to an end-user right
any induced device that has to be untrusted if it's connected a wireless
access point that all turns to be an untrusted port because wireless access
point in turn is connected to end-user devices right so anything coming
from an end-user device has to be undressed 'add so if it's an end user
device obviously even if let's say for instance now this guy is an attacker
right now if he is trying to send any server messages like an offer pack of a
message or an acknowledgement message this will get blocked right that type of
traffic will not go through a DHCP snooping untrusted border right this is
how DHCP snooping prevents DHCP attacks that we looked at earlier right also
also these if you snooping would keep a binding table a binding table is
whenever DHCP server assigns an IP address it is going to look at the MAC
address and IP address right so we spoke about denial of service attack right so
we know that certain MAC address ask for an IP address and that was a sign now
the same device say MAC address device ask for an IP address again it would
know that this is an abnormality because this MAC address just recently asked for
an IP address and an IP address was assigned why is it asking for another IP
address right that is a typical problem where attacker is trying to get more
than one it's trying to a denial of service attack so that will immediately
be prevented so that traffic that request would prevent it also it knows
which port number has which IP address because it's keeping this binding table
so this binding table also makes helps them make a decision of what MAC address
is using what IP address right so this is how DHCP snooping prevents DHCP
attacks that we discussed the next thing we're going to talk about is non default
native VLAN now VLAN is a topic that we discuss many many times that we
dedicated for videos for wheel and so if you do if you still have confusion about
VLANs I would request you to go back and watch those videos I think it is 11 2011
date well day 13 and day 34 or 24 I don't know but go go back and watch
videos now what people talk about today is non-default native village now we
know what native VLAN is right and default native VLAN by default native
VLAN in a Cisco switch is VLAN one right bill on one is the native VLAN that's
default native VLAN now there is a type of a tie called as a VLAN hopping attack
now if you if you know how switches tag packets if the let's say for instance
this is VLAN 1 right and and now the default native VLAN is 1 right so this
is the VLAN 1 and this is VLAN 10 right now typically when traffic comes from
here right this switch who knows that this port is
part of VLAN 1 right so when when this traffic goes out onto a trunk the switch
looks at that traffic and says okay or a wheel and one traffic that's my native
VLAN so I'm not going to tag you so it will go untag that traffic will go
untaek to switch to right this is which - and this is which one right I'm gonna
put this now when this switch - receives that packet is says ok you are coming on
tag that means you are VLAN 1 which is money - villain and hence you can't go
into VLAN 10 traffic right so I can't I can't send that traffic to this computer
right that's that's how it should be that's that's the way it has to be there
right so we LAN 1 traffic should not be able to go to VLAN 10 right now let's
assume the same thing what there's this is an attacker now now what an attacker
does is he creates a packet with a wheel and tag of VLAN 10 now we this is VLAN
10 like we discussed earlier and VLAN 10 and this is VLAN 1 right now this
attacker creates a frame with a wheel and 10 tag on at right so this is a
frame and then there is a VLAN 10 tag on it right and he sends that on to the
switch now which gets that traffic maybe if you
know how we land works when it comes into the switch the switch doesn't do
anything to the the frame whatever frame it receives it doesn't touch anything it
touches only at the trunk when it's non non default native VLAN traffic it tags
it so if at all it is the default native VLAN tag it doesn't tag anything just
sense that the same traffic out on to switch to now when switch to receives
that this frame has a tag in it right switch one did not do this tag this tag
was done by the attacker so switch to does not know that switch to sees that
there is a tag and the tag is VLAN 10 so it takes a traffic and it sends here to
this computer right that traffic goes through because what just happened is we
did a wheel and hopping net act this is something that should not happen how do
we mitigate this first thing is create a random VLAN right just a random VLAN
nine nine nine six six six seven seven seven whatever you want create a random
VLAN and that VLAN should not be used at all it's just a dummy VLAN we keep so
that we don't become a victim to VLAN hopping attacks so just create a random
VLANs don't assign any ports to that VLAN and go to each of these trunks
right and change the native VLAN to that if let's say for instance 666 change the
native VLAN to six six six on both sides if you don't change on both side you
will have a CDP VLAN a native VLAN mismatch error right so go to both side
of the trunk and all the trunks and make the native VLAN as six six six and make
sure that you don't assign any ports to this VLAN so it will be a dead VLAN so
even if somebody wants to do a VLAN hopping attack it will not work because
the native VLAN is in and that is not part of any of the ports
in your switch right so this is how you mitigate a wheel and hopping attack and
that is why a non-default native VLAN should be assigned to your device thank
you so much for watching I will be back very very soon now if you look at the
exam topics you see that from the next video we were beginning in su the most
sought after part offer I see in the two series which is OSPF and EIGRP routing
so and from next videos we would be starting routing stay tuned guys we will
be back very very soon take care bye bye