Lab Objective:
The focus of this lab is to understand how to implement and verify Cisco IOS DHCP features and security, IP Source Guard and IEEE 802.1X port-based security.
Lab Topology:
The lab network topology is illustrated below:
|
IMPORTANT NOTE If you are using the www.howtonetwork.net racks, please begin each and every lab by shutting down all interfaces on all switches and then manually re-enabling only the interfaces that are illustrated in this topology. |
Task 1
Disable VTP on all switches. All switches should support the configuration, modification and deletion of VLANs.
Task 2
Configure VLAN 100 on switches ALS1 and DLS1 and then configure SVI 100 on switch DLS1. This SVI should be assigned the address 100.1.1.1/24.
Configure VLAN 200 on switches DLS1 and DLS2 and then configure SVI 200 on switch DLS1 and DLS2. Assign these interfaces the IP addresses 200.1.1.1/30 and 200.1.1.2/30, respectively.
Task 3
Configure the ports between DLS1 and ALS1 and between ALS1 and R1 as access ports in VLAN 100. Next, configure the ports between the DLS1 and DLS2 as access ports in VLAN 100. Verify that DLS1 and DLS2 can ping each other across VLAN 200.
Task 4
Configure Cisco IOS DHCP Server functionality on switch DLS2 as follows:
- Network/Mask: 100.1.1.0/24
- Excluded Addresses: 100.1.1.1 – 100.1.1.5
- Default Gateway: 100.1.1.1
- Domain Name: howtonetwork.net
- Lease Expiration: 8 hours
Task 5
Configure Cisco IOS DHCP Relay Agent on switch DLS1. This should point to switch DLS2, which will be providing DHCP services for the 100.1.1.0/24 network.
Ensure that the network is appropriately configured so that the DHCP server can assign addresses to hosts on the 100.1.1.0/24 network.
Task 6
Configure DHCP Snooping on switch DLS1. The port connected to the DHCP server should be trusted. All other port should be considered untrusted. Enable IP Source Guard for VLAN 100.
Task 7
Configure router R1 to receive addressing via DHCP. Verify that DHCP Snooping and IP Source Guard are functioning correctly using the appropriate commands.
Lab Validation
Task 1
| DLS1(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
| DLS2(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
| ALS1(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
| ALS2(config)#vtp mode transparent Setting device to VTP TRANSPARENT mode. |
Task 2
| DLS1(config)#vlan 100 DLS1(config-vlan)#exit DLS1(config)#vlan 200 DLS1(config-vlan)#exit DLS1(config)#interface vlan 100 DLS1(config-if)#ip address 100.1.1.1 255.255.255.0 DLS1(config-if)#exit DLS1(config)#interface vlan 200 DLS1(config-if)#ip address 200.1.1.1 255.255.255.252 DLS1(config-if)#exit |
| DLS2(config)#vlan 200 DLS2(config-vlan)#exit DLS2(config)#interface vlan 200 DLS2(config-if)#ip address 200.1.1.2 255.255.255.252 DLS2(config-if)#exit |
| ALS1(config)#vlan 100 ALS1(config-vlan)#exit |
Task 3
| DLS1(config)#interface fastethernet 0/7 DLS1(config-if)#switchport mode access DLS1(config-if)#switchport access vlan 100 DLS1(config-if)#exit DLS1(config)#interface fastethernet0/11 DLS1(config-if)#switchport mode access DLS1(config-if)#switchport access vlan 200 DLS1(config-if)#exit |
| DLS2(config)#interface fastethernet0/11 DLS2(config-if)#switchport mode access DLS2(config-if)#switchport access vlan 200 DLS2(config-if)#exit |
| ALS1(config)#interface fastethernet 0/1 ALS1(config-if)#switchport mode access ALS1(config-if)#switchport access vlan 100 ALS1(config-if)#exit ALS1(config)#interface fastethernet 0/7 ALS1(config-if)#switchport mode access ALS1(config-if)#switchport access vlan 100 ALS1(config-if)#exit |
Finally, verify your configuration by pinging between switches DLS1 and DLS2:
| DLS1#ping 200.1.1.2
Type escape sequence to abort. |
Task 4
| DLS2(config)#ip dhcp excluded-address 100.1.1.1 100.1.1.5 DLS2(config)#ip dhcp pool VLAN-100-POOL DLS2(dhcp-config)#network 100.1.1.0 255.255.255.0 DLS2(dhcp-config)#default-router 100.1.1.1 DLS2(dhcp-config)#domain-name howtonetwork.net DLS2(dhcp-config)#lease 0 8 0 DLS2(dhcp-config)#exit |
Task 5
The first part of this task is straightforward and is completed as follows:
| DLS1(config)#interface vlan 100 DLS1(config-if)#ip helper-address 200.1.1.2 DLS1(config-if)#exit |
To complete the second part of the question, you need to ensure that switch DLS2 has IP reachability to the 100.1.1.0/24 subnet. Use either static routes or dynamic protocols. In this example, a simple default route pointing to switch DLS1 is configured on switch DLS2:
| DLS2(config)#ip routing DLS2(config)#ip route 0.0.0.0 0.0.0.0 vlan 200 200.1.1.1 |
Additionally, you need to enable IP routing on switch DLS1 (if not enabled by default)
| DLS1(config)#ip routing |
Following this, verify connectivity using a simple ping:
| DLS2#ping 100.1.1.1
Type escape sequence to abort. |
Task 6
This task requires a little thought. DHCP Snooping is required on VLANs 100 and 200. The port connected to switch DLS2 should be trusted because this is connected to the DHCP sever. All other ports should be considered untrusted. This task is completed on switch DLS1 as follows:
| DLS1(config)#ip dhcp snooping DLS1(config)#ip dhcp snooping vlan 100 DLS1(config)#ip dhcp snooping vlan 200 DLS1(config)#interface fastethernet 0/11 DLS1(config-if)#ip dhcp snooping trust |
Verify DHCP Snooping configuration using the show ip dhcp snooping commands:
| DLS1#show ip dhcp snooping Switch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 100,200 DHCP snooping is operational on following VLANs: 100,200 DHCP snooping is configured on the following L3 Interfaces: Insertion of option 82 is enabled Interface Trusted Rate limit (pps) |
The second part of this task is to enable IP Source Guard. IOS IP Source Guard is a feature that restricts IP traffic on untrusted Layer 2 ports by filtering the traffic based on the DHCP snooping binding database or manually configured IP source bindings.
This feature is used to prevent IP spoofing attacks. Any traffic coming into the interface with a source IP address other than that assigned via DHCP or static configuration will be filtered out on the untrusted Layer 2 ports. This task is completed as follows:
| DLS1(config)#interface fastethernet 0/7 DLS1(config-if)#ip verify source DLS1(config-if)#exit |
Task 7
This task requires the router to be configured as DHCP client. This is completed as follows:
| R1(config)#interface fastethernet 0/0 R1(config-if)#ip address dhcp R1(config-if)#exit R1(config)# *Apr 10 01:33:28.183: %DHCP-6-ADDRESS_ASSIGN: Interface FastEthernet0/0 assigned DHCP address 100.1.1.6, mask 255.255.255.0, hostname R1 |
Following successful DHCP assignment, verify DHCP Snooping configuration using the show ip dhcp snooping commands on switch DLS1:
|
DLS1#show ip dhcp snooping binding MacAddress IpAddress Lease(sec) Type VLAN Interface —————— ————— ———- ————- —- ——————– 00:0F:23:5E:EC:80 100.1.1.6 28602 dhcp-snooping 100 FastEthernet0/7 Total number of bindings: 1 |
Finally, verify IP Source Guard using the show ip source binding commands on switch DLS1:
| DLS1#show ip source binding dhcp-snooping MacAddress IpAddress Lease(sec) Type VLAN Interface —————— ————— ———- ————- —- ——————– 00:0F:23:5E:EC:80 100.1.1.6 28421 dhcp-snooping 100 FastEthernet0/7 Total number of bindings: 1 |
Final Switch Configurations
DLS1
|
DLS1#term len 0 Current configuration : 4246 bytes DLS1# |
DLS2
|
DLS2#term len 0 Current configuration : 4287 bytes DLS2# |
ALS1
|
ALS1#term len 0 Current configuration : 993 bytes ALS1# |
Final Router Configurations
R1
|
R1#term len 0 Current configuration : 742 bytes R1# |