Konfigurasi DHCP SNOOPING Untuk Mencegah Serangan DHCP Starvation dan DHCP SPOOFING Cisco

Summary

In this video, the presenter demonstrates how to protect a DHCP server from attacks using DHCP Snooping. The two main types of DHCP attacks discussed are DHCP Spoofing, where a fake server provides IP addresses to clients, and DHCP Starvation, where a client makes excessive DHCP requests to overwhelm the server. The tutorial includes step-by-step configuration of the router and switch to prevent these attacks, including setting trusted and untrusted interfaces, and rate-limiting requests. The video concludes with a successful implementation of these security measures, ensuring clients only receive IPs from the legitimate server.

Takeaways

• 😀 DHCP Snooping is a mechanism to protect DHCP servers from attacks by filtering and limiting DHCP traffic.
• 😀 Two common DHCP attacks are DHCP Spoofing, where a rogue server assigns fake IPs, and DHCP Starvation, where a client exhausts the DHCP pool by making excessive requests.
• 😀 In the DHCP Spoofing attack, a rogue DHCP server impersonates a legitimate one and distributes IP addresses to clients, potentially leading to network issues.
• 😀 DHCP Starvation is similar to a Denial of Service (DoS) attack, where a client repeatedly requests DHCP IPs, consuming all available addresses and disrupting network access.
• 😀 To prevent these attacks, **DHCP Snooping** is configured to distinguish between trusted and untrusted interfaces on network switches.
• 😀 The legitimate DHCP server is assigned to a trusted interface on the switch, while interfaces connected to clients or rogue servers are set as untrusted.
• 😀 In the configuration process, the video demonstrates how to set up DHCP servers on two routers—one acting as the legitimate server and the other as the rogue one.
• 😀 **DHCP Snooping** also involves configuring rate-limiting on interfaces to mitigate DHCP Starvation attacks by blocking excessive DHCP requests.
• 😀 The switch can disable interfaces where unusual DHCP requests are detected, preventing further damage from DHCP Starvation attacks.
• 😀 Once DHCP Snooping is enabled and properly configured, only clients receiving IP addresses from the legitimate DHCP server will be able to connect, ensuring network security.

Q & A

What is DHCP Snooping?

DHCP Snooping is a security feature that helps protect a DHCP server from malicious attacks, such as DHCP Spoofing and DHCP Starvation, by monitoring and filtering DHCP messages between clients and servers.

What are the two main types of DHCP attacks discussed in the video?

The two main types of DHCP attacks discussed are DHCP Spoofing and DHCP Starvation.

How does a DHCP Spoofing attack work?

In a DHCP Spoofing attack, a malicious DHCP server impersonates a legitimate server, providing false IP addresses to clients, which can lead to network disruption or unauthorized access.

What is the risk of a DHCP Starvation attack?

In a DHCP Starvation attack, a client floods the DHCP server with excessive IP requests, depleting the pool of available IP addresses and potentially denying service to legitimate clients.

What is the role of the switch in preventing these attacks?

The switch plays a critical role in preventing DHCP attacks by enabling DHCP Snooping and marking certain interfaces as trusted or untrusted to filter DHCP traffic and block rogue servers or excessive requests.

How do you configure DHCP Snooping on a switch?

To configure DHCP Snooping on a switch, you first enable it globally, then designate trusted interfaces (such as the one connected to the legitimate DHCP server) using commands like 'ip dhcp snooping trust'.

What is the significance of the 'trusted' and 'untrusted' interfaces in DHCP Snooping?

The 'trusted' interface is the one that connects to a legitimate DHCP server, while 'untrusted' interfaces are typically where clients are connected. DHCP messages are only allowed from trusted interfaces.

How does the switch prevent a client from receiving IP addresses from a rogue DHCP server?

The switch prevents this by filtering DHCP messages from untrusted interfaces. Only messages from trusted interfaces are allowed to offer IP addresses, thus protecting clients from rogue DHCP servers.

What configuration is used to limit the rate of DHCP requests to prevent DHCP Starvation?

To prevent DHCP Starvation, you can configure a rate limit on the interface connected to the client generating excessive requests using the command 'ip dhcp snooping limit rate'. This limits the number of DHCP requests a client can send per second.

What happens if a client sends too many DHCP requests in a short period?

If a client sends too many DHCP requests, the switch will shut down the interface to prevent the attack, as it is considered abnormal behavior, similar to a denial-of-service attack.