3

It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis.

  1. If PCA (macA,ipA) was originally connected to port1 ( binding - macA,ipA,port1 ) and PCA was relocated to port2 with its original macA,ipA.

Will DAI take port into consideration when checking the binding in the database? Will DAI block PCA now, since it is on port2 - but PCA (macA, ipA still remain the same)?

  1. What's the point of having DAI when we can enable IP Source with port security?

====================

(Edited)

I have added a static binding using (e.g.)

"ip source binding xxx1.yyy1.zzz1 vlan4 192.168.1.1 interface gi1/0/1"

After which my host with the static ip (192.168.1.1) started to send traffic through since (DAI checked the DHCP binding database). (it is unable to send traffic before addin the static binding)

Once the traffic ping through, I move the connected port from gi1/0/1 to gi1/0/2 (since it is a static configuration), there is no dhcp involved and the static binding did not reflect the updated port (to gi1/0/2) and it still worked. ( I also done a arp -d on the host and ping to new host , so it will do an arp request )

q1) From the test above, can I conclude that DAI checks only IP/MAC combi but not the port ?

q2) I realize my static entry in ip source binding is not reflected in dhcp snoop binding table, so can I say that dhcp snoop binding table is a subset of the ip source binding table ? (since ip source binding contain static entry too) It also seems like the DAI references the source binding table (since my static entry works after adding it in), is there any difference between source binding and dhcp snoop table ?

q3) Lastly, I could not understand why when we activate ip source guard + port security, there is a need to turn on option82 in the switch ? Why would the adding of "port-security" require option 82 setting ? ?

  • Please don't edit questions to ask follow up questions, this is not the way SE sites work. If you have follow up questions, you should post them as separate questions. I will edit my answer accordingly this time, but please don't expect users to do so in this fashion. – YLearn Sep 26 '17 at 4:34
3

Will DAI take port into consideration when checking the binding in the database ?

Since you don't mention platform or code version, generally speaking, when a host moves from P1 to P2, the host will still process DHCP and the DHCP snooping binding table will update to reflect P2. So even if a particular implementation does check use the port there should be no problem.

What I can't answer though is if you go a step further and add a dumb switch between the host and the managed switch running DHCP snooping/DAI. If you move the connection from the dumb switch to the managed switch, this often won't trigger the host to process DHCP again (i.e. the host's network connection didn't go down/up). Haven't tried this personally so not sure what would happen, but my guess would be that the switch may update the port on the DHCP snooping binding table when it updates the MAC address table. If I get a chance to test this at some point with my Cisco gear I will come back to edit this.

whats the point of having DAI when we can enable IP Source with port security ?

IP source guard prevents IP traffic that doesn't match the DHCP snooping binding table (or static entries). So if the traffic has no IP headers, it won't prevent any of the traffic.

Port security works by matching the MAC address to restrict access. If the MAC address matches, then the traffic will be allowed.

ARP is sent at L2 (no IP headers), so a host (compromised or not) with a MAC address that allows it to match port security could still perform attacks on ARP (i.e. ARP spoofing, poisoning, etc). DAI provides protection in this gap.

From the test above, can I conclude that DAI checks only IP/MAC combi but not the port ?

From the test above, you can conlude that DAI checks only the IP/MAC combination but not the port for that particular platform and software version only. This does not guarantee that DAI will have the same behavior on a different platform or with a different version of code.

I realize my static entry in ip source binding is not reflected in dhcp snoop binding table, so can I say that dhcp snoop binding table is a subset of the ip source binding table ?

For Cisco devices, it would not be totally inaccurate to say that, but I wouldn't say it that way as the phrasing gives the wrong impression. When stated as you put it, it almost makes it sound as if some of the entries from the IP source binding table are used to generate the DHCP snooping binding table.

You can say that the DHCP snooping binding table is one of the sources used to generate the IP source binding table.

is there any difference between source binding and dhcp snoop table ?

As you noted, the IP source binding table also includes static entries.

Lastly, I could not understand why when we activate ip source guard + port security, there is a need to turn on option82 in the switch ? Why would the adding of "port-security" require option 82 setting ? ?

When you add the MAC address source filtering to IP source guard using the ip verify source port-security command, the client MAC address is not learned until it has obtained a DHCP lease. Until then, all non-IP traffic except for DHCP will also be blocked.

Since the switch won't learn the MAC address of the client until after it obtains a lease, this leads to a problem of how does the switch know where to send the return DHCP traffic from the server to the client? The information inserted by DHCP option 82 gives this information to the switch. However you do need to make sure your DHCP server then also supports option 82.

  • thanks for your reply - it make perfect sense! I have edited my post after making some tests - hope you can see the edited post above – Noob Sep 23 '17 at 2:42
  • much appreciated on the added response. thank you so much. Can i also say the workstation sending DHCP check (request i believe) after changing port (network connection going down/up) is also OS/version dependent ? – Noob Sep 26 '17 at 17:19
  • sorry for not seeing the reason behind, why is the mac address only added into the cam table after it successfully obtain a lease when ip source + port security is turn on ? but if only port-security is turn on, the mac address seem to be populated in the cam immediately – Noob Sep 26 '17 at 17:24
  • @Noob, port security will not add an unknown MAC address to the CAM table unless you allow the interface to do dynamic learning of MAC address (i.e. have a maximum value greater than the configured/sticky addresses). If you leave the default maximum entries at one and configure a MAC address on the port (for PC1), then connect a different device (PC2 for instance), you will not get the MAC address of PC2 in the table. When you tie port-security in with IP source guard, port security will not learn dynamic MAC addresses unless the station performs DHCP or has a static configuration. – YLearn Sep 26 '17 at 21:30
  • for "port security with dynamic learning alone", does the cam table get populated immediately upon receiving the 1st dhcp request ? Does the port security table also get populated upon receiving the 1st dhcp request as well ? If so , why does having ip source guard + port security requires dhcp lease to be successfully obtain before adding into the cam table ? – Noob Sep 27 '17 at 3:39
2
  1. What DAI does is to intercept and inspect all ARP request and reply packets on an untrusted port. If an ARP reply packet contains INVALID information/value (invalid IP_Address-to-MAC_Address, NOT invalid switch port), it will be dropped.

    Therefore, with only DAI feature enabled, you can move your host to different ports without facing any issue because it has valid IP_Address-to-MAC_Address binding.

  2. IP Source Guard makes use of DHCP snooping database and static IP source binding entries. Therefore, DHCP snooping database is "SMALLER" than IP source binding database (with dhcp-snooping and static type entries).

    I would not use the word subset as it is not quite safe for me to say so, even though it looks like that :).

  3. When you enable IP Source Guard with source IP-MAC filter mode, DHCP snooping Option 82 must be turned on.

    The DHCP host MAC address is not learned until the host is granted a lease, and DHCP snooping uses option-82 data to identify the host port when forwarding packets from the server to the host port. You can check this Cisco doc for further information.

  • thanks for your feedback. Any reason why when only "port-security" is setup, the mac address is immediately populated in the cam table, but why when ip source+port security is turn on, the mac address is only populated when it successfully obtain a lease ? – Noob Sep 26 '17 at 17:25
  • @Noob, see my comment above, but port-security will only add a MAC address immediately if you allow the interface to learn MAC addresses dynamically. Port-security does not insert invalid MAC addresses into the CAM table. – YLearn Sep 26 '17 at 21:33
  • @YLearn - thanks for you reply - if i have turn on "port-security with dynamic learning" alone, i believe it does insert into cam table as soon as it receive the 1st dhcp request ? if that is so, why the need to wait until a dhcp lease is obtained when "ip source guard with port security" is use ? – Noob Sep 27 '17 at 3:45
  • @Noob I think Ylearn helped to answer your question :) Let me know if you still have any concern, I am happy to help. – Hung Tran Sep 27 '17 at 7:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.