CloudLabBox
Try the free demo

Aruba CX lab 15 of 16

DHCP snooping and port security with an ARP spoofing demo

Watch a rogue DHCP server hand out its own gateway, then stop it with DHCP snooping, trusted ports and a binding limit, lock a shared port with sticky port security, and see an ARP spoof that this virtual switch cannot block.

Run this lab

It needs Lite: its 5 nodes are set to 6 vCPU and 7,168 MB in total. That fits the free demo too.

In your workspace: Shared, then HPE Aruba Networking CX switching guided labs, then 15 - DHCP snooping and port security with an ARP spoofing demo

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 60 minutes
Nodes need
6 vCPU, 7,168 MB
Smallest plan
Lite

The scenario

A contractor at Northwind plugged a home router into a meeting-room socket, and half the floor got addresses from it, with the router as their gateway. A rogue DHCP server like this can read everything a client sends off the LAN. You're adding the layer 2 defences that stop it: DHCP snooping, limits on the shared port, and port security. You'll also see an attack this virtual switch can't stop, so you know what to look for on real hardware.

DeviceInterfaceAddress
acc1vlan 10 USERS10.10.10.1/24
srv1eth0 (acc1 1/1/3)10.10.10.5/24, the real DHCP server (pool .100 to .150, gateway .1)
PC1eth0 (acc1 1/1/1)DHCP, always gets 10.10.10.101. MAC 02:cb:00:00:15:01
PC2eth0 (desk switch to acc1 1/1/2)DHCP. MAC 02:cb:00:00:15:02
MAL1eth0 (desk switch to acc1 1/1/2)10.10.10.66/24. MAC 02:cb:00:00:15:66, the visitor's laptop

MAL1 has rogue-dhcp start and rogue-dhcp stop, and labarp, a small tool that sends forged ARP replies. Use them only on this isolated lab network. The PCs have renew-dhcp, which drops any old lease and asks for a new one.

What you’ll practise

  • Explain how a rogue DHCP server and ARP spoofing work
  • Enable DHCP snooping, trust the right port and read the binding table and statistics
  • Use an authorised server list and a per-port binding limit
  • Configure IPv4 source lockdown and explain what enforcing it would do
  • Configure port security with sticky learning, and handle a violation

The tasks

  1. Meet the rogue
  2. DHCP snooping
  3. Authorised servers and a binding limit
  4. ARP spoofing, and what the binding table is for
  5. Port security
  6. Shut the port on a violation

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of DHCP snooping and port security with an ARP spoofing demo5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.acc1srv1PC1PC2MAL1DESKeth0eth01/1/21/1/3eth01/1/1eth0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • acc1 1/1/1 to PC1 eth0
  • acc1 1/1/2 to DESK (network)
  • PC2 eth0 to DESK (network)
  • MAL1 eth0 to DESK (network)
  • acc1 1/1/3 to srv1 eth0
Nodes in DHCP snooping and port security with an ARP spoofing demo, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
acc1Aruba AOS-CX virtual switcharubacx-10.142 vCPU, 3,072 MB
srv1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
PC2EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB
MAL1EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder HPE Aruba Networking CX switching guided labs.

  3. Open 15 - DHCP snooping and port security with an ARP spoofing demo and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Aruba CX labs

All Aruba CX labs

Related labs in other courses

CloudLabBox is independent of Hewlett Packard Enterprise. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.