CloudLabBox
Try the free demo

CCNA lab 16 of 46

DHCP snooping and dynamic ARP inspection

A rogue DHCP server is handing out its own gateway and a laptop is about to poison everyone's ARP cache. Stop the first with DHCP snooping, fix the option 82 side effect, then use the snooping bindings for dynamic ARP inspection and watch a spoofed ARP get dropped.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 5,632 MB in total. That fits the free demo too.

In your workspace: Shared, then CCNA 200-301 guided labs, then 16 - DHCP snooping and dynamic ARP inspection

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Advanced
Time
About 60 minutes
Nodes need
6 vCPU, 5,632 MB
Smallest plan
Lite

The scenario

At Kingsmere Recruitment, staff complain that "the Internet is weird" in the mornings. Someone has connected a small router in the meeting room (ROGUE) whose DHCP server answers faster than the real one on R1 and hands out itself (10.16.10.66) as the default gateway: a perfect man-in-the-middle. And the hot-desk laptop (H1) belongs to a contractor who likes security tools. You'll harden the access switch S1 with DHCP snooping and dynamic ARP inspection.

DevicePort on S1Address
R1 (real DHCP server and gateway)Gi0/010.16.10.1/24, pool STAFF from .100
PC1, PC2Gi0/1, Gi0/2DHCP
ROGUE (unauthorised)Gi0/310.16.10.66, offers .200+ with gateway .66
H1 (contractor laptop)Gi1/0static 10.16.10.50/24, MAC 02:00:00:00:16:50

What you’ll practise

  • Explain rogue DHCP and ARP spoofing attacks
  • Configure DHCP snooping with trusted and untrusted ports and rate limits
  • Recognise and fix the option 82 problem with an IOS DHCP server
  • Read the DHCP snooping binding table
  • Configure dynamic ARP inspection, an ARP ACL for a static host and validation checks

The tasks

  1. See the rogue DHCP server win
  2. Turn on DHCP snooping
  3. Fix the option 82 side effect
  4. Read the binding table
  5. Prepare the static host
  6. Turn on dynamic ARP inspection
  7. Launch the attack and watch it fail

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of DHCP snooping and dynamic ARP inspection6 nodes, 5 links. Every link is listed as text below the diagram.R1ROGUES1PC1PC2H1Gi0/0Gi0/0Gi0/2eth0Gi1/0eth0Gi0/1eth0Gi0/3Gi0/0
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • R1 Gi0/0 to S1 Gi0/0
  • S1 Gi0/1 to PC1 eth0
  • S1 Gi0/2 to PC2 eth0
  • S1 Gi0/3 to ROGUE Gi0/0
  • S1 Gi1/0 to H1 eth0
Nodes in DHCP snooping and dynamic ARP inspection, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
R1Cisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
ROGUECisco IOSvvios-adventerprisek9-m.SPA.159-3.M61 vCPU, 1,024 MB
S1Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
H1Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder CCNA 200-301 guided labs.

  3. Open 16 - DHCP snooping and dynamic ARP inspection and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More CCNA labs

All CCNA labs

Related labs in other courses

CloudLabBox is independent of Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.