CloudLabBox
Try the free demo

JNCIS-ENT lab 6 of 17

Port security and DHCP snooping

Lock down an access switch: stop a hub on a desk port from adding devices, keep known MAC addresses across reboots, build a DHCP snooping table, and use it to drop spoofed ARP replies and packets from statically addressed intruders.

Run this lab

It needs Standard: its 5 nodes are set to 11 vCPU and 13,312 MB in total.

In your workspace: Shared, then JNCIS-ENT JN0-352 guided labs, then 06 - Port security and DHCP snooping

Run it on Standard from £5 a day

The free demo can’t run it: it has 6 vCPU and 8 GB, and this lab’s nodes need 11 vCPU and 13,312 MB together. Every lab plan includes every guided lab.

Level
Advanced
Time
About 70 minutes
Nodes need
11 vCPU, 13,312 MB
Smallest plan
Standard

The scenario

An audit of the depot office found three problems on the access switch, ACCESS:

  1. Someone has put a hub on desk port 2, so two machines share one port: PC2 (a legitimate laptop that uses DHCP) and PC3 (an unknown machine with a hand-set address, 10.10.10.200).
  2. Nothing stops a device from spoofing ARP replies or another machine's IP address.
  3. Any machine could run its own DHCP server and hand out bad gateways.

DIST is the gateway (irb.10, 10.10.10.1) and the DHCP server for VLAN STAFF (pool 10.10.10.100 to 10.10.10.149). ACCESS's uplink ge-0/0/0 is a trunk to DIST.

What you’ll practise

  • Configure MAC limiting with a packet action and persistent MAC learning
  • Explain DHCP snooping, trusted and untrusted ports, and the binding table
  • Configure dynamic ARP inspection and IP source guard, and show what they drop
  • Explain what MACsec protects and where it is used

The tasks

  1. Today's behaviour
  2. MAC limiting
  3. Persistent MAC learning
  4. DHCP snooping
  5. Dynamic ARP inspection
  6. IP source guard
  7. MACsec

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of Port security and DHCP snooping5 nodes and 1 network, 5 links. Every link is listed as text below the diagram.DISTACCESSPC1PC2PC3Desk-2-Hubeth0eth0ge-0/0/0ge-0/0/0ge-0/0/2ge-0/0/1eth0
5 nodes and 1 network, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • DIST ge-0/0/0 to ACCESS ge-0/0/0
  • ACCESS ge-0/0/1 to PC1 eth0
  • ACCESS ge-0/0/2 to Desk-2-Hub (network)
  • PC2 eth0 to Desk-2-Hub (network)
  • PC3 eth0 to Desk-2-Hub (network)
Nodes in Port security and DHCP snooping, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
DISTJuniper vJunos-switchvjunosswitch-23.4R2-S2.14 vCPU, 5,120 MB
ACCESSJuniper vJunos-switchvjunosswitch-23.4R2-S2.14 vCPU, 5,120 MB
PC1VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC2VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB
PC3VPCS hostBuilt in to EVE-NGCounted as 1 vCPU, 1,024 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder JNCIS-ENT JN0-352 guided labs.

  3. Open 06 - Port security and DHCP snooping and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More JNCIS-ENT labs

All JNCIS-ENT labs

Related labs in other courses

CloudLabBox is independent of Juniper Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.