Examkin

Soru

Zorluk: ZorLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An enterprise network topology consists of Access-Switch-1 linked via trunk interface GigabitEthernet1/0/24 to Distribution-Switch-1, where the network DHCP server resides. DHCP Snooping is enabled globally and on VLAN 20 across both switches. End hosts connected to access ports on Access-Switch-1 fail to acquire dynamic IPv4 addresses. System logs on Distribution-Switch-1 indicate that incoming DHCP Discover packets arriving on interface GigabitEthernet1/0/24 are being dropped upon arrival. Which configuration oversight is the root cause of these packet drops?

  1. Interface GigabitEthernet1/0/24 on Distribution-Switch-1 remains untrusted for DHCP Snooping, causing it to drop incoming DHCP client requests that contain Option 82 information inserted by Access-Switch-1.Cevap
  2. B
    Access-Switch-1 failed to save its running configuration to startup configuration after learning host hardware addresses via port security sticky MAC commands.
  3. C
    An 802.1Q native VLAN mismatch exists between Access-Switch-1 and Distribution-Switch-1, which blocks untagged DHCP broadcast frames from traversing trunk interface GigabitEthernet1/0/24.
  4. D
    Dynamic ARP Inspection is dropping the DHCP Discover broadcasts on Distribution-Switch-1 due to an implicit deny clause in the switch ARP access list.

Cevap

Interface GigabitEthernet1/0/24 on Distribution-Switch-1 remains untrusted for DHCP Snooping, causing it to drop incoming DHCP client requests that contain Option 82 information inserted by Access-Switch-1.
When DHCP Snooping is active, access switches append DHCP Option 82 (Relay Agent Information) to client requests. If an upstream switch receives a DHCP packet containing Option 82 on a port that is still in the default untrusted state, the switch drops the packet because untrusted ports are not allowed to receive DHCP packets with relay information when giaddr is 0.0.0.0. Designating the trunk interface as trusted using 'ip dhcp snooping trust' resolves the drops.

Adım Adım Çözüm

1
Analyze DHCP Snooping default behaviors on Cisco Catalyst access switches.
When DHCP Snooping is enabled globally, Cisco switches automatically insert DHCP Option 82 relay agent information into client DHCP requests originating on untrusted access ports before forwarding them upstream.
Option 82 adds circuit ID and remote ID details to assist DHCP servers with address allocation and policy enforcement.
2
Evaluate the receiving switch interface trust state.
By default, all switch ports (including 802.1Q trunks) are untrusted for DHCP Snooping until explicitly configured with the 'ip dhcp snooping trust' command.
Untrusted ports drop incoming DHCP packets containing non-zero Option 82 data when the gateway address (giaddr) is 0.0.0.0 to prevent DHCP spoofing.
3
Identify the corrective action required on the inter-switch trunk link.
Configuring 'ip dhcp snooping trust' on interface GigabitEthernet1/0/24 of Distribution-Switch-1 allows DHCP requests with Option 82 to pass through to the central DHCP server.
Trunk links pointing toward legitimate network infrastructure and DHCP servers must be designated as trusted interfaces.

Anahtar Kavram

DHCP Snooping Option 82 untrusted interface validation rules
Bu soruyu puanla

Konular

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

Bu konudan daha fazla soru