802.1X Authentication Using EAP

• Switches can use IEEE 802.1X to perform user authentication.
• User authentication requires the user to supply a username & password, verified by a RADIUS server, before the switch will enable the switch port for normal user traffic.
• IEEE 8802.1X defines some of the LAN user authentication, but it also uses the Extensible Authentication Protocol (EAP).
• EAP: an internet standard (RFC 3748), as the underlying protocol used for authentication.
• EAP also provides One-time passwords (OTPs).

IP Source Guard

• It add one more check to the DHCP snooping logic.
• When enabled along with DHCP snooping, IP Source Guard checks the source IP address of received packets against the DHCP snooping binding database.
• It checks both the source ip & source MAC address against that same database.
• If the entries do not match, the frame is filtered.
• ip verify source
• to check source ip address only
• ip verify source port-security
• check both the source ip & MAC address
• ip source binding mac-address vlan vlan-id ip-address interface interface-id
• Global command to create static entries that will be used in addition to the DHCP snooping binding database.
• 
  

DCHP Snooping Commands

Command	Purpose
ip dhcp snooping vlan vlan-range	Global command to enable DHCP snooping for one or more VLANs
[no] ip dhcp snooping trust	Interface command to enable or disable a trust level on an interface;
Ip dhcp snooping binding mac-addre vlan vlan-id ip-addre interface interface-id expiry seconds	Global command to add static entries to the DHCP snooping binding database
Ip dhcp snooping verify mac-address	Global command to add static entries to the DHCP snooping binding database
Ip dhcp snooping limit rate rate	Sets the maximum number of DHCP messages per second to mitigate DoS attack.

DHCP Snooping: Logical steps for Filtering

• It filters all messages sent exclusively by DHCP servers.
• The switch checks DHCP release & decline messages against the DHCP snooping binding table.
• if the IP address in those messages is not listed with the port in the DHCP snooping binding table, the messages are filtered.
• Optionally, it compares  a DHCP request's client hardware address value with the source MAC address inside the Ethernet frame.

The 1st one takes care of the fake DHCP server man-in-the-middle attack.

The 2nd one prevents an attacking host from releasing a legitimate host's DHCP lease, then attempting to request an address and be assigned the same ip address

DHCP Snooping

• DHCP snooping prevents the damage inflicted by several attacks that use DHCP.
• DHCP snooping causes a switch to examining DHCP messages & filter the inappropriate.
• DHCP snooping builds a table of IP address & port mappings
• this table builds based on the known DHCP messages
• this table is called the  DHCP snooping binding table.
• This DHCP snooping binding table can be used by DAI & IP source Guard feature.
• DHCP snooping defeats certain attacks (man in the middle attack using DHCP) by considering port as untrusted.
• All DHCP messages on trusted ports are only allowed by DHCP snooping.
• To this DHCP clients should exist on untrusted ports.
• As a result, the switch filters incoming DHCP messages that are only sent by servers.
• From design point of view unused & unsecured user ports would be configured as untrusted to DHCP snooping.
• DHCP snooping examine the DHCP client messages on untrusted ports because other attacks can be made using DHCP client messages.
• DHCP servers identify clients based on their client hardware address as listed in the DHCP request.
•