802.1X Roles:

• Supplicant:
• the 802.1x driver supplies a username/password prompt to the user and sends/recives the EAPoL messages.
• Authentication:
• Translate between EAPoL & RADIUS messages in bothe directions and enables/disables ports based on the success/failure of authentication
• Authentication Server:
• Stores usernames/passwords and verifies that the correct values were submitted before authenticating the user

802.1X Authentication Using EAP

• Switches can use IEEE 802.1X to perform user authentication.
• User authentication requires the user to supply a username & password, verified by a RADIUS server, before the switch will enable the switch port for normal user traffic.
• IEEE 8802.1X defines some of the LAN user authentication, but it also uses the Extensible Authentication Protocol (EAP).
• EAP: an internet standard (RFC 3748), as the underlying protocol used for authentication.
• EAP also provides One-time passwords (OTPs).

IP Source Guard

• It add one more check to the DHCP snooping logic.
• When enabled along with DHCP snooping, IP Source Guard checks the source IP address of received packets against the DHCP snooping binding database.
• It checks both the source ip & source MAC address against that same database.
• If the entries do not match, the frame is filtered.
• ip verify source
• to check source ip address only
• ip verify source port-security
• check both the source ip & MAC address
• ip source binding mac-address vlan vlan-id ip-address interface interface-id
• Global command to create static entries that will be used in addition to the DHCP snooping binding database.
• 
  

DCHP Snooping Commands

Command	Purpose
ip dhcp snooping vlan vlan-range	Global command to enable DHCP snooping for one or more VLANs
[no] ip dhcp snooping trust	Interface command to enable or disable a trust level on an interface;
Ip dhcp snooping binding mac-addre vlan vlan-id ip-addre interface interface-id expiry seconds	Global command to add static entries to the DHCP snooping binding database
Ip dhcp snooping verify mac-address	Global command to add static entries to the DHCP snooping binding database
Ip dhcp snooping limit rate rate	Sets the maximum number of DHCP messages per second to mitigate DoS attack.

DHCP Snooping: Logical steps for Filtering

• It filters all messages sent exclusively by DHCP servers.
• The switch checks DHCP release & decline messages against the DHCP snooping binding table.
• if the IP address in those messages is not listed with the port in the DHCP snooping binding table, the messages are filtered.
• Optionally, it compares  a DHCP request's client hardware address value with the source MAC address inside the Ethernet frame.

The 1st one takes care of the fake DHCP server man-in-the-middle attack.

The 2nd one prevents an attacking host from releasing a legitimate host's DHCP lease, then attempting to request an address and be assigned the same ip address