Understanding Network Security for Authorized User Access
# Problem Scenario:
* Only authorized users should be allowed network access.
* Users can obtain IP addresses either via DHCP or a predefined static IP list.
* Unauthorized users (e.g., attackers using rogue DHCP servers or spoofed IPs) must be blocked.
# Required Technologies for Securing Access:1## DHCP Snooping - Protects against rogue DHCP servers and builds a binding table of legitimate DHCP clients.2## IP Source Guard (IPSG) - Ensures that only authorized IP-MAC bindings can send traffic.
Analysis of the Answer Choices:
# A. DAI + Port Security (Incorrect)
* DAI (Dynamic ARP Inspection) prevents ARP spoofing but does not validate IP-MAC-DHCP bindings.
* Port Security only limits MAC addresses per port but does not verify IP addresses.
* Does NOT protect against unauthorized static IP users.
# B. DHCP Snooping + IPSG (Correct)
* DHCP Snooping:
* Prevents rogue DHCP servers from assigning unauthorized IPs.
* Builds a DHCP binding table (IP-MAC-Port).
* IP Source Guard (IPSG):
* Blocks traffic from IPs not listed in the DHCP snooping binding table.
* Can be configured to allow manually specified static IP addresses.
* Best choice to allow only authorized users (both DHCP and static IP users).
# C. DHCP Snooping + DAI (Incorrect)
* DAI (Dynamic ARP Inspection) prevents ARP spoofing but does not block unauthorized static IP users.
* Lacks IP-level access control needed to enforce static IP policies.
# D. DAI + IPSG (Incorrect)
* IPSG (IP Source Guard) needs DHCP Snooping to build the binding table.
* Without DHCP Snooping, IPSG cannot function properly.
* DAI does not provide complete protection against unauthorized users.
Why is the Answer B (DHCP Snooping + IPSG)?
# Ensures only users assigned a DHCP IP (or authorized static IPs) can send traffic.# Blocks rogue DHCP servers and unauthorized static IP users.
Real-World Application:
* Enterprise Networks: Prevents unauthorized static IP users or attackers from accessing VLANs.
* Public Wi-Fi Security: Ensures only authorized users receive IPs and can send traffic.
# Reference: Huawei HCIE-Datacom Guide - DHCP Snooping and IPSG Security Mechanisms