Cisco Certified Network Associate (CCNA) 200-301 · Free study guide

Objective 5.7 — Configure Layer 2 security controls

DHCP snooping, dynamic ARP inspection, and port security protect different parts of an access-layer trust model. DHCP snooping limits unauthorized server messages and learns valid address bindings. Dynamic ARP inspection can validate ARP claims against trusted information. Port security controls which or how many MAC addresses an access port may learn. Their dependencies and trust boundaries must be explicit.

Establish DHCP trust deliberately

Client-facing ports are normally untrusted for DHCP server replies. Uplinks toward an authorized DHCP server or relay path may be trusted. Marking every port trusted removes meaningful enforcement; marking the legitimate server path untrusted blocks real offers. Enable the feature for the intended VLANs and verify the binding table after clients lease addresses.

Bindings commonly contain VLAN, MAC address, assigned IP address, interface, and lease information. They are operational state, not merely a configuration line. Rate limits can reduce abusive traffic, but values must allow normal client behavior and recovery bursts.

Validate ARP claims

Dynamic ARP inspection examines ARP traffic on untrusted ports and can compare claims with DHCP snooping bindings. This helps reject a host claiming another leased address. Static hosts may not appear in the dynamic binding table, so the design needs an approved validation method such as a suitable ARP access list or static binding. Enabling inspection without accounting for those hosts can create an outage.

Limit attachment behavior

Port security can limit learned MAC addresses and use statically configured, dynamically learned, or sticky entries depending on the platform and design. Violation behavior may protect, restrict, or shut the port with different operational consequences. A phone plus attached workstation may legitimately present more than one address, so the maximum must reflect the access design.

IOS command map

At global configuration, ip dhcp snooping and ip dhcp snooping vlan 20 enable snooping for the example VLAN. On the verified server-facing uplink, ip dhcp snooping trust permits authorized server replies. Enable inspection with ip arp inspection vlan 20 and apply ip arp inspection trust only on the validated trusted direction, not on ordinary client ports.

On an intended endpoint access port, start port security with switchport port-security and set an evidence-based limit such as switchport port-security maximum 2 for a phone-plus-PC design. Use show ip dhcp snooping, show ip dhcp snooping binding, show ip arp inspection, show ip arp inspection statistics, and show port-security interface GigabitEthernet0/10 to verify trust, bindings, drops, learned addresses, and violations. Exact supported validation and recovery commands vary by switch family and release.

Worked scenario

A legitimate printer with a static IP loses connectivity after dynamic ARP inspection is enabled. DHCP clients still work and inspection drop counters rise on the printer port. The likely problem is missing validation data for the static mapping, not a need to trust every access port. Add the approved mapping through the supported mechanism, retest, and retain inspection for other hosts.

Layer the controls

Port security does not prove an IP-to-MAC binding, and DHCP snooping does not limit every possible MAC attachment by itself. DAI depends on trustworthy binding information. Coordinate VLAN scope, uplink trust, access-port policy, static-device handling, and failure recovery.

Verification evidence

Inspect snooping state by VLAN, trusted interfaces, bindings, rate violations, inspection statistics, validation sources, secure MAC entries, and port-security violation state. Test a normal lease and ARP exchange, then a controlled invalid claim in a safe lab. Confirm the documented recovery action for an error-disabled port.

Common traps

• Trusting client-facing ports for convenience.
• Enabling DAI without planning for static hosts.
• Setting a one-address maximum where a phone and PC coexist.
• Assuming a configured feature has populated its operational state.
• Treating the three controls as interchangeable.

Readiness checklist

• I can identify trusted and untrusted DHCP directions.
• I can explain how DAI uses binding evidence.
• I can choose port-security learning and violation behavior.
• I verify bindings, drops, secure addresses, and recovery.