ExamFinch.com My Study

Study guide

16.4 Layer 2 Infrastructure Security Features

Practice this exam

CCNP Enterprise ENCOR 350-401

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Enterprise Architecture & Hierarchical Design

1.1 Enterprise Network Design Models & Hierarchical Campus Architecture 1.2 On-Premises, Cloud & Hybrid Infrastructure Deployment Models 1.3 Hardware Switching Architecture & Packet Forwarding

2 Chapter 2: Enterprise Quality of Service (QoS)

2.1 QoS Components: Classification, Marking & Trust Boundaries 2.2 QoS Policy: Queuing, Shaping, Policing & Interpreting MQC Output

3 Chapter 3: Software-Defined WAN (Catalyst SD-WAN)

3.1 Cisco Catalyst SD-WAN Architecture & Orchestration 3.2 SD-WAN Policies, Traffic Engineering & Application-Aware Routing

4 Chapter 4: Software-Defined Access (Catalyst SD-Access)

4.1 Catalyst SD-Access Fabric Architecture & Plane Separation 4.2 Cisco TrustSec, Security Group Tags (SGT), SXP & MACsec

5 Chapter 5: Device & Data Path Virtualization

5.1 Server & Network Device Virtualization 5.2 VRF-Lite & Virtual Routing Multi-Tenancy 5.3 GRE & IPsec Tunnel Virtualization Mechanics

6 Chapter 6: Network Virtualization & Overlay Technologies

6.1 LISP Architecture & EID-to-RLOC Mapping Mechanics 6.2 VXLAN & EVPN Overlay Architecture

7 Chapter 7: Layer 2 Infrastructure & Switching

7.1 VLANs, 802.1Q Trunking & VTPv3 7.2 Spanning Tree Protocol Mechanics 7.3 Advanced STP Protection Mechanisms 7.4 EtherChannel Link Aggregation

8 Chapter 8: Layer 3 Routing Foundations & EIGRP

8.1 IP Routing Foundations & Administrative Distance 8.2 Enhanced Interior Gateway Routing Protocol (EIGRP)

9 Chapter 9: OSPFv2 & OSPFv3 Operations

9.1 OSPFv2 Architecture & Neighbor State Machine 9.2 OSPF LSA Types & Multi-Area Design 9.3 OSPFv3 for IPv4 and IPv6 Address Families

10 Chapter 10: Border Gateway Protocol (BGP)

10.1 BGP Architecture, Neighbor States & Peering 10.2 BGP Path Attributes & Best Path Selection Algorithm

11 Chapter 11: Policy-Based Routing & Route Redistribution

11.1 Policy-Based Routing (PBR) & Route Maps 11.2 Route Redistribution & Loop Prevention

12 Chapter 12: IP Services & High Availability

12.1 First Hop Redundancy Protocols (HSRP, VRRP & GLBP) 12.2 Network Time Protocol (NTPv4) & Precision Time Protocol (PTP) 12.3 Network Address Translation (NAT/PAT) & VRF-Aware NAT

13 Chapter 13: IP Multicast Operations

13.1 IP Multicast Addressing, Group Management (IGMPv1/v2/v3) & IGMP Snooping 13.2 Protocol Independent Multicast (PIM-SM, PIM-SSM & Bidir-PIM) 13.3 Rendezvous Point (RP) Distribution Mechanisms

14 Chapter 14: Network Assurance & Monitoring

14.1 Diagnostic Utilities, Conditional Debugging & Path MTU Discovery 14.2 Syslog Architecture, Logging Facilities & Severity Levels 14.3 SNMPv1/v2c/v3 Security & Flexible NetFlow (FNF) Architecture 14.4 Switched Port Analyzer (SPAN, RSPAN, ERSPAN) & IP SLA Object Tracking

15 Chapter 15: Catalyst Center Assurance & Controller Operations

15.1 Cisco Catalyst Center (DNA Center) Assurance & AI Network Analytics 15.2 Cisco Catalyst Center Device Onboarding & Software Image Management (SWIM)

16 Chapter 16: Enterprise Security & Access Control

16.1 Device Hardening, AAA Architecture & RADIUS/TACACS+ 16.2 Access Control Lists (ACLs) for Infrastructure Security 16.3 Control Plane Policing (CoPP) & Control Plane Protection (CPPr) 16.4 Layer 2 Infrastructure Security Features 16.5 IEEE 802.1X Port-Based Authentication & MAB

17 Chapter 17: Threat Defense & API Security

17.1 Enterprise VPN Technologies (DMVPN Phase 1/2/3 & FlexVPN) 17.2 Next-Generation Threat Defense & Secure Access Service Edge (SASE)

18 Chapter 18: Network Automation, Programmability & Data Modeling

18.1 Python Fundamentals for Network Engineers & Cisco Libraries 18.2 YANG Data Modeling Language (RFC 6020/7950) & Model Types 18.3 REST API Architecture, HTTP Verbs, Security & Cisco Controller APIs 18.4 Model-Driven Telemetry (MDT) & NETCONF/RESTCONF Operations

19 Chapter 19: Orchestration, EEM & AI Operations

19.1 Configuration Management & Infrastructure as Code (Ansible & Terraform) 19.2 Cisco Embedded Event Manager (EEM) & Intent-Based Networking

16.4 Layer 2 Infrastructure Security Features

Key Takeaways Explain This Topic AI

DHCP Snooping operates as a stateful Layer 2 security barrier distinguishing trusted uplink ports from untrusted access ports, dropping rogue DHCP server messages (Offer/ACK), inserting Option 82 metadata, and constructing the authoritative DHCP Snooping Binding Database.

Dynamic ARP Inspection (DAI) prevents ARP poisoning and Man-in-the-Middle (MitM) attacks by intercepting and validating all ARP requests and replies on untrusted ports against the DHCP Snooping database and static ARP ACLs.

IP Source Guard (IPSG) prevents IPv4 address spoofing by dynamically programming hardware Port ACLs (PACLs) based on DHCP snooping bindings in IP-only or IP-and-MAC filtering modes (requiring Port Security).

Port Security restricts unauthorized MAC addresses per switchport across three distinct violation modes: Protect (silent drop), Restrict (drop with SNMP trap and syslog generation), and Shutdown (immediate transition to err-disabled state).

IPv6 First-Hop Security (FHS) shields local access domains against rogue SLAAC routers and rogue DHCPv6 servers using IPv6 RA Guard and IPv6 DHCPv6 Guard policies applied at the switchport or VLAN level.

Last updated: August 2026

16.3 Layer 2 Infrastructure Security Features

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 5.2 (infrastructure security features) requires candidates to configure and verify Layer 2 security features. Candidates must master the interconnected security suite comprising DHCP Snooping (trusted vs. untrusted ports, Option 82 insertion, binding database persistence), Dynamic ARP Inspection (DAI, ARP validation, static ARP ACLs, rate limiting), IP Source Guard (IPSG in IP and IP+MAC modes), Port Security (static, dynamic, sticky MACs, violation modes: Protect, Restrict, Shutdown), and IPv6 First-Hop Security (RA Guard and DHCPv6 Guard).

Local Area Networks (LANs) built on Ethernet switching are inherently vulnerable to broadcast and identity manipulation attacks. Because standard Layer 2 switches forward frames based solely on destination MAC addresses without validating source identity, malicious actors on an access port can launch DHCP Starvation , deploy Rogue DHCP Servers , poison neighbor ARP caches ( Man-in-the-Middle / ARP Spoofing ), spoof trusted IP/MAC addresses, or overwhelm switch CAM tables with millions of bogus MAC addresses ( MAC Flooding ).

Cisco IOS-XE addresses these vulnerabilities through an integrated, defense-in-depth Layer 2 security architecture where DHCP Snooping serves as the foundational telemetry engine feeding the DHCP Snooping Binding Database , which in turn powers Dynamic ARP Inspection (DAI) and IP Source Guard (IPSG) . +---------------------------------------------------------------------------------------------------+

  • | LAYER 2 DEFENSE-IN-DEPTH SECURITY HIERARCHY |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | [ IP SOURCE GUARD (IPSG) ] [ DYNAMIC ARP INSPECTION (DAI) ] |
  • | - Blocks IP & MAC Address Spoofing - Blocks ARP Cache Poisoning & MitM Attacks |
  • | - Builds Dynamic Port ACLs (PACLs) - Validates ARP Requests & Replies on Untrusted |
  • | - Filters unauthorized Source IPs - Checks 'src-mac', 'dst-mac', and 'ip' payloads |
  • | \ / |
  • | \ / |
  • | +----------------------------------------+ |
  • | | DHCP SNOOPING BINDING DATABASE | |
  • | | (MAC, IP, Lease, VLAN, Interface) | |
  • | +----------------------------------------+ |
  • | ^ |
  • | | |
  • | [ DHCP SNOOPING ] -------------------+ |
  • | - Differentiates Trusted (Uplinks/Servers) vs Untrusted (Access Endpoints) Ports |
  • | - Drops Rogue DHCP Offer / ACK / NAK Frames on Untrusted Ports |
  • | - Inserts Option 82 Relay Information (Circuit ID & Remote ID) |
  • | - Rate-Limits DHCP Requests to Prevent Pool Starvation |
  • | |
  • | [ PORT SECURITY ] [ IPv6 FIRST-HOP SECURITY (FHS) ] |
  • | - Limits MAC count per port (1-1024) - IPv6 RA Guard (Blocks Rogue RAs) |
  • | - Static, Dynamic, and Sticky MAC Learning - IPv6 DHCPv6 Guard (Blocks Rogue Servers) |
  • | - Modes: Protect, Restrict, Shutdown (err-disable) - IPv6 ND Inspection & Binding Table |
  • +---------------------------------------------------------------------------------------------------+

1. DHCP Snooping & Option 82 Mechanics

DHCP Snooping operates as a stateful Layer 2 packet inspection engine that intercepts all DHCP broadcast and unicast messages on a per-VLAN basis.

Trusted vs. Untrusted Ports

Trusted Ports ( ip dhcp snooping trust ): Configured on switch uplinks, trunk ports, and interfaces directly connected to authorized DHCP servers. Trusted ports are permitted to receive and forward all DHCP message types, including server responses ( DHCP Offer , DHCP ACK , DHCP NAK ).

Untrusted Ports (Default State): All access ports connected to end-user devices, printers, and unmanaged switches. Untrusted ports are permitted to transmit only client DHCP requests ( DHCP Discover , DHCP Request , DHCP Release , DHCP Decline ). If a DHCP Offer or DHCP ACK arrives on an untrusted port, the switch immediately drops the packet, logs a security alert, and does not forward it, neutralizing rogue DHCP servers. +---------------------------------------------------------------------------------------------------+

  • | DHCP SNOOPING OPERATIONAL RULESET |
  • +---------------------------------------------------------------------------------------------------+
  • | Packet Received on Untrusted Port | Condition / Inspection Check | Switch Action |
  • | :------------------------------------ | :------------------------------------ | :---------------- |
  • | **DHCP Offer / ACK / NAK** | Any DHCP server response message | **DROP & LOG** |
  • | **DHCP Discover / Request** | Source MAC != DHCP Client HW Address | **DROP & LOG** |
  • | **DHCP Release / Decline** | IP/MAC/Port does NOT match DB entry | **DROP & LOG** |
  • | **DHCP Discover / Request** | Rate exceeds `limit rate <pps>` | **ERR-DISABLE** |
  • | **Valid DHCP Discover / Request** | Legitimate client request | **INSERT OPT 82 &**|
  • | | | **FORWARD** |
  • +---------------------------------------------------------------------------------------------------+
  • The DHCP Snooping Binding Database

When a legitimate client completes the four-way DHCP DORA exchange ( Discover , Offer , Request , ACK ), the switch snoops the DHCP ACK on the trusted uplink and extracts the negotiated parameters to create an entry in the DHCP Snooping Binding Database :

  • Client MAC Address
  • Assigned IPv4 Address
  • Lease Duration (seconds)
  • Binding Type (DHCP dynamic vs. static)
  • VLAN ID
  • Physical Interface / Switchport Switch# show ip dhcp snooping binding
  • MacAddress IP Address Lease(sec) Type VLAN Interface
  • ----------------- --------------- ---------- ------------- ---- --------------------
  • 00:50:56:A1:22:33 192.168.10.45 86400 dhcp-snooping 10 GigabitEthernet1/0/1
  • 00:50:56:B4:88:99 192.168.10.46 86400 dhcp-snooping 10 GigabitEthernet1/0/2
  • Total number of bindings: 2

Tip

Binding Database Persistence: By default, the binding database resides solely in volatile RAM and is lost upon switch reboot. In production environments, database persistence must be configured using an external TFTP/FTP/SFTP server or local flash storage ( ip dhcp snooping database flash:dhcp-snoop.db ).

DHCP Option 82 (Relay Agent Information Option)

When DHCP Snooping is enabled, the edge switch automatically inserts DHCP Option 82 into client DHCP Discover and Request packets before forwarding them upstream:

Circuit ID Sub-Option: Identifies the physical ingress port and VLAN (e.g., Module 1, Port 1, VLAN 10).

Remote ID Sub-Option: Identifies the switch hardware (typically the switch base MAC address). +---------------------------------------------------------------------------------------------------+

  • | OPTION 82 DEFAULT FORWARDING ISSUE (giaddr = 0.0.0.0) |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | Client PC Access Switch (Layer 2) Core Router / DHCP Server |
  • | [Untrusted] [DHCP Snooping Enabled] [Default RFC 3046 Policy] |
  • | | | | |
  • | |-- 1. DHCP Discover -----------> | | |
  • | | (giaddr = 0.0.0.0) |-- 2. Inserts Option 82 ---------------> | |
  • | | | (Leaves giaddr = 0.0.0.0) | |
  • | | | x (DROPPED!) |
  • | | | |
  • | * PROBLEM: RFC 3046 specifies that an un-routed packet (giaddr = 0.0.0.0) containing Option 82 |
  • | must be dropped by downstream switches/routers as untrusted. |
  • | |
  • | * SOLUTION 1 (On Access Switch): 'no ip dhcp snooping information option' |
  • | * SOLUTION 2 (On Core Router/SW): 'ip dhcp snooping information option allow-untrusted' |
  • | or 'ip dhcp relay information trust-all' |
  • +---------------------------------------------------------------------------------------------------+

2. Dynamic ARP Inspection (DAI) & Static ARP ACLs

Address Resolution Protocol (ARP) lacks authentication. An attacker can transmit gratuitous ARP replies asserting their MAC address is associated with the default gateway IP, redirecting all subnet traffic through the attacker's machine ( ARP Poisoning / Man-in-the-Middle ).

Dynamic ARP Inspection (DAI) validates all ARP Requests and Replies on untrusted ports before forwarding them:

When an ARP packet arrives on an untrusted port, DAI extracts the Sender MAC and Sender IP from the ARP payload.

DAI queries the DHCP Snooping Binding Database for a matching MAC-to-IP binding on that specific VLAN and port.

If a valid binding exists, the ARP packet is forwarded. If the binding is missing or mismatched, the packet is discarded and logged. +---------------------------------------------------------------------------------------------------+

  • | DYNAMIC ARP INSPECTION (DAI) VALIDATION FLOW |
  • +---------------------------------------------------------------------------------------------------+
  • | |
  • | Incoming ARP Packet on Untrusted Port (Sender IP: 192.168.10.45, Sender MAC: 0050.56A1.2233) |
  • | | |
  • | v |
  • | [ STEP 1: STATIC ARP ACL CHECK ] -> Does an 'arp access-list' filter exist for this VLAN? |
  • | | |
  • | +-- YES: Matches Static ARP ACL? ----> (MATCH: Permit & Forward / NO MATCH: Drop) |
  • | | |
  • | +-- NO / FALLTHROUGH: Proceed to Step 2 |
  • | v |
  • | [ STEP 2: DHCP SNOOPING BINDING DB CHECK ] |
  • | - Looks up 192.168.10.45 + 0050.56A1.2233 + VLAN 10 in Snooping Table |
  • | | |
  • | +-- MATCH FOUND: Forward ARP Packet |
  • | +-- NO MATCH / MISMATCH: SILENT DROP & INCREMENT DAI LOG COUNTER |
  • +---------------------------------------------------------------------------------------------------+
  • Static ARP ACLs for Non-DHCP Endpoints

Statically addressed servers, printers, or appliances do not participate in DHCP and therefore lack entries in the DHCP Snooping database. To prevent DAI from dropping their legitimate ARP packets, administrators configure Static ARP ACLs : ! Configure Static ARP ACL for Static Servers

  • arp access-list STATIC-SERVER-ARP-ACL
  • permit ip host 192.168.10.10 mac host 0050.56a1.0010
  • permit ip host 192.168.10.11 mac host 0050.56a1.0011

!

  • ! Apply Static ARP ACL to Dynamic ARP Inspection on VLAN 10
  • ip arp inspection filter STATIC-SERVER-ARP-ACL vlan 10
  • Additional DAI Payload Validation Checks

DAI can enforce strict Layer 2/Layer 3 header alignment beyond simple binding table lookups using ip arp inspection validate :

src-mac : Checks the Sender MAC in the ARP payload against the Ethernet source MAC in the frame header. Drops if mismatched.

dst-mac : Checks the Target MAC in the ARP payload against the Ethernet destination MAC in the frame header (for ARP replies). Drops if mismatched.

ip : Validates that the Sender IP is not a broadcast ( 255.255.255.255 ), multicast ( 224.0.0.0/4 ), or loopback/invalid address ( 0.0.0.0 ). ! Enable strict multi-attribute ARP validation

  • Switch(config)# ip arp inspection validate src-mac dst-mac ip
  • DAI Rate Limiting & Err-Disable Recovery

To prevent an attacker from DoSing the switch CPU with thousands of bogus ARP packets (which must be inspected by the CPU), untrusted ports enforce a default rate limit of 15 packets per second (pps) :

If the ARP rate exceeds the threshold, the port transitions to err-disabled state.

Automated recovery: errdisable recovery cause arp-inspection with errdisable recovery interval 300 .

Loading diagram... Dynamic ARP Inspection and DHCP Snooping Defense Sequence

  • 3. IP Source Guard (IPSG) & Port Security
  • IP Source Guard (IPSG)

IP Source Guard (IPSG) prevents an attacker from injecting traffic with a spoofed source IP or MAC address. IPSG dynamically constructs and applies hardware Port Access Control Lists (PACLs) to untrusted switchports based directly on the DHCP Snooping Binding Database: +---------------------------------------------------------------------------------------------------+

  • | IP SOURCE GUARD (IPSG) OPERATIONAL MODES |
  • +---------------------------------------------------------------------------------------------------+
  • | IPSG Filtering Mode | Configuration Command | Prerequisite & Enforced Behavior |
  • | :---------------------- | :------------------------------ | :------------------------------------ |
  • | **IP Filtering Only** | `ip verify source` | Requires DHCP Snooping. Drops any |
  • | | | ingress IP packet whose source IP does|
  • | | | not match the snooping table. |
  • | **IP + MAC Filtering** | `ip verify source port-security`| Requires **BOTH DHCP Snooping AND |
  • | | | Port Security**. Drops packets whose |
  • | | | source IP OR source MAC does not match|
  • | | | the combined snooping/port-sec tables.|
  • +---------------------------------------------------------------------------------------------------+
  • Port Security Architecture & Violation Modes

Port Security restricts the number and identity of MAC addresses allowed to transmit frames on an access interface:

Static MACs: Explicitly defined by the administrator ( switchport port-security mac-address <mac> ). Stored in the running-config.

Dynamic MACs: Learned from the source MAC of incoming frames and stored in the MAC address table in RAM. Lost upon switch reboot or MAC aging.

Sticky MACs: Learned dynamically upon frame arrival and automatically written into the active running-config ( switchport port-security mac-address sticky ). Survives reboots if the configuration is saved. +---------------------------------------------------------------------------------------------------+

  • | PORT SECURITY VIOLATION MODES DETAILED COMPARISON |
  • +---------------------------------------------------------------------------------------------------+
  • | Violation Mode | Packet Forwarding Action | Counter Incremented? | Syslog / SNMP Trap? | Port State |
  • | :-------------- | :----------------------- | :------------------- | :------------------ | :---------- |
  • | **Protect** | **Drops** unauthorized | **NO** | **NO** | Stays **UP**|
  • | | frames silently | | | |
  • | **Restrict** | **Drops** unauthorized | **YES** | **YES** | Stays **UP**|
  • | | frames | | | |
  • | **Shutdown** | **Drops** all traffic; | **YES** | **YES** | **DOWN** |
  • | *(Default)* | disables entire port | | | `err-disable`|
  • +---------------------------------------------------------------------------------------------------+

4. IPv6 First-Hop Security (FHS): RA Guard & DHCPv6 Guard

In IPv6 networks, endpoints utilize Stateless Address Autoconfiguration (SLAAC) via ICMPv6 Router Advertisement (RA) messages (Type 134) transmitted by default routers. A rogue device transmitting malicious RA messages can rewrite default gateways and DNS servers for all subnet hosts. +---------------------------------------------------------------------------------------------------+

  • | IPv6 FIRST-HOP SECURITY (FHS) DEFENSE SUITE |
  • +---------------------------------------------------------------------------------------------------+
  • | FHS Feature | Target Threat & Attack Vector | Enforcement Mechanism |
  • | :---------------------- | :------------------------------ | :------------------------------------ |
  • | **IPv6 RA Guard** | Rogue IPv6 Routers / SLAAC | Intercepts ICMPv6 Type 134 (RA) and |
  • | | Hijacking / Malicious Prefixes | Type 137 (Redirect) on untrusted |
  • | | | ports; drops unauthorized RAs. |
  • | **IPv6 DHCPv6 Guard** | Rogue DHCPv6 Server Attacks | Blocks unauthorized DHCPv6 Advertise |
  • | | | and Reply messages on untrusted ports.|
  • | **IPv6 ND Inspection** | IPv6 Neighbor Spoofing (DAD) | Validates Neighbor Solicitations (NS) |
  • | | | and Advertisements (NA) against table.|
  • | **IPv6 Source Guard** | IPv6 Address Spoofing | Hardware PACL filtering of IPv6 source|
  • | | | addresses based on ND binding table. |

+---------------------------------------------------------------------------------------------------+ ! Configuring IPv6 RA Guard Policy

  • Switch(config)# ipv6 nd raguard policy RAGUARD-ACCESS-POLICY
  • Switch(config-nd-raguard)# device-role host

!

  • ! Apply RA Guard to Access Interface
  • Switch(config)# interface GigabitEthernet1/0/1
  • Switch(config-if)# ipv6 nd raguard attach-policy RAGUARD-ACCESS-POLICY

5. Cisco IOS-XE Layer 2 Security CLI Configuration & Verification

Comprehensive Multi-Feature Hardening Configuration ! ===================================================================

  • ! STEP 1: CONFIGURE DHCP SNOOPING GLOBALLY AND PER VLAN
  • ! ===================================================================
  • ip dhcp snooping
  • ip dhcp snooping vlan 10,20,30
  • no ip dhcp snooping information option ! Or allow-untrusted upstream
  • ip dhcp snooping database flash:dhcp-snooping-bindings.db
  • ip dhcp snooping database write-delay 60

!

  • ! ===================================================================
  • ! STEP 2: CONFIGURE DYNAMIC ARP INSPECTION (DAI) & IPSG
  • ! ===================================================================
  • ip arp inspection vlan 10,20,30
  • ip arp inspection validate src-mac dst-mac ip

!

  • ! Enable Errdisable Recovery for Layer 2 Security Violations
  • errdisable recovery cause dhcp-rate-limit
  • errdisable recovery cause arp-inspection
  • errdisable recovery cause psecure-violation
  • errdisable recovery interval 300

!

  • ! ===================================================================
  • ! STEP 3: CONFIGURE TRUSTED UPLINK TRUNK PORT (To Core Switch)
  • ! ===================================================================
  • interface TenGigabitEthernet1/0/48
  • description UPLINK-TO-CORE-SWITCH
  • switchport mode trunk
  • ip dhcp snooping trust
  • ip arp inspection trust

!

  • ! ===================================================================
  • ! STEP 4: CONFIGURE UNTRUSTED ACCESS USER SWITCHPORT
  • ! ===================================================================
  • interface GigabitEthernet1/0/1
  • description ACCESS-USER-ENDPOINT
  • switchport mode access
  • switchport access vlan 10
  • spanning-tree portfast
  • spanning-tree bpduguard enable

!

  • ! Rate-Limit Ingress DHCP & ARP on Untrusted Access Port
  • ip dhcp snooping limit rate 20
  • ip arp inspection limit rate 15

!

  • ! Enable IP Source Guard (Requires DHCP Snooping)
  • ip verify source port-security

!

  • ! Enable Port Security with Sticky MAC & Restrict Violation Mode
  • switchport port-security
  • switchport port-security maximum 2
  • switchport port-security mac-address sticky
  • switchport port-security violation restrict
  • switchport port-security aging time 10
  • switchport port-security aging type inactivity
  • Operational Verification Commands Switch# show ip dhcp snooping
  • Switch DHCP snooping is enabled
  • DHCP snooping is configured on following VLANs: 10,20,30
  • DHCP snooping is operational on following VLANs: 10,20,30
  • Insertion of Option 82 is disabled
  • Verification of hwaddr: return true
  • Interface Trusted Rate limit (pps)
  • ---------------------- ------- ----------------
  • GigabitEthernet1/0/1 no 20
  • TenGigabitEthernet1/0/48 yes unlimited
  • Switch# show ip arp inspection vlan 10
  • Source Mac Validation : Enabled
  • Destination Mac Validation : Enabled
  • IP Address Validation : Enabled
  • Vlan Configuration Operation ACL Match Static ACL
  • --- ------------- --------- --------- ----------
  • 10 Enabled Operational
  • Vlan Permitted Dropped DHCP Drops ACL Drops
  • --- --------- ------- ---------- ---------
  • 10 142050 42 42 0
  • Switch# show port-security interface GigabitEthernet1/0/1
  • Port Security : Enabled
  • Port Status : Secure-up
  • Violation Mode : Restrict
  • Aging Time : 10 mins
  • Aging Type : Inactivity
  • Secure MAC Address Type : Sticky
  • Maximum MAC Addresses : 2
  • Total MAC Addresses : 1
  • Configured MAC Addresses : 0
  • Sticky MAC Addresses : 1
  • Last Source Address:Vlan : 0050.56a1.2233:10
  • Security Violation Count : 0