CCNA Part 4

What is Port Security?

a Layer 2 security mechanism built into Cisco Catalyst switches

What are the 3 main reasons we use port security?

1. Network Access Control: Prevents unauthorized devices (e.g., employee personal laptops) from plugging into an active wall jack and accessing internal resources

2. Mitigation of MAC Table Flooding Attacks: Switches have finite memory for their MAC address table. Attacks like MAC flooding try to overflow the table so the switch fails open and floods all unicast frames

3. Defense Against DHCP Starvation Attacks: Prevents an attacker from spoofing thousands of fake MAC addresses on a single port to exhaust the DHCP IP pool

Exam Tip: Port Security alone does not completely prevent MAC spoofing, as an attacker can spoof an authorized device's MAC address. However, limiting the total count of MAC addresses per port effectively mitigates automated starvation attacks

note

What mode do Cisco switch ports operate in by default?

By default, Cisco switch ports operate in dynamic mode (switchport mode dynamic auto via DTP)

Can port security be enabled on dynamic ports?

No. Port Security cannot be enabled on dynamic ports

Before configuring port security, the port must be explicitly configured as either a ___ ___ port or a ___ ___ port

Before configuring port security, the port must be explicitly configured as either a static access port or a static trunk port

What are the commands that enable port security on an interface?

Switch(config)# interface g0/1

Switch(config-if)# switchport mode access

Switch(config-if)# switchport port-security

When an unauthorized source MAC address enters a port security-enabled port, the switch responds based on its configured ___ ___.

When an unauthorized source MAC address enters a port security-enabled port, the switch responds based on its configured Violation Mode

What is the default violation mode?

Shutdown

What are the 2 other violation modes?

1. Restrict

2. Protect

Answer the following questions for the shutdown violation mode:

1. Does it drop unauthorized traffic?

2. Does it disable the interface?

3. Does it generate syslog/SNMP trap?

4. Does it increment the violation counter?

5. What happens if authorized traffic flow is passed through it after the violation?

1. Yes

2. Yes (err-disabled)

3. Yes

4. Set to 1

5. Stopped (port down)

Answer the following questions for the restrict violation mode:

1. Does it drop unauthorized traffic?

2. Does it disable the interface?

3. Does it generate syslog/SNMP trap?

4. Does it increment the violation counter?

5. What happens if authorized traffic flow is passed through it after the violation?

1. Yes

2. No

3. Yes (per frame)

4. Yes (per frame)

5. Allowed

Answer the following questions for the protect violation mode:

1. Does it drop unauthorized traffic?

2. Does it disable the interface?

3. Does it generate syslog/SNMP trap?

4. Does it increment the violation counter?

5. What happens if authorized traffic flow is passed through it after the violation?

1. Yes

2. No

3. No

4. No

5. Allowed

What is the command to assign a violation mode to a port using port-security?

Switch(config-if)# switchport port-security violation { shutdown | restrict | protect }

How do you manually recover a port that has been shutdown due to a violation in shutdown mode? What are the commands?

Always disconnect the unauthorized device first. Then bounce the port in interface configuration mode:

Switch(config-if)# shutdown

Switch(config-if)# no shutdown

How do you automatically recover a port that has been shutdown due to a violation in shutdown mode? What are the commands?

Automatically re-enables disabled ports after a specified interval:

Switch(config)# errdisable recovery cause psecure-violation

Switch(config)# errdisable recovery interval 180

• The default recovery interval is 300 seconds (5 minutes).

• Warning: If the rogue device is not disconnected prior to recovery, the port will immediately re-enter err-disabled status upon receiving another frame

Port security allows you to specify MAC addresses using three distinct approaches. List the 3 approaches.

1. Dynamic Secure MAC Addresses

2. Static Secure MAC Addresses

3. Sticky Secure MAC Addresses

What are dynamic secure MAC addresses, how are they learned, how are they stored, and what is their behavior on reboot?

Dynamic secure MAC addresses are the absolute simplest form of Cisco Port Security.

How It Works

• Learning: When a device plugs into g0/1, the switch learns its MAC address dynamically and adds it to the secure MAC address table in RAM.

• Storage: Stored only in RAM (volatile memory). They are never saved to the running configuration or startup configuration.

• Behavior on Reboot: If the switch reboots or the port link resets (unplugged cable), all dynamically learned secure MAC addresses are erased immediately. The next device to plug in gets learned as the new allowed MAC.

How are dynamic secure MAC addresses secure?

• MAC Flood Protection: Just like Sticky, it caps the maximum allowed MACs on a port (e.g., switchport port-security maximum 1). An attacker cannot flood the CAM table.

• Real-Time Port Lock: While the original device is connected, plugging a second device into a hub/mini-switch on g0/1 will trigger a violation and block the second device.

What is the security flaw with dynamic secure MAC addresses?

Zero Persistence: If an attacker physically unplugs a printer or PC from g0/1 and plugs in their rogue laptop, the link state drops and resets. The switch forgets the original device's MAC and immediately learns and trusts the attacker's laptop.

What are static secure MAC addresses, how are they learned, how are they stored, and what is their behavior on reboot?

Static secure MAC addresses are the most rigid and manually controlled form of Port Security.

How It Works

• Learning: No automatic learning occurs. A network administrator explicitly types the allowed MAC address directly into the command line (e.g., switchport port-security mac-address 0011.2233.4455).

• Storage: Stored in the running configuration. Once the admin saves the config (write memory), it is permanently written to NVRAM.

• Behavior on Reboot: Fully persistent across reboots and cable disconnects. The port will only communicate with the manually specified MAC address.

How are static secure MAC addresses secure?

• No "First-Come, First-Served" Risk: Unlike Dynamic and Sticky, an unauthenticated device cannot simply plug into an open port and claim it. If the plugged-in device's MAC doesn't match the hardcoded entry, the port immediately blocks it or shuts down.

• Total Port Control: Guarantees that port g0/1 belongs exclusively to the designated host hardware.

What is the security flaw of static secure MAC addresses?

1. MAC Spoofing: If an attacker physically inspects a printer label or sniffs traffic to learn the authorized MAC address, they can easily spoof their network adapter's MAC address to match the static entry and bypass the control.

2. Administrative Overhead: Manually configuring hundreds of 48-bit MAC addresses across an enterprise switch block is notoriously difficult to maintain.

What are sticky secure MAC addresses, how are they learned, how are they stored, and what is their behavior on reboot?

Sticky secure MAC addresses combine manual security with automated convenience, allowing a switch to dynamically learn MAC addresses and convert them into secure entries.

Learning

• Dynamic to Static Conversion: The switch automatically learns MAC addresses of connected devices dynamically (up to a configured maximum limit), or you can pre-define a base set.

• Command Line Control: Once learned, these addresses are "made sticky" via configuration commands (e.g., switchport port-security mac-address sticky or by manually adding specific sticky entries).

Storage

• Running Configuration: Learned addresses are immediately written into the switch's running configuration file.

• NVRAM Persistence: When the administrator saves the configuration (write memory or copy running-config startup-config), these addresses are permanently written to NVRAM alongside the manual settings.

Behavior on Reboot

• Persistent Retention: Unlike pure dynamic secure addresses which are wiped out upon a power cycle or reboot, sticky secure addresses remain intact across reboots and cable disconnects.

• Re-learning vs. Preservation: Because they are saved to the startup configuration, the switch does not need to re-learn them when it boots back up; it immediately enforces the saved list on the port.

How are sticky secure MAC addresses secure?

Automated Port Control with Flexible Binding

• Host-to-Port Lock-In: Once learned and saved, sticky MAC addresses function identically to static entries, guaranteeing that only the specific host hardware can communicate on that port.

• Reduced Administrative Overhead: Provides total port isolation without requiring administrators to manually discover and manually type out every individual 48-bit MAC address for every host.

What are the security flaws of sticky secure MAC addresses?

1. The "First-Plug Wins" Vulnerability (Initial Trust Window)

• Unauthenticated Access: When sticky security is first enabled on a port without pre-existing static entries, the switch blindly trusts the very first MAC address to transmit frame headers.

• Rogue Device Binding: If an unauthorized device or attacker plugs into an open port before the intended host connects, the switch binds that rogue MAC address to the port configuration automatically.

2. Susceptibility to MAC Spoofing & Network Interception

• Lack of Hardware Authentication: Port security only inspects the Layer 2 source MAC address in the Ethernet frame, not device identity, digital certificates, or cryptographic keys.

• Inline Rogue Tap: If an attacker uses a network tap or a bridged device with a cloned (spoofed) MAC address of the legitimate host, the switch will permit the traffic because the frame headers match the sticky database.

Do secure MAC addresses age out by default?

By default, secure MAC addresses do not age out (aging time = 0 minutes)

What is the command that ages out a secure MAC address?

Switch(config-if)# switchport port-security aging time <minutes>

What is the default aging type?

Absolute

What is the absolute aging type?

After the secure MAC address is learned, the aging timer starts and the MAC is removed after the timer expires, even if the switch continues receiving frames from that source MAC address.

What is the inactivity aging type?

After the secure MAC address is learned, the aging timer starts but is reset every time a frame from that source MAC address is received on the interface.

What is the command to configure the aging type?

Switch(config-if)# switchport port-security aging type { absolute | inactivity }

Secure static MAC address aging is disabled by default. What command lets you age secure static MAC addresses?

Switch(config-if)# switchport port-security aging static

What is DHCP Snooping?

DHCP Snooping is a Layer 2 security feature on Cisco Catalyst switches designed to defend against malicious attacks that exploit the Dynamic Host Configuration Protocol (DHCP). It acts as a logical firewall sitting between untrusted hosts and the DHCP infrastructure, inspecting and filtering DHCP traffic

DHCP Snooping categorizes switch interfaces into two operational states, what are those states?

1. Untrusted Port

2. Trusted Port

What is the default state, placement, and behavior of untrusted ports?

• Default State: All switch interfaces are untrusted by default when DHCP Snooping is enabled globally.

• Placement: Typically assigned to downlink ports connected to end-user devices (PCs, IP phones, printers).

• Behavior: Switches inspect all incoming DHCP client messages. DHCP server responses (e.g., OFFER, ACK, NAK) arriving on untrusted ports are immediately dropped

What is the placement and behavior of trusted ports?

• Placement: Manually configured on uplink ports leading to legitimate network infrastructure (DHCP servers, DHCP relay agents, or upstream switches)

• Behavior: Traffic bypasses DHCP Snooping inspection filters and is forwarded normally without packet drops

Explain a DHCP Starvation (Exhaustion) Attack’s:

1. Mechanism

2. Impact

3. Key Field

4. Mitigation

• Mechanism: An attacker floods the network with continuous DHCP DISCOVER requests using spoofed source MAC addresses

• Impact: Depletes the DHCP server’s IP address pool, resulting in a Denial of Service (DoS) for legitimate hosts attempting to join the network

• Key Field: Attackers spoof the Client Hardware Address (chaddr) field inside the DHCP payload, which servers use to identify clients across DHCP relay agents

• Mitigation: DHCP Snooping validates that the frame's source MAC address matches the inner chaddr field, discarding mismatched frames. Rate limiting prevents high-rate flooding

Explain a DHCP Poisoning/Rogue (Spurious) DHCP Server Attack’s":

1. Mechanism

2. Impact

3. Result

4. Mitigation

• Mechanism: An unauthorized ("spurious") DHCP server responds to client DHCP DISCOVER broadcasts with rogue IP configuration parameters

• Impact: The rogue server assigns its own IP address as the client's Default Gateway

• Result: Enables a Man-in-the-Middle (MitM) attack. All external traffic from the victim host routes through the attacker's system before reaching the real default gateway, allowing traffic inspection or modification

• Mitigation: Untrusted ports automatically drop all DHCP server messages (OFFER, ACK, NAK), blocking rogue servers connected to user ports

DHCP Snooping enforces different ____ logic based on whether a message originates from a ____ or a ____.

DHCP Snooping enforces different inspection logic based on whether a message originates from a server or a client

For message type OFFER:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Server

2. Always discarded

For message type ACK:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Server

2. Always discarded

For message type NAK:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Server

2. Always discarded

For message type DISCOVER:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Client

2. Inspected (Source MAC == chaddr field)

For message type REQUEST:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Client

2. Inspected (Source MAC == chaddr field)

For message type RELEASE:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Client

2. Check packet Source IP and interface against the DHCP Snooping Binding Table. Match = Forward; Mismatch = Discard

For message type DECLINE:

1. Who is the sender?

2. What is it’s behavior on untrusted ports?

1. Client

2. Check packet Source IP and interface against the DHCP Snooping Binding Table. Match = Forward; Mismatch = Discard

What does a switch record when an end host completes the DHCP DORA process through an untrusted port?

The switch records the binding details in its dynamic binding database:

• MAC Address: Host physical address

• IP Address: Assigned IP address

• Lease (seconds): Remaining lease duration

• Type: dhcp-snooping

• VLAN: Associated VLAN ID

• Interface: Incoming port identifier

Note: The DHCP Snooping Binding Table does not store the default gateway address

DHCP Snooping Configuration: What command enables DHCP snooping globally?

Switch(config)# ip dhcp snooping

DHCP Snooping Configuration: What command enables DHCP snooping for specific VLANs?

Switch(config)# ip dhcp snooping vlan 1

DHCP Snooping Configuration: What command configures trusted interface(s) pointing to the DHCP server/relay?

Switch(config)# interface GigabitEthernet0/0

Switch(config-if)# ip dhcp snooping trust

DHCP Snooping Configuration: What command configures rate limiting on untrusted access interfaces?

Switch(config)# interface range GigabitEthernet0/1 - 3

Switch(config-if)# ip dhcp snooping limit rate 10

*10 packets per second

DHCP Snooping Configuration: What command (optional) disables option 82 insertion if issues occur (more on this later)?

Switch(config)# no ip dhcp snooping information option

DHCP Snooping Configuration: What verification command lets you view DHCP snooping operational status and global parameters?

Switch# show ip dhcp snooping

DHCP Snooping Configuration: What verification command lets you view dynamic binding table entries?

Switch# show ip dhcp snooping binding

DHCP Snooping Configuration: What verification command lets you view err-disable status and automatic recovery timers?

Switch# show errdisable recovery

DHCP Snooping Configuration: What command lets you automatically recover from the err-disable state caused by a rate-limit infraction?

SW1(config)# errdisable recovery cause dhcp-rate-limit

What is the default Cisco behavior for Option 82 in regard to switches? What is the issue it can cause, and what is the solution?

• Default Cisco Behavior: Cisco switches automatically insert Option 82 metadata into client DHCP requests, even if the switch is not operating as a Layer 3 relay agent

• Common Issue: Unconfigured downstream switches or servers drop packets containing Option 82 received on untrusted ports or without relay information

• Solution: Apply ‘no ip dhcp snooping information option’ globally to prevent the switch from appending Option 82 (must be applied to every switch in the network)

Here is a pic showing the command review for DHCP Snooping

Which DHCP message types are always dropped when received on an untrusted port?

• Answer: OFFER, ACK, NAK

• Reason: These are server-generated messages and must only originate from trusted interfaces.

What parameters are verified when a DHCP DISCOVER packet arrives on an untrusted interface?

Answer: Frame Source MAC address vs. DHCP Client Hardware Address (chaddr)

Which attack uses a spoofed MAC address of a known network host to bypass port security controls?

Answer: MAC Spoofing

What is dynamic ARP inspection?

Dynamic ARP Inspection (DAI) is a Layer 2 security feature on Cisco switches designed to prevent ARP poisoning and Man-in-the-Middle (MitM) attacks. DAI operates on untrusted switch ports by intercepting, inspecting, and validating all ARP requests and replies against a trusted database (primarily the DHCP Snooping Binding Table or configured ARP ACLs) before forwarding them

What is the purpose, process, and fields in the payload of Standard ARP?

• Purpose: Maps a known Layer 3 IP address to an unknown Layer 2 MAC address within a local area network (LAN).

• Process:

  • ARP Request: Broadcast message (FF:FF:FF:FF:FF:FF) sent by a host asking "Who has IP X.X.X.X?"

  • ARP Reply: Unicast message sent back by the target device containing its MAC address.

• Encapsulation Note: ARP messages run directly over Ethernet (Ethernet Type 0x0806). There is no IP header. Important fields inside the ARP payload include:

  • Sender MAC / Sender IP

  • Target MAC / Target IP

What is Gratuitous ARP? What does the process look like? What are some legitimate use cases? What are its security vulnerabilities?

• An ARP Reply sent without receiving an ARP Request

• Sent to the broadcast MAC address (FF:FF:FF:FF:FF:FF).

• Legitimate Use Cases: Notifies the network of IP/MAC changes or link status updates so surrounding devices can update their ARP tables automatically

• Security Vulnerability: Exploited by attackers to poison host ARP tables without prompting

Explain how ARP poisoning works in detail in 4 steps.

1. An attacker sends a forged Gratuitous ARP (G-ARP) frame to the LAN claiming to own the IP address of the Default Gateway (or another host)

2. Victim hosts receive the G-ARP and update their local ARP cache, mapping the Default Gateway's IP address to the attacker's MAC address.

3. Subsequent traffic intended for the Default Gateway is routed directly to the attacker

4. The attacker inspects/modifies the packet and forwards it to the actual gateway, completing a Man-in-the-Middle (MitM) attack

For Dynamic ARP Inspection (DAI), are port untrusted or trusted by default? Where should untrusted ports be placed?

• Untrusted Ports (Default): All ports are untrusted by default. DAI intercepts and validates incoming ARP messages on these ports.

  • Typical placement: Access ports connected to end hosts (PCs, printers, IP phones).

What does DAI do on trusted ports? Where should trusted ports be placed?

• Trusted Ports: DAI bypasses inspection on trusted ports and forwards all ARP messages unconditionally

  • Typical placement: Uplinks connected to other switches, routers, or network infrastructure

What are the 3 steps DAI goes through when inspecting an ARP message on an untrusted port?

1. Check 1 (Default): DAI inspects the Sender MAC and Sender IP in the ARP frame payload.

2. Database Lookup: DAI compares the pair against the DHCP Snooping Binding Table

3. Action:

   • Match found: Message is forwarded

   • No match / Mismatch: Message is dropped, and an error log is generated

How would the Sender MAC and Sender IP already be in the DHCP Snooping Binding Table?

When Dynamic ARP Inspection (DAI) inspects an ARP packet arriving on an untrusted port, it validates the Sender Hardware Address (Sender MAC) and Sender Protocol Address (Sender IP) embedded within the ARP payload against the DHCP Snooping Binding Table.

The pair exists in the table prior to the ARP check because DHCP Snooping operates at Layer 2 during the host's initial IP address acquisition, long before normal ARP communication begins.

How the Pair Enters the DHCP Snooping Binding Table

When a client device connects to the network and attempts to obtain an IP address via DHCP, the switch intercepts the full 4-step DHCP exchange on its switchport:

1. DHCPDISCOVER: The client sends a broadcast message to locate available DHCP servers.

2. DHCPOFFER: A DHCP server responds with an offered IP address.

3. DHCPREQUEST: The client requests the offered IP address from the server.

4. DHCPACK (The Trigger Point): The DHCP server sends an Acknowledgement to the client confirming the assignment of the IP address, lease time, default gateway, and DNS settings.

When the switch (with DHCP Snooping enabled) sees the DHCPACK packet returning from a trusted port destined for the client on an untrusted port, it extracts key metadata from the DHCP payload and writes a new entry into its local binding database.

Structure of a Binding Table Entry

Each dynamic entry recorded in the DHCP Snooping Binding Table includes the following bound parameters:

MAC Address	IP Address	Lease Time (sec)	Type	VLAN	Interface
00:50:56:AB:CD:12	192.168.1.105	86400	dhcp-snooping	10	Gi0/1

Because the switch parses the server's official DHCPACK payload, it verifies both the client's physical MAC address and the exact IP assigned by the DHCP server before binding them to the specific switch port (Gi0/1).

The Hand-off to DAI (Dynamic ARP Inspection)

Once the binding table entry is created, DAI uses this database as its authoritative "source of truth" to enforce ARP security.

+-----------------------------------------------------------------------------------+
| 1. Client completes DHCP exchange (DHCPACK)                                       |
| 2. Switch records: [ MAC: 0050.56AB.CD12 | IP: 192.168.1.105 | Port: Gi0/1 ]       |
+-----------------------------------------------------------------------------------+
                                        |
                                        v
+-----------------------------------------------------------------------------------+
| 3. Client later sends ARP Request/Response on Gi0/1                               |
|    Payload: Sender MAC = 0050.56AB.CD12, Sender IP = 192.168.1.105               |
+-----------------------------------------------------------------------------------+
                                        |
                                        v
+-----------------------------------------------------------------------------------+
| 4. DAI intercepts ARP packet on untrusted port Gi0/1                              |
| 5. DAI compares ARP payload (Sender MAC/IP) against Binding Table entry            |
| 6. Match found? -> PERMIT packet                                                 |
|    Mismatch / Spoofed? -> DROP packet & log security violation                    |
+-----------------------------------------------------------------------------------+

1. Normal Flow (Permitted): The host at Gi0/1 sends an ARP Request. DAI checks the Sender MAC (0050.56AB.CD12) and Sender IP (192.168.1.105) payload against the binding table for port Gi0/1. Since they match, the packet passes.

2. Spoofing Attempt (Dropped): An attacker on Gi0/1 sends a gratuitous ARP or ARP Response claiming to be 192.168.1.1 (the default gateway). DAI intercepts the ARP packet, compares Sender IP: 192.168.1.1 against Gi0/1's binding table entry (192.168.1.105), detects the mismatch, drops the packet, and logs a violation.

In order to DHCP in the first place, wouldn't it need to do ARP which means the binding table would not have the necessary information and the switch would block the frame because of DAI?

The short answer is no, because DHCP traffic does not use ARP during the initial IP address acquisition.

DAI (Dynamic ARP Inspection) only inspects ARP packets (Ethertype 0x0806). It does not inspect or drop standard IP packets, UDP packets, or DHCP messages (Ethertype 0x0800, UDP ports 67/68).

Because the entire initial 4-step DHCP exchange happens via UDP/IP broadcast without using ARP, the client completes its IP address lease before any ARP frames are ever generated.

How DHCP Obtains an IP Without Using ARP

Before a host has an IP address, it cannot perform ARP because ARP relies on having a source IP address to populate the "Sender IP" field. Instead, DHCP relies purely on Layer 2 MAC broadcasts and Layer 3 UDP messages:

1. DHCPDISCOVER:

   • Source MAC: Client MAC (0050.56AB.CD12) | Destination MAC: Broadcast (FFFF.FFFF.FFFF)

   • Source IP: 0.0.0.0 | Destination IP: 255.255.255.255

   • DAI Status: Ignored. This is a UDP/IP frame, not an ARP frame.

2. DHCPOFFER:

   • Server offers an IP (e.g., 192.168.1.105).

   • DAI Status: Ignored. This is a UDP/IP frame.

3. DHCPREQUEST:

   • Client requests to lease 192.168.1.105.

   • DAI Status: Ignored. This is a UDP/IP frame.

4. DHCPACK:

   • Server confirms the lease.

   • The Switch Intercepts This Packet: DHCP Snooping reads the DHCPACK returning on the trusted server port, notes Client MAC: 0050.56AB.CD12 and Assigned IP: 192.168.1.105, and creates the binding table entry.

Beyond checking the DHCP snooping table, DAI can perform deeper packet validation using the command ____________________.

Beyond checking the DHCP snooping table, DAI can perform deeper packet validation using the command ip arp inspection validate [dst-mac] [ip] [src-mac]

Describe the ‘dst-mac’ check option

Checks destination MAC in Ethernet header against Target MAC in ARP body (applies to ARP replies). Drops if mismatch.

Describe the ‘ip’ check option

Checks for invalid/unexpected IP addresses (e.g., 0.0.0.0, 255.255.255.255, or Multicast IPs).

Describe the ‘src-mac’ check option

Checks source MAC in Ethernet header against Sender MAC in ARP body. Drops if mismatch.

Critical Syntax Warning: Configuring multiple validation parameters sequentially overwrites previous entries! To enable multiple checks, you must specify all desired parameters in a single command line

note

What is the command to do the above mentioned config?

Switch(config)# ip arp inspection validate ip src-mac dst-mac

How can attackers attempt a DoS attack in relation to DAI?

Because DAI requires processing by the switch CPU, attackers can attempt a Denial of Service (DoS) attack by flooding ARP frames

What is the default packet limit per second on untrusted ports?

Untrusted Ports (Default): Enabled at 15 packets per second (pps)

What is the default packet limit per second on trusted ports?

Trusted Ports (Default): Rate limiting is disabled

What special feature does DAI offer in terms of rate limiting and burst intervals that DHCP snooping does not offer?

Burst Interval Feature: DAI allows defining a custom time window (x packets over y seconds), unlike DHCP snooping which only measures per-second intervals

What verification command lets you view the rate limiting and burst interval of the interfaces on the switch?

SW1# show ip arp inspection interfaces

What happens when a port exceeds the rate limit?

When a port exceeds the rate limit, it enters the err-disabled state

How can you manually re-enable the interface?

Manual: shutdown followed by no shutdown on the interface.

How can you automatically re-enable the interface?

Automatic: errdisable recovery cause arp-inspection

What happens to static IP addresses (eg. servers) in relation to the DHCP Snooping Binding Table and DAI?

Devices with static IP addresses (e.g., servers) won't have entries in the DHCP Snooping Binding Table. DAI will drop their legitimate ARP traffic.

How can we get DAI to not drop legitimate traffic from static sources?

An ARP Access Control List (ACL) must be configured.

What commands create the ARP ACL?

Switch(config)# arp access-list STATIC_SERVERS

Switch(config-arp-acl)# permit ip host 192.168.1.100 mac host 0011.2233.4455

What command applies the ARP ACL to DAI on the target VLAN?

Switch(config)# ip arp inspection filter STATIC_SERVERS vlan 1

DAI Configuration: What command enables DAI on specific VLANs (Required)?

Switch(config)# ip arp inspection vlan 1,10,20

DAI Configuration: What command configures an interface as trusted?

Switch(config)# interface gigabitethernet0/0

Switch(config-if)# ip arp inspection trust

DAI Configuration: What command configures custom rate limiting (25 packets per 2-second interval)?

Switch(config-if)# ip arp inspection limit rate 25 burst interval 2

DAI Configuration: What command enables optional validation checks (Must be entered on one line)?

Switch(config)# ip arp inspection validate ip src-mac dst-mac

DAI Configuration: What command enables automatic err-disable recovery for DAI?

Switch(config)# errdisable recovery cause arp-inspection

What verification command displays overall DAI status, enabled VLANs, validation settings, and frame statistics (forwarded/dropped)?

show ip arp inspection

What verification command verifies if automatic recovery is enabled for ARP inspection?

show errdisable recovery

What is the primary goal of DHCP Snooping vs Dynamic ARP Inspection?

Prevent Rogue DHCP Servers / DHCP Attacks

Prevent ARP Poisoning / MitM Attacks

What is the activation command for DHCP Snooping vs DAI?

ip dhcp snooping AND ip dhcp snooping vlan X

ip arp inspection vlan X (VLAN-only)

What is the default port state of DHCP Snooping vs DAI?

Untrusted

Untrusted

What is the default rate limiting of DHCP Snooping vs DAI?

Disabled on all ports

15 pps on untrusted ports (Disabled on trusted)