Security Fundamentals Intermediate ~6 min

DHCP snooping + Dynamic ARP Inspection

On SW1, protect VLAN 10 against rogue DHCP servers and ARP spoofing. Enable DHCP snooping globally and for VLAN 10, mark uplink Gi0/1 as trusted (real DHCP server sits upstream), and enable Dynamic ARP Inspection for VLAN 10 with the uplink also trusted for ARP.

Topology

SW1

Objectives

○DHCP snooping enabled globally
○DHCP snooping on VLAN 10
○Gi0/1 marked dhcp snooping trust
○ARP inspection on VLAN 10
○Gi0/1 marked arp inspection trust

Hints

Hint 1 — the model

Snooping/DAI default = all ports UNTRUSTED. You must explicitly trust the port that reaches the legitimate DHCP server (and switches upstream). Everything else drops rogue DHCP + forged ARP.

Hint 2 — full sequence

enable
configure terminal
 ip dhcp snooping
 ip dhcp snooping vlan 10
 ip arp inspection vlan 10
 interface gi0/1
  ip dhcp snooping trust
  ip arp inspection trust
  end

← Previous task

Write a standard numbered ACL

Security Fundamentals · ~6 min

Next task →

Secure VTY lines for SSH only

Security Fundamentals · ~6 min