Security Fundamentals Build ~5 min

Dynamic ARP Inspection (DAI): trust ports + validation

Access ports face users; Gi0/1 is the uplink to the real DHCP server. Secure VLAN 10: turn on DHCP snooping globally, enable it on VLAN 10, enable DAI for VLAN 10, and mark Gi0/1 as trusted for both. DAI reads DHCP snooping's binding table. It can't run without snooping.

Topology

SW1

Objectives

○DHCP snooping enabled globally
○DHCP snooping on VLAN 10
○Gi0/1 trusted for DHCP snooping
○Dynamic ARP Inspection on VLAN 10
○Gi0/1 trusted for ARP inspection

Hints

Hint 1, why trust the uplink

Snooping and DAI both drop DHCP / ARP that comes in on untrusted ports. Your real DHCP server sits behind Gi0/1, so if you don't trust that port the switch will drop the server's DHCPOFFERs, and legitimate ARP replies from the default gateway will be silently blackholed too.

Hint 2, verify it later

After you're done, run show ip dhcp snooping and show ip arp inspection. Both should list VLAN 10 as operational and Gi0/1 as trusted.

Hint 3, full sequence

enable
configure terminal
 ip dhcp snooping
 ip dhcp snooping vlan 10
 ip arp inspection vlan 10
 interface gi0/1
  ip dhcp snooping trust
  ip arp inspection trust
  end

← Previous task

Write a standard numbered ACL

Security Fundamentals · ~6 min

Next task →

DHCP snooping + Dynamic ARP Inspection

Security Fundamentals · ~6 min

Stuck on a lab, or not sure what to practice next?

Talk it through with a mentor on a free 20-minute call. We look at your lab, your exam date and your weak spots, and you leave with a plan.

Book free session

Cisco Mentorship

CompTIA Foundation

Firewall Security

Short Courses

More

CCNA v1.1

CCNA v2.0

CCNA Automation

CCNP

Network+

NSE 4

Lab Tasks

Videos

Packet Tracer Labs

Simulators

Dynamic ARP Inspection (DAI): trust ports + validation

Stuck on a lab, or not sure what to practice next?