Security Fundamentals Build ~5 min

Dynamic ARP Inspection (DAI) — trust ports + validation

Access ports face users; Gi0/1 is the uplink to the real DHCP server. Secure VLAN 10: turn on DHCP snooping globally, enable it on VLAN 10, enable DAI for VLAN 10, and mark Gi0/1 as trusted for both. DAI reads DHCP snooping's binding table — it can't run without snooping.

Topology

SW1

Objectives

○DHCP snooping enabled globally
○DHCP snooping on VLAN 10
○Gi0/1 trusted for DHCP snooping
○Dynamic ARP Inspection on VLAN 10
○Gi0/1 trusted for ARP inspection

Hints

Hint 1 — why trust the uplink

Snooping and DAI both drop DHCP / ARP that comes in on untrusted ports. Your real DHCP server sits behind Gi0/1, so if you don't trust that port the switch will drop the server's DHCPOFFERs — and legitimate ARP replies from the default gateway will be silently blackholed too.

Hint 2 — verify it later

After you're done, run show ip dhcp snooping and show ip arp inspection. Both should list VLAN 10 as operational and Gi0/1 as trusted.

Hint 3 — full sequence

enable
configure terminal
 ip dhcp snooping
 ip dhcp snooping vlan 10
 ip arp inspection vlan 10
 interface gi0/1
  ip dhcp snooping trust
  ip arp inspection trust
  end

← Previous task

Write a standard numbered ACL

Security Fundamentals · ~6 min

Next task →

DHCP snooping + Dynamic ARP Inspection

Security Fundamentals · ~6 min