Protect an access VLAN with DHCP snooping, DAI and IP Source Guard

Cisco IOSWorking

On access switch ASW1, stop rogue DHCP servers and ARP spoofing in VLAN 10 and lock each access port to the address it was given, without breaking the static-IP printer or the IOS DHCP relay on DSW1.

Item	Value
VLAN 10	10.10.10.0/24, gateway 10.10.10.1 on DSW1
DHCP	SVI Vlan10 on DSW1 relays with `ip helper-address 10.10.50.20`
PC1	MAC 0050.5689.1a2b, DHCP
PRN1	MAC 0050.5689.0005, static 10.10.10.5
Uplink	ASW1 Gi1/0/48 trunk to DSW1

Tasks

Enable DHCP snooping for VLAN 10, trust only the uplink, and rate-limit DHCP on access ports to 15 packets per second.
Make sure option 82 does not break the IOS relay on DSW1, and keep the binding table across reloads.
Enable Dynamic ARP Inspection for VLAN 10 with all three validation checks, trusting only the uplink.
Allow the static printer through DAI with an ARP ACL.
Enable IP Source Guard on the PC and printer ports.
Recover err-disabled ports automatically after 5 minutes.

Solution

1DHCP snoopingASW1

ASW1 on Cisco IOS

ip dhcp snooping vlan 10
no ip dhcp snooping information option
ip dhcp snooping database flash:dhcp-snooping.db
ip dhcp snooping
!
interface GigabitEthernet1/0/48
 description Uplink to DSW1
 ip dhcp snooping trust
!
interface range GigabitEthernet1/0/1 - 46
 ip dhcp snooping limit rate 15

Without no ip dhcp snooping information option, ASW1 inserts option 82 with a zero giaddr and the IOS relay on DSW1 drops the requests. Let the binding table fill (clients renew at half their lease time) before moving on to DAI.

2Dynamic ARP InspectionASW1
ASW1 on Cisco IOS
```
ip arp inspection vlan 10
ip arp inspection validate src-mac dst-mac ip
!
interface GigabitEthernet1/0/48
 ip arp inspection trust
```
All three validation keywords go in one command; a second validate line replaces the first. Untrusted ports keep the default limit of 15 ARP packets per second.
3ARP ACL for the static printerASW1
ASW1 on Cisco IOS
```
arp access-list STATIC-HOSTS
 permit ip host 10.10.10.5 mac host 0050.5689.0005
!
ip arp inspection filter STATIC-HOSTS vlan 10
```
Without the static keyword on the filter, DAI checks the ACL first and then still falls back to the DHCP bindings for everyone else.
4IP Source GuardASW1
ASW1 on Cisco IOS
```
ip source binding 0050.5689.0005 vlan 10 10.10.10.5 interface GigabitEthernet1/0/6
!
interface GigabitEthernet1/0/5
 ip verify source
interface GigabitEthernet1/0/6
 ip verify source
```
The static binding gives the printer an entry that DHCP never will. To check the MAC as well as the IP, Catalyst 9000 uses ip verify source mac-check; older Catalyst releases use ip verify source port-security together with port security.

5Err-disable recoveryASW1

ASW1 on Cisco IOS

errdisable recovery cause dhcp-rate-limit
errdisable recovery cause arp-inspection
errdisable recovery interval 300

Verify

ASW1 output

ASW1# show ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:50:56:89:1A:2B   10.10.10.51      691140      dhcp-snooping   10    GigabitEthernet1/0/5
Total number of bindings: 1

PC1 is bound to its lease on Gi1/0/5. The printer does not appear here because it never uses DHCP; its static entry is used by IPSG instead.

ASW1 output

ASW1# show ip arp inspection vlan 10
Source Mac Validation      : Enabled
Destination Mac Validation : Enabled
IP Address Validation      : Enabled

 Vlan     Configuration    Operation   ACL Match          Static ACL
 ----     -------------    ---------   ---------          ----------
   10     Enabled          Active      STATIC-HOSTS       No

 Vlan     ACL Logging      DHCP Logging      Probe Logging
 ----     -----------      ------------      -------------
   10     Deny             Deny              Off

DAI is active on VLAN 10 with all checks, the ARP ACL is attached, and Static ACL is No, so DHCP bindings are used too.

ASW1 output

ASW1# show ip verify source
Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan
---------  -----------  -----------  ---------------  -----------------  ----
Gi1/0/5    ip           active       10.10.10.51                         10
Gi1/0/6    ip           active       10.10.10.5                          10

Each port accepts only its own source IP. Anything else sent from those ports is dropped in hardware.

ASW1 output

ASW1# show logging | include DAI
%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Res) on Gi1/0/5, vlan 10.([0050.5689.1a2b/10.10.10.1/0050.5689.0005/10.10.10.5/09:12:44 UTC Tue Nov 10 2026])

During an approved test, a forged ARP reply from PC1 claiming the gateway address 10.10.10.1 was dropped. The binding for Gi1/0/5 says 10.10.10.51, not 10.10.10.1.

Mistakes people make

Forgetting to trust the uplink for both snooping and DAI. Every lease and every gateway ARP reply is dropped.
Leaving option 82 insertion on toward an IOS relay, which silently drops all requests.
Enabling DAI or IPSG before the binding table is populated, which cuts off clients whose leases predate snooping.
Forgetting static hosts. The printer has no binding and loses ARP and IP connectivity.
No snooping database, so a reload empties the table and blocks everyone until they renew.
Rolling all three features onto every switch at once instead of piloting one VLAN.

Say it in the interview

"DHCP snooping goes first: trust only the uplink, rate-limit the access ports, turn off option 82 toward the IOS relay, and save the bindings to flash. Once the table is full, DAI checks every ARP on untrusted ports against it, with an ARP ACL for the static printer. IP Source Guard last, so each port can only send from the address it was given. Then I prove it with the binding table and a controlled spoof test."

Book 3.3 Internet (IP)