9.1 DHCP Snooping and Dynamic ARP Inspection

DHCP Snooping and Dynamic ARP Inspection

Quick Summary: Standard Ethernet networks operate on an implicit trust model where any connected endpoint can broadcast network control messages. Attackers exploit this design by introducing rogue DHCP servers or broadcasting fraudulent Address Resolution Protocol (ARP) responses to execute Man-in-the-Middle (MitM) and Denial-of-Service (DoS) attacks. DHCP Snooping mitigates rogue DHCP servers by categorizing switch ports into trusted and untrusted interfaces and dynamically building a secure binding database. Dynamic ARP Inspection (DAI) leverages this binding table to intercept and validate ARP packets on untrusted ports, ensuring that Layer 2 MAC addresses match authorized Layer 3 IP assignments.

---

The Layer 2 Threat Landscape: Rogue DHCP and ARP Spoofing

Within a standard broadcast domain, client devices broadcast requests to discover network infrastructure services. Because Layer 2 switches forward broadcast frames out all active ports within a VLAN by default, any host can listen to or respond to these discovery broadcasts.

The Threat of Rogue DHCP Servers

When an endpoint joins an Ethernet network, it broadcasts a DHCP Discover message. Any DHCP server residing in that broadcast domain can respond with a DHCP Offer. A rogue DHCP server—whether placed intentionally by an attacker or accidentally by an employee connecting an unmanaged wireless router—introduces severe security vulnerabilities:

• Man-in-the-Middle (MitM) Traffic Redirection: The rogue server responds faster than the legitimate enterprise DHCP server, supplying client devices with a fraudulent default gateway address (pointing to the attacker's workstation). All outbound client traffic is intercepted, analyzed, or altered before being forwarded upstream.
• DNS Hijacking: The rogue server assigns the IP address of an attacker-controlled DNS server, redirecting users to phishing portals or credential-harvesting clones of corporate services.
• Denial of Service (DoS): The rogue server leases invalid IP configurations (such as an incorrect subnet mask or unroutable gateway), completely severing client connectivity.
• DHCP Starvation Attacks: An attacker uses automated tools (such as Yersinia) to flood the legitimate DHCP server with thousands of DHCP Discover messages containing randomized MAC addresses. This exhausts the available IP scope, preventing legitimate enterprise devices from acquiring network access.

ARP Protocol Vulnerabilities and Cache Poisoning

The Address Resolution Protocol (ARP, RFC 826) maps known Layer 3 IPv4 addresses to dynamic Layer 2 Ethernet MAC addresses. However, ARP possesses no built-in authentication mechanisms:

• Stateless and Unverified: Devices process and cache ARP replies even if they never transmitted a corresponding ARP request.
• Gratuitous ARP Poisoning: An attacker can transmit an unsolicited Gratuitous ARP (GARP) frame asserting that the default gateway's IP address is now associated with the attacker's own MAC address. The victim workstation and the default gateway both update their local ARP caches with this forged binding.
• Traffic Interception: Outbound packets from the victim to external networks are delivered directly to the attacker's switch port at Layer 2. The attacker enables IP forwarding to relay packets to the real gateway, eavesdropping on unencrypted traffic without the victim detecting connection disruption.

---

DHCP Snooping Operational Mechanics

DHCP Snooping acts as a Layer 2 perimeter firewall on the access switch, inspecting DHCP control messages exchanged between clients and servers. It operates by enforcing a strict classification of physical switch ports:

+---------------------------------------------------------------------------------------------------------+
|                                      DHCP SNOOPING PORT ARCHITECTURE                                    |
|                                                                                                         |
|     [ Untrusted Port 1/1/1 ] --------> Client Workstation (Permits DHCP Discover / Request)            |
|                                       (DISCARDS Rogue DHCP Offer / ACK / NAK Frames!)                   |
|                                                                                                         |
|     [ AOS-CX Access Switch ] --------> Maintains DHCP Snooping Binding Table in Hardware                |
|                                       [ MAC | IP | Lease | Type | VLAN | Port ]                         |
|                                                                                                         |
|     [ Trusted Port 1/1/48 ] ---------> Uplink to Enterprise DHCP Server / Core Router                  |
|                                       (Permits all DHCP messages: Discover, Offer, Request, ACK)       |
+---------------------------------------------------------------------------------------------------------+

Trusted vs. Untrusted Ports

1. Untrusted Ports:

   • By default, once DHCP Snooping is enabled on a VLAN, all switch ports in that VLAN operate in untrusted mode.
   • Untrusted ports connect to edge endpoints: user laptops, desktop workstations, printers, and standard IoT devices.
   • Allowed Ingress Traffic: Client-originated DHCP messages, including DHCPDISCOVER, DHCPREQUEST, DHCPDECLINE, and DHCPRELEASE.
   • Blocked Ingress Traffic: Server-originated DHCP messages, including DHCPOFFER, DHCPACK, and DHCPNAK. If an untrusted port receives a server-generated frame, the switch immediately discards the frame, increments a security violation counter, and generates an administrative log.

2. Trusted Ports:

   • Network engineers must explicitly configure uplinks connecting to legitimate enterprise DHCP servers, DHCP relay agents, or upstream aggregation/core switches as trusted.
   • Allowed Ingress Traffic: All DHCP messages (both client requests and server responses) flow unimpeded without filtering.

The DHCP Snooping Binding Database

As legitimate endpoints complete the four-step DHCP transaction (DORA: Discover, Offer, Request, ACK) across untrusted ports and trusted uplinks, the access switch snoops the passing frames. Upon observing a valid DHCPACK returning from a trusted port, the switch dynamically records an entry in the DHCP Snooping Binding Table:

The switch maintains this table dynamically: when a client gracefully disconnects via DHCPRELEASE or the lease timer expires, the corresponding binding is removed. If a device uses a static IP address, an administrator can manually configure a static binding entry.

DHCP Option 82 Support

DHCP Snooping also supports DHCP Option 82 (Relay Agent Information Option). When an access switch intercepts a DHCP Discover on an untrusted port, it can append sub-options identifying the client's physical switch chassis, module, and port (Circuit ID) and switch identifier (Remote ID). The upstream DHCP server uses this metadata to allocate specific IP subnets or lease policies based on physical switch port locations.

---

Dynamic ARP Inspection (DAI) Mechanics

While DHCP Snooping protects the initial address acquisition process, Dynamic ARP Inspection (DAI)—referred to as ARP Protection in some AOS-S documentation and ARP Inspection in AOS-CX—secures ongoing Layer 2 to Layer 3 address resolution.

Validation Process on Untrusted Ports

DAI intercepts all ARP Request and ARP Reply frames arriving on untrusted switch ports. Before forwarding an ARP packet, the switch hardware compares the sender information stored inside the ARP packet payload against the verified DHCP Snooping Binding Table:

1. Payload Inspection: The switch extracts the Sender Hardware Address (SHA) and Sender Protocol Address (SPA) from the ARP payload.
2. Binding Table Lookup: The switch queries its internal database to verify if an active entry exists linking that exact MAC address (SHA) to that exact IP address (SPA) on that specific ingress interface and VLAN.
3. Forwarding Decision:
   • Valid Match: The ARP frame is forwarded out normal switch ports.
   • Invalid or Missing Entry: If the IP-MAC pairing does not match an active lease, or if no entry exists for that host, the frame is dropped immediately, and a security violation is logged.

Trusted Ports in DAI

Just as with DHCP Snooping, interfaces connecting to upstream default gateways, core switches, and trusted servers are configured as ARP Inspection Trusted. ARP packets received on trusted ports bypass inspection entirely, minimizing latency and eliminating switch CPU overhead on high-throughput uplinks.

Protecting the CPU

Because ARP inspection sends ARP packets to the switch CPU for validation, a flood of ARP traffic is also a CPU-protection concern. AOS-CX protects its control plane with control-plane policing (CoPP) and lets you cap broadcast traffic per port with rate-limit broadcast <rate> pps; there is no separate ARP-inspection rate-limit command to memorize for this exam.

---

Technical Comparison: DHCP Snooping vs. Dynamic ARP Inspection

---

AOS-CX Configuration Commands and Verification

The following AOS-CX 10.14 configuration enables DHCP snooping and Dynamic ARP Inspection on VLANs 10 and 20 and trusts the aggregation uplink. (Releases before 10.14 used the keyword dhcpv4-snooping.)

switch# configure terminal

! Step 1: Globally enable DHCP Snooping, then enable it per VLAN (VLAN context)
switch(config)# dhcp-snooping
switch(config)# vlan 10
switch(config-vlan-10)# dhcp-snooping
switch(config-vlan-10)# arp inspection
switch(config-vlan-10)# exit
switch(config)# vlan 20
switch(config-vlan-20)# dhcp-snooping
switch(config-vlan-20)# arp inspection
switch(config-vlan-20)# exit

! Step 2: Configure the Uplink Port to Aggregation/Core Switch as Trusted
switch(config)# interface 1/1/48
switch(config-if)# description Uplink-to-Campus-Core
switch(config-if)# no routing
switch(config-if)# vlan trunk allowed 10,20
switch(config-if)# dhcp-snooping trust
switch(config-if)# arp inspection trust
switch(config-if)# exit

! Step 3: Edge access ports stay untrusted (the default)
switch(config)# interface 1/1/1-1/1/24
switch(config-if-<1/1/1-1/1/24>)# no routing
switch(config-if-<1/1/1-1/1/24>)# vlan access 10
switch(config-if-<1/1/1-1/1/24>)# exit

Essential Verification Commands

---

Common Exam Traps

• DAI Dependency on DHCP Snooping: A classic exam question asks why legitimate dynamic clients lose network connectivity immediately after enabling DAI. If an administrator enables DAI before DHCP Snooping has populated the binding database, the switch drops all client ARP requests because no bindings exist! DHCP Snooping must be active and populated first.
• Omitting Uplink Trust: Forgetting to configure dhcp-snooping trust on switch uplinks prevents all downstream clients from receiving IP addresses because legitimate DHCPOFFER and DHCPACK packets from the core DHCP server are dropped at the access switch uplink.
• Untrusted Port Misconceptions: Untrusted ports do not block all DHCP traffic; they specifically permit client-originated requests (DHCPDISCOVER, DHCPREQUEST) and block server-originated responses.