PracticeVideosBlogFlashcardsEspañol

Free exam prep

CCNP Enterprise

Practice QuestionsStudy Guide

16.4 Layer 2 Infrastructure Security Features

Key Takeaways

  • DHCP Snooping operates as a stateful Layer 2 security barrier distinguishing trusted uplink ports from untrusted access ports, dropping rogue DHCP server messages (Offer/ACK), inserting Option 82 metadata, and constructing the authoritative DHCP Snooping Binding Database.
  • Dynamic ARP Inspection (DAI) prevents ARP poisoning and Man-in-the-Middle (MitM) attacks by intercepting and validating all ARP requests and replies on untrusted ports against the DHCP Snooping database and static ARP ACLs.
  • IP Source Guard (IPSG) prevents IPv4 address spoofing by dynamically programming hardware Port ACLs (PACLs) based on DHCP snooping bindings in IP-only or IP-and-MAC filtering modes (requiring Port Security).
  • Port Security restricts unauthorized MAC addresses per switchport across three distinct violation modes: Protect (silent drop), Restrict (drop with SNMP trap and syslog generation), and Shutdown (immediate transition to err-disabled state).
  • IPv6 First-Hop Security (FHS) shields local access domains against rogue SLAAC routers and rogue DHCPv6 servers using IPv6 RA Guard and IPv6 DHCPv6 Guard policies applied at the switchport or VLAN level.
Last updated: August 2026

16.3 Layer 2 Infrastructure Security Features

Core Blueprint Focus: Cisco 350-401 ENCOR v1.2 topic 5.2 (infrastructure security features) requires candidates to configure and verify Layer 2 security features. Candidates must master the interconnected security suite comprising DHCP Snooping (trusted vs. untrusted ports, Option 82 insertion, binding database persistence), Dynamic ARP Inspection (DAI, ARP validation, static ARP ACLs, rate limiting), IP Source Guard (IPSG in IP and IP+MAC modes), Port Security (static, dynamic, sticky MACs, violation modes: Protect, Restrict, Shutdown), and IPv6 First-Hop Security (RA Guard and DHCPv6 Guard).

Local Area Networks (LANs) built on Ethernet switching are inherently vulnerable to broadcast and identity manipulation attacks. Because standard Layer 2 switches forward frames based solely on destination MAC addresses without validating source identity, malicious actors on an access port can launch DHCP Starvation, deploy Rogue DHCP Servers, poison neighbor ARP caches (Man-in-the-Middle / ARP Spoofing), spoof trusted IP/MAC addresses, or overwhelm switch CAM tables with millions of bogus MAC addresses (MAC Flooding).

Cisco IOS-XE addresses these vulnerabilities through an integrated, defense-in-depth Layer 2 security architecture where DHCP Snooping serves as the foundational telemetry engine feeding the DHCP Snooping Binding Database, which in turn powers Dynamic ARP Inspection (DAI) and IP Source Guard (IPSG).

+---------------------------------------------------------------------------------------------------+
|                         LAYER 2 DEFENSE-IN-DEPTH SECURITY HIERARCHY                               |
+---------------------------------------------------------------------------------------------------+
|                                                                                                   |
|  [ IP SOURCE GUARD (IPSG) ]                   [ DYNAMIC ARP INSPECTION (DAI) ]                    |
|   - Blocks IP & MAC Address Spoofing           - Blocks ARP Cache Poisoning & MitM Attacks        |
|   - Builds Dynamic Port ACLs (PACLs)           - Validates ARP Requests & Replies on Untrusted    |
|   - Filters unauthorized Source IPs            - Checks 'src-mac', 'dst-mac', and 'ip' payloads   |
|                 \                                            /                                    |
|                  \                                          /                                     |
|                   +----------------------------------------+                                      |
|                   |   DHCP SNOOPING BINDING DATABASE       |                                      |
|                   |   (MAC, IP, Lease, VLAN, Interface)    |                                      |
|                   +----------------------------------------+                                      |
|                                       ^                                                           |
|                                       |                                                           |
|  [ DHCP SNOOPING ] -------------------+                                                           |
|   - Differentiates Trusted (Uplinks/Servers) vs Untrusted (Access Endpoints) Ports                |
|   - Drops Rogue DHCP Offer / ACK / NAK Frames on Untrusted Ports                                  |
|   - Inserts Option 82 Relay Information (Circuit ID & Remote ID)                                  |
|   - Rate-Limits DHCP Requests to Prevent Pool Starvation                                          |
|                                                                                                   |
|  [ PORT SECURITY ]                                    [ IPv6 FIRST-HOP SECURITY (FHS) ]           |
|   - Limits MAC count per port (1-1024)                 - IPv6 RA Guard (Blocks Rogue RAs)         |
|   - Static, Dynamic, and Sticky MAC Learning           - IPv6 DHCPv6 Guard (Blocks Rogue Servers) |
|   - Modes: Protect, Restrict, Shutdown (err-disable)   - IPv6 ND Inspection & Binding Table       |
+---------------------------------------------------------------------------------------------------+

1. DHCP Snooping & Option 82 Mechanics

DHCP Snooping operates as a stateful Layer 2 packet inspection engine that intercepts all DHCP broadcast and unicast messages on a per-VLAN basis.

Trusted vs. Untrusted Ports

  • Trusted Ports (ip dhcp snooping trust): Configured on switch uplinks, trunk ports, and interfaces directly connected to authorized DHCP servers. Trusted ports are permitted to receive and forward all DHCP message types, including server responses (DHCP Offer, DHCP ACK, DHCP NAK).
  • Untrusted Ports (Default State): All access ports connected to end-user devices, printers, and unmanaged switches. Untrusted ports are permitted to transmit only client DHCP requests (DHCP Discover, DHCP Request, DHCP Release, DHCP Decline). If a DHCP Offer or DHCP ACK arrives on an untrusted port, the switch immediately drops the packet, logs a security alert, and does not forward it, neutralizing rogue DHCP servers.
+---------------------------------------------------------------------------------------------------+
|                         DHCP SNOOPING OPERATIONAL RULESET                                         |
+---------------------------------------------------------------------------------------------------+
|  Packet Received on Untrusted Port    | Condition / Inspection Check          | Switch Action     |
| :------------------------------------ | :------------------------------------ | :---------------- |
| **DHCP Offer / ACK / NAK**            | Any DHCP server response message       | **DROP & LOG**     |
| **DHCP Discover / Request**           | Source MAC != DHCP Client HW Address  | **DROP & LOG**     |
| **DHCP Release / Decline**            | IP/MAC/Port does NOT match DB entry   | **DROP & LOG**     |
| **DHCP Discover / Request**           | Rate exceeds `limit rate <pps>`       | **ERR-DISABLE**   |
| **Valid DHCP Discover / Request**     | Legitimate client request             | **INSERT OPT 82 &**|
|                                       |                                       | **FORWARD**       |
+---------------------------------------------------------------------------------------------------+

The DHCP Snooping Binding Database

When a legitimate client completes the four-way DHCP DORA exchange (Discover, Offer, Request, ACK), the switch snoops the DHCP ACK on the trusted uplink and extracts the negotiated parameters to create an entry in the DHCP Snooping Binding Database:

  • Client MAC Address
  • Assigned IPv4 Address
  • Lease Duration (seconds)
  • Binding Type (DHCP dynamic vs. static)
  • VLAN ID
  • Physical Interface / Switchport
Switch# show ip dhcp snooping binding
MacAddress          IP Address       Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:50:56:A1:22:33   192.168.10.45    86400       dhcp-snooping  10    GigabitEthernet1/0/1
00:50:56:B4:88:99   192.168.10.46    86400       dhcp-snooping  10    GigabitEthernet1/0/2
Total number of bindings: 2

[!TIP] Binding Database Persistence: By default, the binding database resides solely in volatile RAM and is lost upon switch reboot. In production environments, database persistence must be configured using an external TFTP/FTP/SFTP server or local flash storage (ip dhcp snooping database flash:dhcp-snoop.db).

DHCP Option 82 (Relay Agent Information Option)

When DHCP Snooping is enabled, the edge switch automatically inserts DHCP Option 82 into client DHCP Discover and Request packets before forwarding them upstream:

  • Circuit ID Sub-Option: Identifies the physical ingress port and VLAN (e.g., Module 1, Port 1, VLAN 10).
  • Remote ID Sub-Option: Identifies the switch hardware (typically the switch base MAC address).
+---------------------------------------------------------------------------------------------------+
|                         OPTION 82 DEFAULT FORWARDING ISSUE (giaddr = 0.0.0.0)                     |
+---------------------------------------------------------------------------------------------------+
|                                                                                                   |
|  Client PC                  Access Switch (Layer 2)                 Core Router / DHCP Server     |
|  [Untrusted]                [DHCP Snooping Enabled]                 [Default RFC 3046 Policy]     |
|      |                                 |                                         |                |
|      |-- 1. DHCP Discover -----------> |                                         |                |
|      |   (giaddr = 0.0.0.0)            |-- 2. Inserts Option 82 ---------------> |                |
|      |                                 |   (Leaves giaddr = 0.0.0.0)             |                |
|      |                                 |                                         x (DROPPED!)     |
|      |                                 |                                                          |
|  * PROBLEM: RFC 3046 specifies that an un-routed packet (giaddr = 0.0.0.0) containing Option 82   |
|    must be dropped by downstream switches/routers as untrusted.                                   |
|                                                                                                   |
|  * SOLUTION 1 (On Access Switch):  'no ip dhcp snooping information option'                      |
|  * SOLUTION 2 (On Core Router/SW): 'ip dhcp snooping information option allow-untrusted'         |
|                                    or 'ip dhcp relay information trust-all'                      |
+---------------------------------------------------------------------------------------------------+

2. Dynamic ARP Inspection (DAI) & Static ARP ACLs

Address Resolution Protocol (ARP) lacks authentication. An attacker can transmit gratuitous ARP replies asserting their MAC address is associated with the default gateway IP, redirecting all subnet traffic through the attacker's machine (ARP Poisoning / Man-in-the-Middle).

Dynamic ARP Inspection (DAI) validates all ARP Requests and Replies on untrusted ports before forwarding them:

  1. When an ARP packet arrives on an untrusted port, DAI extracts the Sender MAC and Sender IP from the ARP payload.
  2. DAI queries the DHCP Snooping Binding Database for a matching MAC-to-IP binding on that specific VLAN and port.
  3. If a valid binding exists, the ARP packet is forwarded. If the binding is missing or mismatched, the packet is discarded and logged.
+---------------------------------------------------------------------------------------------------+
|                         DYNAMIC ARP INSPECTION (DAI) VALIDATION FLOW                              |
+---------------------------------------------------------------------------------------------------+
|                                                                                                   |
|  Incoming ARP Packet on Untrusted Port (Sender IP: 192.168.10.45, Sender MAC: 0050.56A1.2233)     |
|                                      |                                                            |
|                                      v                                                            |
|  [ STEP 1: STATIC ARP ACL CHECK ] -> Does an 'arp access-list' filter exist for this VLAN?        |
|       |                                                                                           |
|       +-- YES: Matches Static ARP ACL? ----> (MATCH: Permit & Forward / NO MATCH: Drop)           |
|       |                                                                                           |
|       +-- NO / FALLTHROUGH: Proceed to Step 2                                                     |
|                                      v                                                            |
|  [ STEP 2: DHCP SNOOPING BINDING DB CHECK ]                                                       |
|   - Looks up 192.168.10.45 + 0050.56A1.2233 + VLAN 10 in Snooping Table                          |
|       |                                                                                           |
|       +-- MATCH FOUND: Forward ARP Packet                                                         |
|       +-- NO MATCH / MISMATCH: SILENT DROP & INCREMENT DAI LOG COUNTER                            |
+---------------------------------------------------------------------------------------------------+

Static ARP ACLs for Non-DHCP Endpoints

Statically addressed servers, printers, or appliances do not participate in DHCP and therefore lack entries in the DHCP Snooping database. To prevent DAI from dropping their legitimate ARP packets, administrators configure Static ARP ACLs:

! Configure Static ARP ACL for Static Servers
arp access-list STATIC-SERVER-ARP-ACL
 permit ip host 192.168.10.10 mac host 0050.56a1.0010
 permit ip host 192.168.10.11 mac host 0050.56a1.0011
!
! Apply Static ARP ACL to Dynamic ARP Inspection on VLAN 10
ip arp inspection filter STATIC-SERVER-ARP-ACL vlan 10

Additional DAI Payload Validation Checks

DAI can enforce strict Layer 2/Layer 3 header alignment beyond simple binding table lookups using ip arp inspection validate:

  • src-mac: Checks the Sender MAC in the ARP payload against the Ethernet source MAC in the frame header. Drops if mismatched.
  • dst-mac: Checks the Target MAC in the ARP payload against the Ethernet destination MAC in the frame header (for ARP replies). Drops if mismatched.
  • ip: Validates that the Sender IP is not a broadcast (255.255.255.255), multicast (224.0.0.0/4), or loopback/invalid address (0.0.0.0).
! Enable strict multi-attribute ARP validation
Switch(config)# ip arp inspection validate src-mac dst-mac ip

DAI Rate Limiting & Err-Disable Recovery

To prevent an attacker from DoSing the switch CPU with thousands of bogus ARP packets (which must be inspected by the CPU), untrusted ports enforce a default rate limit of 15 packets per second (pps):

  • If the ARP rate exceeds the threshold, the port transitions to err-disabled state.
  • Automated recovery: errdisable recovery cause arp-inspection with errdisable recovery interval 300.
Loading diagram...
Dynamic ARP Inspection and DHCP Snooping Defense Sequence

3. IP Source Guard (IPSG) & Port Security

IP Source Guard (IPSG)

IP Source Guard (IPSG) prevents an attacker from injecting traffic with a spoofed source IP or MAC address. IPSG dynamically constructs and applies hardware Port Access Control Lists (PACLs) to untrusted switchports based directly on the DHCP Snooping Binding Database:

+---------------------------------------------------------------------------------------------------+
|                             IP SOURCE GUARD (IPSG) OPERATIONAL MODES                              |
+---------------------------------------------------------------------------------------------------+
|  IPSG Filtering Mode    | Configuration Command           | Prerequisite & Enforced Behavior      |
| :---------------------- | :------------------------------ | :------------------------------------ |
| **IP Filtering Only**   | `ip verify source`              | Requires DHCP Snooping. Drops any     |
|                         |                                 | ingress IP packet whose source IP does|
|                         |                                 | not match the snooping table.         |
| **IP + MAC Filtering**  | `ip verify source port-security`| Requires **BOTH DHCP Snooping AND     |
|                         |                                 | Port Security**. Drops packets whose  |
|                         |                                 | source IP OR source MAC does not match|
|                         |                                 | the combined snooping/port-sec tables.|
+---------------------------------------------------------------------------------------------------+

Port Security Architecture & Violation Modes

Port Security restricts the number and identity of MAC addresses allowed to transmit frames on an access interface:

  • Static MACs: Explicitly defined by the administrator (switchport port-security mac-address <mac>). Stored in the running-config.
  • Dynamic MACs: Learned from the source MAC of incoming frames and stored in the MAC address table in RAM. Lost upon switch reboot or MAC aging.
  • Sticky MACs: Learned dynamically upon frame arrival and automatically written into the active running-config (switchport port-security mac-address sticky). Survives reboots if the configuration is saved.
+---------------------------------------------------------------------------------------------------+
|                         PORT SECURITY VIOLATION MODES DETAILED COMPARISON                         |
+---------------------------------------------------------------------------------------------------+
|  Violation Mode | Packet Forwarding Action | Counter Incremented? | Syslog / SNMP Trap? | Port State  |
| :-------------- | :----------------------- | :------------------- | :------------------ | :---------- |
| **Protect**     | **Drops** unauthorized   | **NO**               | **NO**              | Stays **UP**|
|                 | frames silently          |                      |                     |             |
| **Restrict**    | **Drops** unauthorized   | **YES**              | **YES**             | Stays **UP**|
|                 | frames                   |                      |                     |             |
| **Shutdown**    | **Drops** all traffic;   | **YES**              | **YES**             | **DOWN**    |
| *(Default)*     | disables entire port     |                      |                     | `err-disable`|
+---------------------------------------------------------------------------------------------------+

4. IPv6 First-Hop Security (FHS): RA Guard & DHCPv6 Guard

In IPv6 networks, endpoints utilize Stateless Address Autoconfiguration (SLAAC) via ICMPv6 Router Advertisement (RA) messages (Type 134) transmitted by default routers. A rogue device transmitting malicious RA messages can rewrite default gateways and DNS servers for all subnet hosts.

+---------------------------------------------------------------------------------------------------+
|                         IPv6 FIRST-HOP SECURITY (FHS) DEFENSE SUITE                               |
+---------------------------------------------------------------------------------------------------+
|  FHS Feature            | Target Threat & Attack Vector   | Enforcement Mechanism                 |
| :---------------------- | :------------------------------ | :------------------------------------ |
| **IPv6 RA Guard**       | Rogue IPv6 Routers / SLAAC      | Intercepts ICMPv6 Type 134 (RA) and   |
|                         | Hijacking / Malicious Prefixes  | Type 137 (Redirect) on untrusted      |
|                         |                                 | ports; drops unauthorized RAs.        |
| **IPv6 DHCPv6 Guard**   | Rogue DHCPv6 Server Attacks     | Blocks unauthorized DHCPv6 Advertise  |
|                         |                                 | and Reply messages on untrusted ports.|
| **IPv6 ND Inspection**  | IPv6 Neighbor Spoofing (DAD)    | Validates Neighbor Solicitations (NS) |
|                         |                                 | and Advertisements (NA) against table.|
| **IPv6 Source Guard**   | IPv6 Address Spoofing           | Hardware PACL filtering of IPv6 source|
|                         |                                 | addresses based on ND binding table. |
+---------------------------------------------------------------------------------------------------+

! Configuring IPv6 RA Guard Policy
Switch(config)# ipv6 nd raguard policy RAGUARD-ACCESS-POLICY
Switch(config-nd-raguard)# device-role host
!
! Apply RA Guard to Access Interface
Switch(config)# interface GigabitEthernet1/0/1
Switch(config-if)# ipv6 nd raguard attach-policy RAGUARD-ACCESS-POLICY

5. Cisco IOS-XE Layer 2 Security CLI Configuration & Verification

Comprehensive Multi-Feature Hardening Configuration

! ===================================================================
! STEP 1: CONFIGURE DHCP SNOOPING GLOBALLY AND PER VLAN
! ===================================================================
ip dhcp snooping
ip dhcp snooping vlan 10,20,30
no ip dhcp snooping information option ! Or allow-untrusted upstream
ip dhcp snooping database flash:dhcp-snooping-bindings.db
ip dhcp snooping database write-delay 60
!
! ===================================================================
! STEP 2: CONFIGURE DYNAMIC ARP INSPECTION (DAI) & IPSG
! ===================================================================
ip arp inspection vlan 10,20,30
ip arp inspection validate src-mac dst-mac ip
!
! Enable Errdisable Recovery for Layer 2 Security Violations
errdisable recovery cause dhcp-rate-limit
errdisable recovery cause arp-inspection
errdisable recovery cause psecure-violation
errdisable recovery interval 300
!
! ===================================================================
! STEP 3: CONFIGURE TRUSTED UPLINK TRUNK PORT (To Core Switch)
! ===================================================================
interface TenGigabitEthernet1/0/48
 description UPLINK-TO-CORE-SWITCH
 switchport mode trunk
 ip dhcp snooping trust
 ip arp inspection trust
!
! ===================================================================
! STEP 4: CONFIGURE UNTRUSTED ACCESS USER SWITCHPORT
! ===================================================================
interface GigabitEthernet1/0/1
 description ACCESS-USER-ENDPOINT
 switchport mode access
 switchport access vlan 10
 spanning-tree portfast
 spanning-tree bpduguard enable
 !
 ! Rate-Limit Ingress DHCP & ARP on Untrusted Access Port
 ip dhcp snooping limit rate 20
 ip arp inspection limit rate 15
 !
 ! Enable IP Source Guard (Requires DHCP Snooping)
 ip verify source port-security
 !
 ! Enable Port Security with Sticky MAC & Restrict Violation Mode
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict
 switchport port-security aging time 10
 switchport port-security aging type inactivity

Operational Verification Commands

Switch# show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs: 10,20,30
DHCP snooping is operational on following VLANs: 10,20,30
Insertion of Option 82 is disabled
Verification of hwaddr: return true
Interface                  Trusted    Rate limit (pps)
-----------------------    -------    ----------------
GigabitEthernet1/0/1       no         20
TenGigabitEthernet1/0/48   yes        unlimited

Switch# show ip arp inspection vlan 10
Source Mac Validation      : Enabled
Destination Mac Validation : Enabled
IP Address Validation      : Enabled
 Vlan     Configuration    Operation   ACL Match          Static ACL
 ----     -------------    ---------   ---------          ----------
   10     Enabled          Operational
 Vlan     Permitted        Dropped     DHCP Drops         ACL Drops
 ----     ---------        -------     ----------         ---------
   10        142050             42             42                 0

Switch# show port-security interface GigabitEthernet1/0/1
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Restrict
Aging Time                 : 10 mins
Aging Type                 : Inactivity
Secure MAC Address Type    : Sticky
Maximum MAC Addresses      : 2
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0050.56a1.2233:10
Security Violation Count   : 0
Test Your Knowledge

A network engineer enables DHCP Snooping on an edge access switch connected to a core distribution switch that operates as the default gateway and DHCP relay agent. Immediately after deployment, all client PCs connected to the access switch fail to obtain IP addresses via DHCP. An inspection reveals that the edge switch inserts DHCP Option 82 with a gateway IP address field of 0.0.0.0, causing the upstream distribution switch to discard the client requests. Which configuration on the distribution switch resolves this problem while maintaining Option 82 security?

A
B
C
D
Test Your Knowledge

A network security administrator must configure Port Security on several access switchports connecting conference room tables. The organization requires that unauthorized devices attempting to connect should have their packets discarded, the security violation counter must increment, and an SNMP trap/syslog message must be generated immediately for alerting. However, the physical switchport must remain operational ('up/up') so that previously authenticated devices are not disconnected. Which Port Security violation mode meets these specifications?

A
B
C
D
Test Your Knowledge

A financial data center implements Dynamic ARP Inspection (DAI) across all access switches. Several mission-critical database servers configured with static IP addresses fail to communicate with their default gateway because they do not participate in DHCP and therefore have no entries in the DHCP Snooping Binding Database. What is the correct method to permit ARP traffic for these statically addressed servers under DAI?

A
B
C
D
Test Your Knowledge

An enterprise branch office experiences network disruptions caused by rogue Linux workstations transmitting unauthorized IPv6 Router Advertisement (RA) messages across VLAN 20, advertising themselves as the default gateway and corrupting client SLAAC address tables. Which IPv6 First-Hop Security (FHS) technology deployed on the access switches directly neutralizes this Layer 2 attack vector?

A
B
C
D
Up Next

16.5 IEEE 802.1X Port-Based Authentication & MAB

Continue learning