4.4 DHCP Snooping, Dynamic ARP Inspection (DAI) & IP Source Guard

In an enterprise local area network, IP host communication relies on foundational discovery and resolution protocols—specifically the Dynamic Host Configuration Protocol (DHCP) and the Address Resolution Protocol (ARP). However, because both protocols were conceived decades ago without built-in security, authentication, or integrity checks, unhardened Layer 2 broadcast domains remain vulnerable to devastating attacks.

---

The Layer 2 Threat Landscape

Four pervasive attack vectors threaten campus switched environments at Layer 2:

1. Rogue DHCP Server Attack: An unauthorized DHCP server—introduced maliciously by an attacker or accidentally by an employee connecting an off-the-shelf SOHO Wi-Fi router—listens for client DHCPDISCOVER broadcasts. If the rogue server responds faster than the legitimate corporate DHCP server, it assigns clients incorrect IP addressing parameters, designating the rogue server as the default gateway and primary DNS server. This allows the attacker to intercept all outbound web traffic, execute SSL-stripping attacks, and redirect users to phishing sites.
2. DHCP Starvation Attack: An attacker transmits a continuous stream of DHCPDISCOVER frames with randomized, spoofed source MAC addresses. The legitimate DHCP server leases every available IP address in its pool to these fictitious clients, exhausting the subnet scope. Legitimate enterprise workstations are then unable to obtain IP addresses, resulting in a widespread denial-of-service condition.
3. ARP Spoofing / ARP Cache Poisoning: ARP lacks any mechanism to verify whether the sender of an ARP reply actually owns the claimed IP address. In an ARP poisoning attack, an attacker sends unsolicited Gratuitous ARP (GARP) or forged ARP replies across the VLAN, claiming that the default gateway's IP address is mapped to the attacker's MAC address. Workstations and switches update their local ARP caches with this falsified mapping, causing all subnet traffic to route directly to the attacker (enabling classic Man-in-the-Middle eavesdropping).
4. IP Source Address Spoofing: An attacker transmits IP packets utilizing a forged source IP address belonging to an authorized server, executive workstation, or management subnet. This technique is used to bypass IP-based access control lists (ACLs), hijack authenticated sessions, or execute reflected denial-of-service attacks.

To counter these threats systematically, Juniper switches provide a cohesive, three-tiered Layer 2 defense framework: DHCP Snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG).

---

DHCP Snooping Architecture & Trusted/Untrusted Roles

DHCP Snooping acts as an internal Layer 2 stateful inspection firewall between DHCP clients and DHCP servers. When DHCP snooping is enabled on a VLAN, Junos categorizes switch interfaces into two operational trust levels:

• Trusted Interfaces (overrides trusted): Interfaces connected directly to legitimate, authorized DHCP servers or trunk uplinks leading to the core distribution network where DHCP servers reside. Trusted interfaces are permitted to transmit and receive all types of DHCP messages, including server responses (DHCPOFFER, DHCPACK, DHCPNAK).
• Untrusted Interfaces: Access ports connecting to end-user workstations, printers, and guest devices. Untrusted interfaces are permitted to transmit client requests (DHCPDISCOVER, DHCPREQUEST, DHCPDECLINE, DHCPRELEASE). However, untrusted interfaces are strictly forbidden from receiving server responses. If a DHCPOFFER, DHCPACK, or DHCPNAK arrives on an untrusted port, Junos immediately drops the packet and logs a security violation.

The DHCP Snooping Binding Table

As legitimate clients negotiate network access on untrusted ports, the switch passively "snoops" the 4-way DHCP exchange (DISCOVER $\to$ OFFER $\to$ REQUEST $\to$ ACK). When the trusted DHCP server returns a DHCPACK, the switch intercepts the frame and automatically extracts five critical parameters, writing them into the DHCP Snooping Binding Database:

1. Client MAC Address
2. Assigned IPv4 Address
3. Lease Duration & Expiration Timestamp
4. VLAN ID
5. Physical Ingress Interface

This database acts as the single source of truth for all downstream Layer 2 security features.

Output note: Command output shown here is a schematic teaching example, not a captured device session. Field names and feature support depend on platform and Junos release.

Dynamic ARP Inspection (DAI)

Once DHCP Snooping constructs the binding database, Dynamic ARP Inspection (DAI) leverages this data to eradicate ARP spoofing and Man-in-the-Middle attacks.

Operational Mechanics

When DAI is enabled on a VLAN, the switch intercepts every ARP Request and ARP Reply packet arriving on untrusted ports before placing it into the forwarding path. The switch hardware inspects the ARP protocol payload, examining the Sender Hardware Address (SHA / MAC) and the Sender Protocol Address (SPA / IP):

• The switch queries the DHCP Snooping database to verify whether an active entry exists pairing that exact IP address and MAC address to that specific ingress interface and VLAN.
• Valid Binding: If the SHA and SPA match an active binding entry, the ARP packet is forwarded normally.
• Invalid / Spoofed Binding: If no matching binding entry exists, or if the MAC address in the ARP payload differs from the MAC bound to that IP address, the switch immediately discards the ARP frame and increments the DAI violation counter. If configured, an alarm is triggered.

Handling Statically Addressed Endpoints

In enterprise networks, certain devices—such as network printers, database servers, hypervisors, and legacy PBX controllers—utilize static IP addresses rather than DHCP leases. Because these devices never execute a DHCP negotiation, they will not appear in the DHCP snooping table.

If DAI is enabled on a VLAN containing statically addressed devices, DAI will treat all ARP traffic from these legitimate devices as unverified and discard it, resulting in complete network isolation!

To resolve this, Junos allows administrators to configure Static DHCP Security Bindings under the VLAN security hierarchy:

[edit vlans VLAN_DATA forwarding-options dhcp-security]
user@EX4300# set group STATIC-CLIENT interface ge-0/0/15.0 static-ip 10.10.10.50 mac 00:11:22:33:44:55

This static binding injects a permanent mapping into the snooping database, allowing DAI to validate the device's ARP packets.

---

IP Source Guard (IPSG)

While Dynamic ARP Inspection secures Layer 2 ARP resolution, it does not inspect standard Layer 3 IP data packets. An attacker who bypasses ARP could still inject raw IPv4 frames with forged source IP addresses.

IP Source Guard (IPSG) closes this gap by enforcing wire-speed source IP and MAC address validation on untrusted access interfaces.

Operational Mechanics

When IP Source Guard is enabled, Junos automatically provisions dynamic stateless packet filters in the switch ASIC (TCAM) on all untrusted access interfaces. These filters are derived directly from the active DHCP Snooping database:

1. As frames enter an untrusted port, the ASIC inspects the Layer 3 source IP address and Layer 2 source MAC address.
2. If the source IP/MAC pair matches the active snooping binding for that physical interface, the packet is permitted into the switching fabric.
3. If an endpoint attempts to transmit packets using an unassigned or spoofed source IP address, the switch ASIC drops the packet at wire speed in hardware without consuming control-plane CPU cycles.

---

Junos Configuration: The Integrated Security Suite

The following configuration illustrates an end-to-end deployment of DHCP Snooping, DAI, and IPSG on a Juniper EX4300 switch for VLAN_DATA (VLAN ID 100):

[edit vlans VLAN_DATA forwarding-options dhcp-security]
user@EX4300# show
group access-interfaces {
    interface ge-0/0/10.0;
    interface ge-0/0/11.0;
    interface ge-0/0/12.0;
}
group server-uplinks {
    interface ge-0/0/0.0 {
        overrides {
            trusted;
        }
    }
}
dynamic-arp-inspection;
ip-source-guard;

Critical Configuration Gotchas

Exam Trap & Operational Pitfall: Forgetting to configure overrides trusted on the uplink interface (ge-0/0/0.0) is the single most common cause of network-wide outages after enabling DHCP security. On ELS, access ports are untrusted and trunk ports are trusted by default. Audit overrides instead of assuming every uplink is untrusted. If the server-facing path is an untrusted access interface or has an explicit untrusted override, the switch drops all DHCPOFFER and DHCPACK packets arriving from the server. Consequently, clients depending on that path can lose DHCP service!

Operational Diagnostics & Verification Commands

Junos provides specialized operational commands to inspect the DHCP snooping table, verify DAI packet counters, and diagnose Layer 2 security drops.

1. Inspecting the Snooping Database: show dhcp-security binding

Displays all active dynamically learned and statically configured IP-to-MAC bindings:

user@EX4300> show dhcp-security binding

IP address        MAC address          VLAN       Interface    Lease (sec)  Type
10.10.10.101      00:05:85:11:22:33    VLAN_DATA  ge-0/0/10.0  86400        dynamic
10.10.10.102      00:05:85:44:55:66    VLAN_DATA  ge-0/0/11.0  82150        dynamic
10.10.10.50       00:11:22:33:44:55    VLAN_DATA  ge-0/0/15.0  infinite     static

In this output:

• Workstations on ge-0/0/10.0 and ge-0/0/11.0 have active dynamic leases with countdown timers.
• The printer on ge-0/0/15.0 is permanently validated via a static binding with an infinite lease.

2. Detailed Binding Inspection: show dhcp-security binding detail

To view granular lease information and client hostnames:

user@EX4300> show dhcp-security binding detail

IP address: 10.10.10.101
  MAC address: 00:05:85:11:22:33
  VLAN: VLAN_DATA
  Interface: ge-0/0/10.0
  Client hostname: Finance-PC-01
  Server IP: 10.10.10.1
  Lease remaining: 86320 seconds
  State: BOUND

3. Monitoring DAI and Snooping Statistics: show dhcp-security statistics

Displays counters for forwarded and dropped packets across DHCP Snooping and DAI:

user@EX4300> show dhcp-security statistics

DHCP Snooping Statistics:
  Packets received from untrusted ports : 1245
  Packets received from trusted ports   : 1245
  Packets dropped (untrusted offer/ack) : 14
  Packets dropped (invalid format)      : 0

Dynamic ARP Inspection Statistics:
  Total ARP packets inspected           : 8940
  Valid ARP packets forwarded           : 8922
  Invalid ARP packets dropped           : 18
  ARP request packets forwarded         : 6420
  ARP reply packets forwarded           : 2502

If the counter Packets dropped (untrusted offer/ack) increments, an unauthorized DHCP server is actively operating on an untrusted port. If Invalid ARP packets dropped increments, an endpoint is transmitting spoofed ARP responses or an unconfigured static IP device is present on the network.

Official references checked 2026-10-18: ELS security and trust defaults, Static bindings.