Questions? Call 1.800.716.8955

Chapter 31

Layer 2 Security: Port Security, DHCP Snooping and DAI

Exam topics covered

5.7 Configure and verify Layer 2 security features (DHCP snooping, dynamic ARP inspection, and port security)

Foundation. Firewalls and ACLs guard the edges of a network, but many attacks start from inside, from a device plugged into an ordinary wall jack. Ethernet switching, DHCP and ARP were designed for cooperative networks: a switch learns any source MAC it sees, any device may answer a DHCP Discover, and any host may claim any IP address in an ARP reply. An attacker on an access port can exploit each of these to intercept traffic or deny service. This chapter first explains the common Layer 2 attacks, then configures the three Catalyst features that stop them, port security, DHCP snooping and Dynamic ARP Inspection (DAI), and finally the simple hygiene that prevents VLAN hopping. Output is illustrative of Catalyst IOS 15 and IOS XE.

The examples use access switch SW1. Users are in VLAN 10 (10.1.10.0/24) on ports G1/0/1 to G1/0/24; the uplink G1/0/48 leads to R1 (10.1.10.1), the default gateway and DHCP server. A printer with a static address 10.1.10.5 sits on G1/0/10.

31.1 Layer 2 Attacks

31.1.1 MAC flooding

A switch's MAC address table (CAM table) has a finite size, a few thousand to a few tens of thousands of entries. An attacker running a tool such as macof sends frames with thousands of random source MAC addresses per second. The table fills with bogus entries, and the switch can no longer learn legitimate addresses. Frames to unknown destinations are flooded out every port in the VLAN, so the switch behaves like a hub and the attacker receives traffic meant for others (Figure 31-1). Port security stops this by limiting how many MAC addresses a port may use.

Figure 31-1 MAC flooding fills the MAC address table, forcing the switch to flood unicast traffic like a hub.

31.1.2 DHCP spoofing and starvation

In DHCP spoofing, the attacker runs a rogue DHCP server. Clients accept the first Offer they receive, and a server on the local segment usually answers faster than a legitimate one across the network. The rogue Offer can hand out the attacker's address as the default gateway or DNS server, making the attacker a man in the middle for all of the victim's traffic (Figure 31- 2). In DHCP starvation, the attacker sends Discovers with thousands of spoofed client MAC addresses until the real server's pool is exhausted; legitimate clients then get no address (a denial of service), and the rogue server has the field to itself. DHCP snooping stops spoofing; snooping's rate limit and port security limit starvation.

Figure 31-2 DHCP spoofing: the rogue server's Offer wins, and the client sends all off-subnet traffic to the attacker.

31.1.3 ARP poisoning

ARP has no authentication, and hosts accept gratuitous ARP replies they never asked for. In ARP poisoning (ARP spoofing), the attacker sends PC1 a reply saying "10.1.10.1 is at my MAC" and sends R1 a reply saying "10.1.10.11 is at my MAC". Both caches are now poisoned, and traffic between PC1 and its gateway flows through the attacker, who forwards it on so nobody notices (Figure 31-3). DAI stops this by checking every ARP message on untrusted ports.

PC1 10.1.10.11

R1 10.1.10.1

Mac 0011.2233.4401

Figure 31-3 ARP poisoning: unsolicited ARP replies redirect traffic in both directions through the attacker.

31.1.4 VLAN hopping

VLAN hopping lets an attacker send traffic into a VLAN they are not assigned to. There are two methods. In switch spoofing, the attacker's device speaks DTP and negotiates a trunk with a switch port left in a dynamic mode, gaining access to every VLAN on the trunk. In double tagging, the attacker, who sits in the trunk's native VLAN, sends a frame with two 802.1Q tags (Figure 31-4). The first switch removes the outer tag (because it matches the native VLAN, which is sent untagged) and forwards the frame across the trunk, where the next switch reads the inner tag and delivers it into the victim's VLAN. Double tagging is one-way only, but that is enough for some attacks.

  • Attacker
  • access VLAN 1
  • SW1 SW2
  • trunk, native VLAN 1
  • Victim

Vlan 20

Eth 1 20 data Eth 20 data

sent: outer tag 1, inner tag 20 SW1 strips native tag 1; SW2 sees 20

Figure 31-4 Double tagging: the outer native-VLAN tag is removed by SW1, exposing the inner tag that SW2 obeys.

Table 31-1 Layer 2 attacks and their mitigations

Attack What it exploits Mitigation

MAC flooding Finite MAC address table Port security (maximum MAC addresses)

Dhcp

spoofing

Clients trust any DHCP server DHCP snooping (untrusted ports drop server messages)

Dhcp

starvation

Server leases to any MAC DHCP snooping rate limit, port security ARP poisoning Unauthenticated ARP Dynamic ARP Inspection

  • VLAN hopping DTP negotiation, native VLAN
  • untagged
  • Static access/trunk modes, nonegotiate ,
  • unused native VLAN

31.2 Port Security

Port security limits which and how many source MAC addresses may send frames into a switch port. A MAC address the port has accepted is a secure MAC address. Secure addresses can be:

Static: typed in with switchport port-security mac-address mac .

Dynamic: learned from traffic and kept only in the MAC table; lost on reload or if the port goes down.

Sticky: learned dynamically but written into the running configuration as switchport port-security mac-address sticky mac . Save the configuration and they survive a reload. The maximum (default 1) sets how many secure addresses the port allows. When a frame arrives from a new MAC beyond the maximum, or a secure MAC learned on one port appears on another port in the same VLAN, a violation occurs and the port reacts according to its violation mode (Table 31-2).

Table 31-2 Port security violation modes

Port security works only on ports statically set as access (or trunk); IOS rejects it on a port in dynamic auto/desirable mode. A typical configuration allows two addresses per port (a phone plus a PC), learns them sticky, and logs violations without disabling the port:

SW1(config)# interface range GigabitEthernet1/0/1 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 10
SW1(config-if-range)# switchport port-security ! enable; nothing happens
without it
SW1(config-if-range)# switchport port-security maximum 2
SW1(config-if-range)# switchport port-security mac-address sticky
SW1(config-if-range)# switchport port-security violation restrict
SW1(config-if-range)# switchport port-security aging time 60 ! minutes
SW1(config-if-range)# switchport port-security aging type inactivity

Aging removes secure addresses after a time so a port can learn new ones. It is off by default (time 0). Type absolute removes the address after the time regardless of activity; type inactivity removes it only after that much time with no traffic from it. Sticky addresses do not age out unless static aging is enabled.

SW1 — console

SW1# show port-security interface GigabitEthernet1/0/1
SW1# show port-security address

Secure Mac Address Table

----------------------------------------------------------------------------- Vlan Mac Address Type Ports Remaining Age

  • (mins)
  • ---- ----------- ---- ----- -------------
  • 10 0050.7966.6801 SecureSticky Gi1/0/1 -
  • 10 0008.2fe1.07c4 SecureSticky Gi1/0/1 -

-----------------------------------------------------------------------------

Figure 31-5 Port security on G1/0/1: two sticky addresses learned, and three frames from a third MAC were dropped and counted (restrict mode).

31.2.1 Err-disabled ports and recovery

In shutdown mode a violation puts the port into the err-disabled state: it is down, the LED is amber or off, and no traffic passes until it is recovered (Figure 31-6). Recover manually with shutdown then no shutdown on the interface, after removing the offending device. Or enable automatic recovery globally, which re-enables the port after an interval (default 300 seconds) and will disable it again if the violation continues:

SW1(config)# errdisable recovery cause psecure-violation
SW1(config)# errdisable recovery interval 300

SW1 — console

%PORT_SECURITY-2-PSECURE_VIOLATION: Security violation occurred, caused by MAC address 000c.29aa.bb01 on port GigabitEthernet1/0/5.

%PM-4-ERR_DISABLE: psecure-violation error detected on Gi1/0/5, putting Gi1/0/5 in err-disable state

SW1# show interfaces status err-disabled

Port Name Status Reason Err-disabled Vlans

Gi1/0/5 err-disabled psecure-violation

SW1# show port-security

Secure Port MaxSecureAddr CurrentAddr SecurityViolation Security Action (Count) (Count) (Count)

--------------------------------------------------------------------------- Gi1/0/1 2 2 3 Restrict

Gi1/0/5 1 1 1 Shutdown

---------------------------------------------------------------------------

Figure 31-6 A port in default shutdown mode is err-disabled after a violation.

Exam alert

Know the defaults: port security disabled, maximum 1, violation shutdown, aging off. Of the three modes only protect does not log or count violations, and only shutdown err-disables the port. Sticky addresses appear in the running configuration.

31.3 DHCP Snooping

DHCP snooping makes the switch act as a DHCP firewall. Every port in a snooped VLAN is either trusted or untrusted (the default once snooping is enabled):

Trusted ports face legitimate DHCP servers or relays, typically uplinks. All DHCP messages are allowed.

Untrusted ports face clients. The switch drops server messages (DHCPOFFER, DHCPACK, DHCPNAK) arriving on them, which defeats rogue servers. It also drops a DHCPRELEASE or DHCPDECLINE whose port does not match the binding table, and (by default) client messages whose source MAC differs from the DHCP chaddr field. As legitimate leases complete, the switch records each one in the DHCP snooping binding table: client MAC, leased IP, lease time, VLAN and port. That table is the foundation for DAI and IP Source Guard. To slow starvation attacks, set a rate limit on untrusted ports; a port that exceeds it is err-disabled (cause dhcp-rate-limit).

Discover/request ok

Figure 31-7 DHCP snooping: server messages are accepted only on the trusted uplink, and completed leases populate the binding table.

SW1(config)# ip dhcp snooping ! global enable
SW1(config)# ip dhcp snooping vlan 10 ! and per VLAN
SW1(config)# no ip dhcp snooping information option ! see the option 82 note
SW1(config)# interface GigabitEthernet1/0/48
SW1(config-if)# ip dhcp snooping trust
SW1(config)# interface range GigabitEthernet1/0/1 - 24
SW1(config-if-range)# ip dhcp snooping limit rate 10 ! DHCP packets per second

Note

Option 82. By default a snooping switch inserts DHCP option 82 (relay agent information: the switch and port the request came from) into client requests, with a giaddr of 0.0.0.0. Many servers, including Cisco IOS, discard such packets when they arrive on an interface that is not trusted for relay information, and clients get no address. Fix it either by disabling insertion on the switch ( no ip dhcp snooping information option , as above) or by trusting option 82 on the server ( ip dhcp relay information trusted on the interface, or globally ip dhcp relay information trust-all ).

SW1# show ip dhcp snooping

Switch DHCP snooping is enabled

DHCP snooping is configured on following VLANs:

DHCP snooping is operational on following VLANs:

  • Insertion of option 82 is disabled
  • Verification of hwaddr field is enabled
  • Interface Trusted Allow option Rate limit (pps)
  • ----------------------- ------- ------------ ----------------
  • GigabitEthernet1/0/1 no no 10
  • GigabitEthernet1/0/48 yes yes unlimited
SW1# show ip dhcp snooping binding

MacAddress IpAddress Lease(sec) Type VLAN Interface

------------------ --------------- ---------- ------------- ---- -------------------- 00:50:79:66:68:01 10.1.10.11 85974 dhcp-snooping 10 GigabitEthernet1/0/1 00:50:79:66:68:02 10.1.10.12 86012 dhcp-snooping 10 GigabitEthernet1/0/2 00:08:2F:E1:07:C4 10.1.10.14 84410 dhcp-snooping 10 GigabitEthernet1/0/1 Total number of bindings: 3

Figure 31-8 DHCP snooping status and the binding table. Each lease is tied to a MAC address, VLAN and port.

Exam alert

Once snooping is enabled, all ports are untrusted by default; you must trust the uplink toward the real server, or no client gets an address. Untrusted ports drop DHCP server messages (Offer, Ack, Nak). Snooping must be enabled both globally and per VLAN.

31.4 Dynamic ARP Inspection

Dynamic ARP Inspection (DAI) intercepts every ARP request and reply arriving on untrusted ports in the inspected VLANs and checks that the sender's IP-to-MAC mapping is legitimate, by comparing it with the DHCP snooping binding table (and with any ARP ACLs you configure). ARP messages that do not match are dropped and logged, so a poisoned reply such as "10.1.10.1 is at 000c.29aa.bb01" from G1/0/5 never reaches its victim (Figure 31-9). ARP on trusted ports, such as uplinks to other switches and routers, is not inspected. DAI depends on DHCP snooping, so configure snooping first.

Figure 31-9 DAI validates ARP from untrusted ports against the snooping bindings; the attacker's claim to own the gateway's IP is rejected.

Three details complete the picture:

Static hosts. Devices with static IP addresses (such as the printer at 10.1.10.5) have no DHCP binding, so DAI would drop their ARP. Permit them with an ARP ACL applied with ip arp inspection filter .

Rate limiting. Because inspection uses the switch CPU, untrusted ports are limited to 15 ARP packets per second by default; trusted ports are unlimited. A port that exceeds its limit is err-disabled (cause arp-inspection).

Additional validation (optional): ip arp inspection validate src-mac checks that the Ethernet source MAC equals the ARP sender MAC; dst-mac checks the destination MAC in replies; ip rejects invalid addresses such as 0.0.0.0 or broadcast.

SW1(config)# arp access-list STATIC-HOSTS
SW1(config-arp-nacl)# permit ip host 10.1.10.5 mac host 0050.56aa.0005
SW1(config)# ip arp inspection vlan 10
SW1(config)# ip arp inspection filter STATIC-HOSTS vlan 10
SW1(config)# ip arp inspection validate src-mac ip
SW1(config)# interface GigabitEthernet1/0/48
SW1(config-if)# ip arp inspection trust
SW1(config)# interface range GigabitEthernet1/0/1 - 24
SW1(config-if-range)# ip arp inspection limit rate 20 ! default 15 pps
SW1(config)# errdisable recovery cause arp-inspection

%SW_DAI-4-DHCP_SNOOPING_DENY: 1 Invalid ARPs (Res) on Gi1/0/5, vlan 10.

([000c.29aa.bb01/10.1.10.1/0050.7966.6801/10.1.10.11/09:41:07 EDT Sun Oct 4 2026])

SW1# show ip arp inspection vlan 10
  • Source Mac Validation : Enabled
  • Destination Mac Validation : Disabled
  • IP Address Validation : Enabled
  • Vlan Configuration Operation ACL Match Static ACL
  • ---- ------------- --------- --------- ----------
  • 10 Enabled Active STATIC-HOSTS No
SW1# show ip arp inspection statistics vlan 10
  • Vlan Forwarded Dropped DHCP Drops ACL Drops
  • ---- --------- ------- ---------- ---------
  • 10 1842 57 57 0
SW1# show ip arp inspection interfaces
  • Interface Trust State Rate (pps) Burst Interval
  • --------------- ----------- ---------- --------------
  • Gi1/0/1 Untrusted 20 1
  • Gi1/0/5 Untrusted 20 1
  • Gi1/0/48 Trusted None N/A

Figure 31-10 DAI in action: the attacker's forged replies for 10.1.10.1 are logged and dropped ("DHCP Drops" means no matching snooping binding).

Exam alert

DAI compares ARP messages on untrusted ports with the DHCP snooping binding table; trust uplinks and router ports. Use an ARP ACL for statically addressed hosts. Default rate limit: 15 pps on untrusted ports, exceeded ports go err-disabled.

31.5 Preventing VLAN Hopping

VLAN hopping is defeated by configuration hygiene rather than a separate feature. Never leave a port to negotiate its role with DTP, keep user traffic out of the native VLAN, and park unused ports:

! User ports: static access, no DTP

SW1(config)# interface range GigabitEthernet1/0/1 - 24
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport nonegotiate
! Trunks: static trunk, no DTP, unused native VLAN
SW1(config)# interface GigabitEthernet1/0/48
SW1(config-if)# switchport mode trunk
SW1(config-if)# switchport nonegotiate
SW1(config-if)# switchport trunk native vlan 999 ! no hosts in VLAN 999
SW1(config-if)# switchport trunk allowed vlan 10,20,30
! Unused ports: parking VLAN and shut down
SW1(config)# interface range GigabitEthernet1/0/25 - 47
SW1(config-if-range)# switchport mode access
SW1(config-if-range)# switchport access vlan 998
SW1(config-if-range)# shutdown

Static modes plus nonegotiate stop switch spoofing. A native VLAN that no host uses stops double tagging, because the attacker can never be in the native VLAN; some platforms can go further with vlan dot1q tag native , which tags native-VLAN frames on trunks. Pruning trunks to only the needed VLANs reduces exposure further.

LAB Harden an Access Switch

Goal: on SW1, stop a rogue DHCP server, ARP poisoning and MAC flooding while keeping legitimate hosts, including a static printer, working.

Figure 31-11 Lab topology: VLAN 10, 10.1.10.0/24.

Steps:

  • 1. On R1 create a DHCP pool for 10.1.10.0/24 excluding .1–.10. On SW1 make G1/0/48 a static trunk with native VLAN 999 and nonegotiate ; make G1/0/1–24 static access ports in VLAN 10.
  • 2. Enable port security on G1/0/1–24: maximum 2, sticky, violation restrict. On G1/0/5 leave the default (maximum 1, shutdown).
  • 3. Enable DHCP snooping for VLAN 10, disable option 82 insertion, trust G1/0/48, and rate-limit access ports to 10 pps. Renew PC1 and PC2.
  • 4. Create the ARP ACL for the printer, enable DAI for VLAN 10 with the filter, and trust G1/0/48.
  • 5. From the attacker, start a rogue DHCP server, then send forged ARP replies for 10.1.10.1, then connect a second MAC (for example a VM bridged on the laptop). Verify:

SW1 — lab verification

SW1# show ip dhcp snooping binding | include Gi

00:50:79:66:68:01 10.1.10.11 86311 dhcp-snooping 10 GigabitEthernet1/0/1 00:50:79:66:68:02 10.1.10.12 86330 dhcp-snooping 10 GigabitEthernet1/0/2

SW1# show ip arp inspection statistics vlan 10 | include 10

10 412 23 23 0

10 398 14 0 0

SW1# show interfaces status err-disabled

Port Name Status Reason Err-disabled Vlans

Gi1/0/5 err-disabled psecure-violation

Figure 31-12 Expected results: bindings only for legitimate clients, forged ARPs dropped, and the attacker's port err-disabled.

Expected results: PCs receive addresses from R1 only; the rogue Offers are dropped at G1/0/5 and no client binding points to the rogue. The forged ARP replies increment DAI drops, while PC1's ARP cache still shows R1's real MAC. The printer can still ARP thanks to the ARP ACL (ACL permits increase). The second MAC on G1/0/5 err-disables the port; recover it with shutdown / no shutdown .

Arp acl

native VLAN

Review questions

  • 1. Which attack fills a switch's MAC address table so that it floods unicast frames?
  • A. ARP poisoning
  • B. MAC flooding
  • C. DHCP starvation
  • D. Double tagging
  • 2. What is the default port security violation mode?
  • A. Protect
  • B. Restrict
  • C. Shutdown
  • D. Disable
  • 3. Which two statements about the restrict violation mode are true? (Choose two.)
  • A. The port is err-disabled
  • B. Frames from unknown MACs are dropped
  • C. A syslog message is generated
  • D. The violation counter does not increase
  • E. All traffic on the port is dropped
  • 4. What happens to sticky secure MAC addresses?
  • A. They are added to the running configuration
  • B. They are saved automatically to NVRAM
  • C. They age out after 5 minutes
  • D. They are shared with other switches through VTP
  • 5. An access port is err-disabled by port security. Which two actions can bring it back? (Choose two.)
  • A. shutdown then no shutdown
  • B. clear mac address-table
  • C. errdisable recovery cause psecure-violation
  • D. switchport port-security violation protect
  • E. no switchport port-security maximum
  • 6. Which DHCP messages does a switch drop when received on a DHCP snooping untrusted port?
  • A. DHCPDISCOVER and DHCPREQUEST
  • B. DHCPOFFER and DHCPACK
  • C. All DHCP messages
  • D. Only DHCPRELEASE
  • 7. After enabling DHCP snooping, no clients receive addresses. Which is the most likely cause?
  • A. The uplink toward the DHCP server is not trusted
  • B. The access ports are untrusted
  • C. The rate limit is too high
  • D. DAI is not enabled
  • 8. What information does the DHCP snooping binding table hold?
  • A. Server IP, pool and lease
  • B. Client MAC, IP, lease, VLAN and port
  • C. Router MAC and gateway IP
  • D. DHCP option 82 contents
  • 9. Which feature validates ARP packets against the DHCP snooping binding table?
  • A. Port security
  • B. IP Source Guard
  • C. Dynamic ARP Inspection
  • D. Storm control
  • 10. A printer with a static IP address loses connectivity after DAI is enabled. What should be configured?
  • A. ip dhcp snooping trust on the printer port
  • B. An ARP ACL permitting the printer's IP and MAC
  • C. switchport port-security maximum 2
  • D. ip arp inspection validate dst-mac
  • 11. What is the default DAI rate limit on untrusted interfaces?
  • A. 10 pps
  • B. 15 pps
  • C. 100 pps
  • D. Unlimited
  • 12. Which two configurations mitigate VLAN hopping? (Choose two.)
  • A. switchport nonegotiate with static port modes
  • B. Using VLAN 1 as the native VLAN for user ports
  • C. Setting the native VLAN to an unused VLAN
  • D. switchport mode dynamic desirable
  • E. Enabling DHCP snooping
  • 13. A rogue device answers DHCP requests faster than the real server and gives its own address as the default gateway. Which attack is this?
  • A. DHCP starvation
  • B. DHCP spoofing
  • C. MAC flooding
  • D. Switch spoofing

Answers

  • 1. B. MAC flooding exhausts the table so frames to unknown MACs are flooded.
  • 2. C. Shutdown is the default; the port goes err-disabled.
  • 3. B, C. Restrict drops, logs and counts but keeps the port up.
  • 4. A. Sticky MACs are written to the running configuration; save it to keep them.
  • 5. A, C. Manual bounce or automatic errdisable recovery. Changing the mode does not re-enable the port.
  • 6. B. Server messages (Offer, Ack, Nak) are dropped on untrusted ports.
  • 7. A. All ports are untrusted by default, so the real server's replies are dropped too.
  • 8. B. Bindings record MAC, IP, lease time, VLAN and interface.
  • 9. C. DAI uses the snooping bindings; IP Source Guard filters IP traffic, not ARP.
  • 10. B. Static hosts have no binding, so an ARP ACL ( ip arp inspection filter ) is needed.
  • 11. B. 15 pps on untrusted ports; trusted ports are unlimited.
  • 12. A, C. Disable DTP and keep hosts out of the native VLAN; dynamic modes invite switch spoofing.
  • 13. B. A rogue server impersonating the real one is DHCP spoofing; starvation exhausts the pool.
Use ← → to move between sections