LogoفارسیFA

Hands-On Lab: DHCP Snooping and Dynamic ARP Inspection

This hands-on lab configures DHCP snooping to establish trusted and untrusted ports, then enables Dynamic ARP Inspection using the resulting binding table, demonstrating how the two features work together to block a simulated rogue DHCP server and ARP spoofing attempt.

DHCP Snooping ConfigurationDynamic ARP InspectionTrusted Port

~3 min read · Updated Sep 23, 2026

Lab Objective

Configure DHCP snooping with an appropriately trusted uplink port, verify the binding table populates correctly, then enable Dynamic ARP Inspection using that table, and confirm both a rogue DHCP response and a spoofed ARP reply are blocked.

Lab Purpose

DHCP snooping and DAI, discussed earlier in this series, are deliberately designed to work together: DHCP snooping's binding table provides the trusted reference data that makes DAI effective. This lab demonstrates the complete workflow from initial configuration through verifying both attack types are actually blocked.

Lab Topology

Switch1
  Gi1/0/24 ---- legitimate DHCP server (trusted)
  Gi1/0/1  ---- PC-A (192.168.66.10, untrusted)
  Gi1/0/2  ---- Simulated rogue device (untrusted)

VLAN 10 carries all these ports

Task 1: Enable DHCP Snooping

Enable DHCP snooping globally and for VLAN 10.

Task 2: Trust the Uplink Port Only

Mark Gi1/0/24 as trusted, leaving all other ports untrusted by default.

Task 3: Verify the Binding Table Populates

Allow PC-A to obtain an address via DHCP and confirm the binding table records it.

Task 4: Simulate a Rogue DHCP Response

Attempt to send a DHCP offer from the untrusted Gi1/0/2 port and confirm it is dropped.

Task 5: Enable Dynamic ARP Inspection

Enable DAI for VLAN 10, trusting the same uplink port.

Task 6: Simulate an ARP Spoofing Attempt

Attempt to send a forged ARP reply from the untrusted port claiming to own the default gateway's IP, and confirm it is dropped.

Solution and Verification

Switch1(config)# ip dhcp snooping
Switch1(config)# ip dhcp snooping vlan 10

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# ip dhcp snooping trust

PC-A> ipconfig /renew

IPv4 Address: 192.168.66.10

Switch1# show ip dhcp snooping binding

MacAddress        IpAddress      Lease  Type          VLAN  Interface
00aa.bb00.1010    192.168.66.10  86400  dhcp-snooping 10    Gi1/0/1

-- Simulated rogue DHCP offer sent from Gi1/0/2:

Switch1# show ip dhcp snooping statistics

Interface   Filter Type   Reason         Drop Count
Gi1/0/2     DHCP Server   Untrusted port  1
-- The rogue offer is dropped, since only
-- Gi1/0/24 is trusted to send DHCP server
-- responses

Switch1(config)# ip arp inspection vlan 10

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# ip arp inspection trust

-- Simulated spoofed ARP reply from Gi1/0/2,
-- falsely claiming to own 192.168.66.1
-- (the default gateway):

Switch1# show ip arp inspection statistics

Vlan  Forwarded  Dropped
10     42         1
-- The forged ARP reply is dropped, since
-- it does not match any legitimate binding
-- (192.168.66.1 was never assigned via DHCP
-- to that untrusted port's MAC address)

Key Takeaway

The DHCP snooping binding table populated in the earlier tasks is exactly what DAI checks each ARP message against — this is why DHCP snooping must be configured and functioning correctly before DAI can provide any real protection, and why the two features are almost always deployed together rather than independently.

Written & researched by Dr. Shahin Siami

Related Articles

Hands-On Lab: Configuring HSRP for IPv6

This hands-on lab configures HSRP for IPv6 between two routers, demonstrating the option to use an automatically generated link-local virtual address rather than manually assigning one, and verifies failover behavior mirrors the IPv4 HSRP lab covered earlier in this series.

Continue

Hands-On Lab: Configuring SVI Autostate Exclude

This hands-on lab configures SVI autostate exclude on a monitoring port within a VLAN, preventing that single inactive port from incorrectly bringing down the SVI for an entire VLAN that still has other active member ports.

Continue

Hands-On Lab: Configuring Private VLANs (PVLANs)

This hands-on lab configures a full Private VLAN structure with a primary VLAN and both isolated and community secondary VLANs, demonstrating fine-grained Layer 2 isolation within a single IP subnet beyond what the simple protected-port feature from an earlier lab can achieve.

Continue

Hands-On Lab: Configuring VLAN Access Control Lists (VACLs)

This hands-on lab configures a VLAN Access Control List using a VLAN access-map to filter traffic within a single VLAN at Layer 2, something a standard router-applied ACL cannot achieve since traffic never leaves the VLAN to reach a routed interface.

Continue

Hands-On Lab: Configuring Storm Control

This hands-on lab configures storm control thresholds on a switch port to limit broadcast and multicast traffic, simulating a broadcast storm and verifying the switch suppresses excess traffic before it can overwhelm the network.

Continue

Hands-On Lab: Configuring PVLAN Edge (Protected Ports)

This hands-on lab configures PVLAN Edge (protected ports) on two access ports within the same VLAN, isolating them from each other at Layer 2 while both retain normal connectivity to an uplink port, demonstrating a lightweight isolation feature that requires no separate VLAN.

Continue
Previous ArticleNext Article