Hands-On Lab: DHCP Snooping and Dynamic ARP Inspection

Lab Objective

Configure DHCP snooping with an appropriately trusted uplink port, verify the binding table populates correctly, then enable Dynamic ARP Inspection using that table, and confirm both a rogue DHCP response and a spoofed ARP reply are blocked.

Lab Purpose

DHCP snooping and DAI, discussed earlier in this series, are deliberately designed to work together: DHCP snooping's binding table provides the trusted reference data that makes DAI effective. This lab demonstrates the complete workflow from initial configuration through verifying both attack types are actually blocked.

Lab Topology

Switch1
  Gi1/0/24 ---- legitimate DHCP server (trusted)
  Gi1/0/1  ---- PC-A (192.168.66.10, untrusted)
  Gi1/0/2  ---- Simulated rogue device (untrusted)

VLAN 10 carries all these ports

Task 1: Enable DHCP Snooping

Enable DHCP snooping globally and for VLAN 10.

Task 2: Trust the Uplink Port Only

Mark Gi1/0/24 as trusted, leaving all other ports untrusted by default.

Task 3: Verify the Binding Table Populates

Allow PC-A to obtain an address via DHCP and confirm the binding table records it.

Task 4: Simulate a Rogue DHCP Response

Attempt to send a DHCP offer from the untrusted Gi1/0/2 port and confirm it is dropped.

Task 5: Enable Dynamic ARP Inspection

Enable DAI for VLAN 10, trusting the same uplink port.

Task 6: Simulate an ARP Spoofing Attempt

Attempt to send a forged ARP reply from the untrusted port claiming to own the default gateway's IP, and confirm it is dropped.

Solution and Verification

Switch1(config)# ip dhcp snooping
Switch1(config)# ip dhcp snooping vlan 10

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# ip dhcp snooping trust

PC-A> ipconfig /renew

IPv4 Address: 192.168.66.10

Switch1# show ip dhcp snooping binding

MacAddress        IpAddress      Lease  Type          VLAN  Interface
00aa.bb00.1010    192.168.66.10  86400  dhcp-snooping 10    Gi1/0/1

-- Simulated rogue DHCP offer sent from Gi1/0/2:

Switch1# show ip dhcp snooping statistics

Interface   Filter Type   Reason         Drop Count
Gi1/0/2     DHCP Server   Untrusted port  1
-- The rogue offer is dropped, since only
-- Gi1/0/24 is trusted to send DHCP server
-- responses

Switch1(config)# ip arp inspection vlan 10

Switch1(config)# interface gigabitethernet1/0/24
Switch1(config-if)# ip arp inspection trust

-- Simulated spoofed ARP reply from Gi1/0/2,
-- falsely claiming to own 192.168.66.1
-- (the default gateway):

Switch1# show ip arp inspection statistics

Vlan  Forwarded  Dropped
10     42         1
-- The forged ARP reply is dropped, since
-- it does not match any legitimate binding
-- (192.168.66.1 was never assigned via DHCP
-- to that untrusted port's MAC address)

Key Takeaway

The DHCP snooping binding table populated in the earlier tasks is exactly what DAI checks each ARP message against — this is why DHCP snooping must be configured and functioning correctly before DAI can provide any real protection, and why the two features are almost always deployed together rather than independently.