CCNA Layer 2 Security: DHCP Snooping, Dynamic ARP Inspection, Storm Control, RA Guard and Port Security

Each CCNA Layer 2 security feature answers one specific attack that happens inside a VLAN, before traffic ever reaches a router or firewall: DHCP snooping stops rogue DHCP servers and DHCP starvation, dynamic ARP inspection (DAI) stops ARP spoofing, storm control stops traffic floods, RA guard stops rogue IPv6 routers, and port security stops MAC flooding and unauthorised devices. Matching the attack to the control is the first skill; a feature that inspects the wrong protocol does nothing for the attack, however strict it is.

The features are built to work together. DHCP snooping builds the binding table that DAI relies on, and all of them are applied on access-layer switches, where hosts connect. They are configured with Cisco IOS commands on Catalyst switches; the command forms in this lesson follow Catalyst IOS and IOS XE.

DHCP snooping classifies every switch port as trusted or untrusted and drops DHCP server messages that arrive on untrusted ports, so only the port that leads to the real DHCP server (an uplink, or the server's own port) can deliver offers and acknowledgements. Once snooping is active for a VLAN, every port in it is untrusted by default; you trust only the ports toward legitimate servers.

Trusting the wrong ports reverses the protection: if every desk port is trusted, a home router on any of them can answer clients again. Snooping also runs these checks on untrusted ports:

• MAC address verification (on by default): the Ethernet source MAC must match the client hardware address (chaddr) inside the DHCP packet.
• A DHCPRELEASE or DHCPDECLINE must arrive on the same port as the binding it refers to, so one host cannot release another host's lease.
• A packet that already carries relay-agent information (option 82), or a non-zero relay agent address (giaddr), is dropped, since a client should never send either.

Enabling it takes two commands

DHCP snooping needs both a global switch and a per-VLAN list. ip dhcp snooping turns the feature on; ip dhcp snooping vlan 10 names the VLANs it inspects. With only one of them, nothing is filtered and the trust settings have no effect.

ip dhcp snooping
ip dhcp snooping vlan 10,20
!
interface GigabitEthernet1/0/48
 description Uplink toward the DHCP server
 ip dhcp snooping trust

show ip dhcp snooping separates the two conditions. It prints whether "Switch DHCP snooping is enabled" or disabled, then the VLANs on which snooping is configured and the VLANs on which it is operational. A VLAN that is configured but not operational usually means the global command is missing (or the VLAN does not exist or is not active on the switch); a VLAN that is missing from both lists needs ip dhcp snooping vlan. The same output lists trusted interfaces and their rate limits.

Beyond trust, DHCP snooping protects the DHCP pool with MAC verification and a per-port rate limit, and it inserts option 82 into client requests, which sometimes needs adjusting so a DHCP server accepts them.

Starvation and the two controls that stop it

A DHCP starvation tool sends thousands of DHCPDISCOVERs, each with a different client hardware address (chaddr), until the server has no addresses left. If the tool keeps one real Ethernet source MAC and only changes chaddr, port security never triggers, because port security counts source MAC addresses in the Ethernet header. Two DHCP snooping capabilities each stop the attack:

• MAC address verification (ip dhcp snooping verify mac-address, enabled by default) drops every packet whose chaddr differs from the source MAC.
• Rate limiting: ip dhcp snooping limit rate 10 on an untrusted interface sets how many DHCP packets per second it accepts. Exceeding the limit error-disables the port with cause dhcp-rate-limit; it does not merely drop the excess. There is no limit by default.

Size the limit for what the port carries. A desk port needs only a few packets per second, but an untrusted trunk to a downstream switch carries the combined burst of every client behind it, for example when every client on the floor renews at the same moment. A limit that suits one host error-disables such a trunk and cuts off everyone; raise the value on that interface rather than remove the limit. Trusted ports are normally left without a limit.

Option 82 insertion

When snooping is enabled, a Catalyst switch by default inserts DHCP option 82 (relay agent information: which switch and port the request came from) into client requests. Because it is a Layer 2 switch and not a relay, it leaves the relay agent address (giaddr) as 0.0.0.0. Two consequences appear in practice:

If the DHCP server assigns addresses based on option 82, keep insertion on at the access layer and fix the receiving device instead.

The binding table

For every DHCP exchange it sees complete on an untrusted port, DHCP snooping records a binding: MAC address, leased IP address, lease time, VLAN and interface. show ip dhcp snooping binding lists them. The table is held in memory; ip dhcp snooping database (a database agent, such as a flash file or TFTP server) saves it so bindings survive a reload. The agent only preserves bindings; it never creates them. A binding is removed when the lease expires or the client releases it.

Dynamic ARP inspection intercepts ARP requests and replies on untrusted ports and forwards them only if the sender IP address and sender MAC address match a valid IP-to-MAC binding for that port and VLAN; anything else is dropped and logged. That stops ARP spoofing, where an attacker announces that the gateway's IP address belongs to the attacker's MAC.

ip dhcp snooping
ip dhcp snooping vlan 10
ip arp inspection vlan 10
!
interface GigabitEthernet1/0/48
 ip dhcp snooping trust
 ip arp inspection trust

Where the bindings come from

DAI takes its bindings from the DHCP snooping binding table (and from ARP ACLs, covered next). Several behaviours follow from that:

• Bindings exist only for DHCP exchanges the switch observed. Turning on DAI in a VLAN whose hosts got their leases before snooping was enabled leaves those hosts with no binding, so DAI drops their ARP and they lose the gateway; any host that completes a fresh DHCP exchange gets a binding and is unaffected. Making the hosts renew (for example ipconfig /renew, or bouncing their ports) creates the bindings. Enable snooping first and let bindings build before enabling DAI.
• A matching MAC alone is not enough. If a user changes a DHCP-leased PC to a static address, its ARP now carries a pair (new IP, same MAC) that matches no binding, and it is dropped even though the old lease has not expired.
• An invalid ARP packet is dropped and logged; validation failures do not error-disable the port. Only the rate limit does that.

Trust for DAI is separate from trust for DHCP snooping

ip arp inspection trust and ip dhcp snooping trust are independent settings; trusting a port for one does nothing for the other. Every port is untrusted for DAI by default. Trust the ports toward the router or the next switch, never host ports.

Between two switches that both run DAI, trust the inter-switch link. Each switch holds bindings only for hosts on its own access ports, so a switch that treats the link as untrusted checks the neighbour's hosts against its own table, finds nothing, and drops their ARP. Because both switches validate ARP where it enters the network, trusting the link loses nothing. If the neighbour does not run DAI, leave the link untrusted (and use ARP ACLs for any hosts behind it).

Rate limit

DAI applies a rate limit to protect the switch CPU: 15 ARP packets per second by default on untrusted ports, and no limit on trusted ports. Exceeding it error-disables the port with cause arp-inspection, logged as %SW_DAI-4-PACKET_RATE_EXCEEDED followed by an err-disable message. A legitimate host that sends a lot of ARP, such as a network scanner, needs a higher limit on its port, for example ip arp inspection limit rate 40, which keeps the port untrusted and still validated. Trusting the port also stops the shutdowns but removes validation.

A host with a statically configured address never runs DHCP, so it has no binding and DAI drops its ARP; an ARP ACL gives DAI an explicit permitted IP-to-MAC pair for such hosts while their ports stay untrusted and validated.

arp access-list STATIC-HOSTS
 permit ip host 192.168.30.20 mac host 00aa.bb01.0c22
!
ip arp inspection filter STATIC-HOSTS vlan 30

DAI checks ARP ACLs first. A packet permitted by the ACL is forwarded; a packet that matches no entry falls through to the DHCP snooping binding check, which is why an ACL for one printer does not affect DHCP clients in the VLAN.

Use static only for a VLAN whose hosts are all listed in the ACL. Trusting the static host's port is the alternative to an ACL, but it removes ARP validation on that port.

Optional extra checks

ip arp inspection validate {src-mac | dst-mac | ip} adds checks beyond the binding match: src-mac compares the Ethernet source MAC with the ARP sender MAC, dst-mac compares the Ethernet destination MAC with the ARP target MAC in replies, and ip rejects invalid or unexpected addresses such as 0.0.0.0, 255.255.255.255 and multicast addresses. They make DAI stricter; they never cause a packet that failed the binding check to pass. Use show ip arp inspection (per-VLAN statistics and drops) and show ip arp inspection interfaces (trust state and rate limit) to verify.

Storm control measures broadcast, multicast or unicast traffic arriving on a port over one-second intervals and, when a traffic type exceeds its configured threshold, blocks that type of traffic until it falls back below the threshold. It limits the damage of a loop or a faulty NIC; it does not look at addresses or protocols.

interface GigabitEthernet1/0/15
 storm-control broadcast level 10.00 5.00
 storm-control multicast level 20.00

• Each traffic type has its own counter. Frames to FFFF.FFFF.FFFF count as broadcast, so a broadcast storm needs storm-control broadcast; a multicast threshold would not see it.
• The level is a percentage of the port's bandwidth (it can also be given in bits or packets per second with level bps or level pps).
• The first value is the rising threshold and the optional second value the falling threshold. Once traffic exceeds the rising level, the port blocks that type until traffic drops below the falling level, not merely below the rising one. With no falling value, it equals the rising value.

A port shut down by storm control stays error-disabled until someone bounces it, unless errdisable recovery cause storm-control is configured. Storm control limits traffic volume; it does not cap how many MAC addresses a port learns, which is port security's job. Verify with show storm-control.

IPv6 RA guard drops ICMPv6 router advertisements (and redirects) that arrive on ports facing hosts, so a device that is not a router cannot announce itself as the default gateway. With SLAAC, hosts take their default router, and often their prefix, from router advertisements, so a laptop running router-advertisement software can otherwise become the gateway for the whole VLAN and intercept its traffic.

ipv6 nd raguard policy HOSTS
 device-role host
!
ipv6 nd raguard policy UPLINK
 device-role router
!
interface range GigabitEthernet1/0/1 - 47
 ipv6 nd raguard attach-policy HOSTS
interface GigabitEthernet1/0/48
 ipv6 nd raguard attach-policy UPLINK

The policy's device-role decides what the port may send. A host role (the default) blocks inbound router advertisements and redirects; a router role allows them. Attach the host policy only to host ports. Attaching it to the port that faces the legitimate router as well (an easy mistake with interface range) drops the real router's advertisements, and hosts lose their IPv6 default gateway. Changing the policy to router on every port removes the protection instead.

RA guard does not cover DHCPv6

RA guard inspects router advertisements only. Addresses or options that hosts get from DHCPv6, such as a DNS server from stateless DHCPv6 (signalled by the RA's O flag), come in DHCPv6 server messages that RA guard never examines. DHCPv6 guard is the matching control: a policy with device-role client (the default) attached to access ports drops DHCPv6 server replies arriving there, and the port toward the real server gets device-role server.

ipv6 dhcp guard policy CLIENTS
 device-role client
!
interface GigabitEthernet1/0/14
 ipv6 dhcp guard attach-policy CLIENTS

The IPv4 features do nothing for IPv6: DHCP snooping does not filter DHCPv6, and DAI does not inspect IPv6 neighbor discovery.

Port security limits which and how many source MAC addresses may send frames into a switch port and acts when a frame from any other address arrives; it is the defence against MAC flooding and against unauthorised devices on desk ports.

Prerequisite: a static port mode

Port security works only on a port in static access or static trunk mode. A Catalyst port left in its default dynamic (DTP) mode rejects the command with a message such as "Command rejected: ... is a dynamic port". Enter switchport mode access first; assigning an access VLAN or enabling PortFast does not change the mode.

interface GigabitEthernet1/0/6
 switchport mode access
 switchport access vlan 10
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation restrict
 switchport port-security mac-address sticky

Defaults

switchport port-security with nothing else enables the feature with its defaults: a maximum of one secure MAC address, violation mode shutdown, and no aging (aging time 0). The first address heard is learned dynamically as the secure address. A second device, for example behind a small unmanaged switch on a desk port, then error-disables the whole port, so the first device loses connectivity too.

Violation modes

Protect is the silent mode: a device is blocked but nothing is logged and show port-security interface shows a violation count of 0, which is why protect mode is hard to troubleshoot: the device simply gets no service and there is no trace of why. Choose restrict when the port must stay up and violations must be visible.

Phones and the maximum

With a Cisco IP phone and a PC on one port (access VLAN plus voice VLAN), the phone's MAC address, learned in the voice VLAN, counts toward the port-security maximum. The default maximum of one is therefore used up by the phone, and the PC triggers a violation. Size the maximum to the phone plus the devices allowed behind it: with the phone learned only in the voice VLAN and one PC, switchport port-security maximum 2 admits both and still treats a third device as a violation. (Some platforms also allow a per-VLAN maximum, such as maximum 1 vlan voice.)

Secure MAC addresses can be static (typed with switchport port-security mac-address H.H.H), dynamic (learned and kept only in the MAC table) or sticky; how they are stored decides what survives a reload, and the aging settings decide when a learned address is released for the next device.

Sticky addresses

switchport port-security mac-address sticky converts dynamically learned secure addresses into switchport port-security mac-address sticky H.H.H lines in the running configuration. They are not written to NVRAM until the configuration is saved (copy running-config startup-config). If the switch reloads before that, it boots without them and each port learns, and makes sticky, whichever device sends first; the original device can then cause a violation on its own port. Sticky learning changes how addresses are stored, not how many are allowed.

Aging

Secure addresses do not age out by default. Two interface commands control aging:

• switchport port-security aging time N sets the timer in minutes (0 disables aging), so a two-hour timer is aging time 120, not 7200.
• switchport port-security aging type {absolute | inactivity}. Absolute (the default) deletes the address a fixed time after it was learned, even if the device is still sending. Inactivity deletes it only after no traffic has come from it for the whole period, which suits hot desks.

The global mac address-table aging-time (in seconds) applies to ordinary dynamic MAC entries, not to secure addresses.

The second violation trigger: a secure address on another port

Port security raises a violation in two cases: when a port would exceed its maximum, and when a MAC address that is secure on one secure port appears on another secure port in the same VLAN. The address is not moved. Suppose a workstation's MAC is secure on Gi1/0/9 and Gi1/0/9 is still up. When that MAC appears on Gi1/0/12 in the same VLAN, the violation is raised on Gi1/0/12, the port where the address arrived, and it follows Gi1/0/12's own violation mode regardless of how many free secure slots that port has. Clear the old entry (for example clear port-security sticky interface gi1/0/9, or remove the sticky line) before moving the device.

Verifying

show port-security interface gi1/0/6 shows Port Status (Secure-up or Secure-shutdown), violation mode, aging time and type, maximum and total MAC addresses, sticky count and the security violation count. show port-security address lists secure addresses and their type, and show port-security summarises every port.

Several Layer 2 security features protect the network by putting a port into the err-disabled state, which stops all traffic on it until the port is reset manually or by automatic error-disable recovery. Recognising the cause tells you which feature tripped.

show interfaces status err-disabled lists err-disabled ports with their reason.

Manual recovery

Err-disabled is an operational state, not a configuration line. After removing the cause, enter shutdown then no shutdown on the interface; the port comes back at once and the configuration does not change. Removing port security or clearing sticky addresses changes the configuration and does not, by itself, lift the err-disabled state.

Automatic recovery

errdisable recovery cause psecure-violation
errdisable recovery cause arp-inspection
errdisable recovery interval 120

• Recovery is enabled per cause with errdisable recovery cause; each cause above has its own keyword, and enabling one does nothing for the others.
• One global timer applies to all causes: errdisable recovery interval, in seconds, default 300 (5 minutes), accepted range 30 to 86400. A value below 30 is rejected.
• show errdisable recovery lists each cause as Enabled or Disabled and the timer interval.
• errdisable detect cause is a different command: it controls whether a cause shuts ports down at all (enabled by default), not whether they come back.

Automatic recovery only brings the port back; if the cause persists (a second device behind a phone, a rate limit set too low), the port fails again on the next violation. Fix the cause, for example by raising a maximum or a rate limit, rather than relying on recovery.