CCNA 200-301 v1.1 reference — Security Fundamentals

Layer 2 security features

Port security, DHCP snooping and Dynamic ARP Inspection: trust boundaries, violation actions and verification.

Objective 5.7v1.1 exam target

Layer 2 security features

DAI depends on DHCP snooping — enable snooping first.
Feature	Stops	Mechanism
Port security	Unauthorized devices / MAC flooding	Limits learned MACs per port; violation actions protect/restrict/shutdown
DHCP snooping	Rogue DHCP servers	Untrusted ports may not send DHCP server replies; builds a binding table
Dynamic ARP inspection	ARP poisoning	Validates ARPs against the DHCP snooping binding table

DAI depends on DHCP snooping — enable snooping first.

The trust boundary is the whole model: ports facing *your* infrastructure (real DHCP servers, uplinks) are trusted; everything facing users is untrusted by default. DHCP snooping drops server-side messages (Offer/Ack) on untrusted ports; DAI drops ARPs whose IP↔MAC↔port doesn't match a trusted source — usually the snooping binding table, though approved static ARP ACLs are an alternative validation source.

Port security

Limit a desk port to one learned MAC with shutdown on violation — Privileged EXEC → Interface configuration

Cisco IOS / IOS XE

Port must be a static access (or trunk) port — port security rejects dynamic mode.

configure terminal
interface gigabitethernet1/0/5
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
 end

Verify

show port-security
show port-security interface gi1/0/5
show port-security address

Secure status, max/current count, violation count and action.
Sticky entries persist the learned MAC into config.

Violation actions: protect (drop silently), restrict (drop + log/increment), shutdown (err-disable).

Changes device configuration.

DHCP snooping + DAI

Protect user VLANs from rogue DHCP and ARP spoofing — Privileged EXEC → Global + interface configuration

Cisco IOS / IOS XE

configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10,20
ip arp inspection vlan 10,20
interface gigabitethernet1/0/24
 ip dhcp snooping trust
 ip arp inspection trust
 end

Verify

show ip dhcp snooping
show ip dhcp snooping binding
show ip arp inspection

Snooping enabled for the right VLANs with the uplink trusted.
Binding table populates from real leases — DAI uses exactly this table.

Trust the UPLINK/DHCP-server-facing ports only — trust on a user port defeats the feature.
Static-IP hosts bypass snooping bindings — they need ip arp inspection arp-acl entries or trust.

Changes device configuration.

$ show port-security interface (interpreted)

Port Status : Secure-shutdownRead with show interfaces status err-disabled — psecure-violation is the actual errdisable reason.

Violation Mode : ShutdownThe configured reaction.

Maximum MAC Addresses : 1Limit.

Total MAC Addresses : 1Learned count.

Security Violation Count : 2Repeat offenders → investigate, don't just re-enable.

On this page