CCNA 200-301 v1.1 reference — Security Fundamentals

Layer 2 security features

Port security, DHCP snooping and Dynamic ARP Inspection: trust boundaries, violation actions and verification.

Objective 5.7v1.1 exam target

Port security

Limit a desk port to one learned MAC with shutdown on violation — Privileged EXEC → Interface configuration

Cisco IOS / IOS XE

Port must be a static access (or trunk) port — port security rejects dynamic mode.

configure terminal
interface gigabitethernet1/0/5
 switchport mode access
 switchport port-security
 switchport port-security maximum 1
 switchport port-security violation shutdown
 switchport port-security mac-address sticky
 end

Verify

show port-security
show port-security interface gi1/0/5
show port-security address

Secure status, max/current count, violation count and action.
Sticky entries persist the learned MAC into config.

Violation actions: protect (drop silently), restrict (drop + log/increment), shutdown (err-disable).

Changes device configuration.

$ show port-security interface (interpreted)

Port Status : Secure-shutdownRead with show interfaces status err-disabled — psecure-violation is the actual errdisable reason.

Violation Mode : ShutdownThe configured reaction.

Maximum MAC Addresses : 1Limit.

Total MAC Addresses : 1Learned count.

Security Violation Count : 2Repeat offenders → investigate, don't just re-enable.

DHCP snooping and DAI

The trust boundary is the whole model: ports facing *your* infrastructure (real DHCP servers, uplinks) are trusted; everything facing users is untrusted by default. DHCP snooping drops server-side messages (Offer/Ack) on untrusted ports; DAI drops ARPs whose IP↔MAC↔port doesn't match a trusted source — usually the snooping binding table, though approved static ARP ACLs are an alternative validation source.

DHCP snooping + DAI

Protect user VLANs from rogue DHCP and ARP spoofing — Privileged EXEC → Global + interface configuration

Cisco IOS / IOS XE

configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10,20
ip arp inspection vlan 10,20
interface gigabitethernet1/0/24
 ip dhcp snooping trust
 ip arp inspection trust
 end

Verify

show ip dhcp snooping
show ip dhcp snooping binding
show ip arp inspection

Snooping enabled for the right VLANs with the uplink trusted.
Binding table populates from real leases — DAI uses exactly this table.

Trust the UPLINK/DHCP-server-facing ports only — trust on a user port defeats the feature.
Static-IP hosts bypass snooping bindings — they need ip arp inspection arp-acl entries or trust.

Changes device configuration.

Verification

Layer 2 security features

DAI depends on DHCP snooping — enable snooping first.
Feature	Stops	Mechanism
Port security	Unauthorized devices / MAC flooding	Limits learned MACs per port; violation actions protect/restrict/shutdown
DHCP snooping	Rogue DHCP servers	Untrusted ports may not send DHCP server replies; builds a binding table
Dynamic ARP inspection	ARP poisoning	Validates ARPs against the DHCP snooping binding table

DAI depends on DHCP snooping — enable snooping first.

Attack these features prevent

Attack: User connects a rogue mini-switch running a DHCP server

Without snooping, the rogue hands out poisoned gateways — traffic reroutes through it.
With snooping, the untrusted port drops the rogue's Offer before clients see it.
If the attacker instead forges ARPs to poison caches, DAI drops ARPs not matching the binding table.

Each feature plugs a specific L2 hole — together they cover the common LAN attacks.

Common mistakes

Enabling port security on a dynamic/auto port — it's rejected or misbehaves; set mode access first.
Trusting user ports — 'trusted' means 'believe DHCP/ARP from here'.
Enabling DAI without snooping — the binding table is empty, so DAI drops legitimate ARPs.
Forgetting err-disabled ports need manual re-enable after the cause is removed.
Setting maximum too low for a port with a phone + PC daisy-chained.

Legitimate phone+PC violates port security

Observation: A desk port err-disables when a phone and PC share it.

Hypotheses

Maximum 1 can't hold phone+PC MACs
Voice VLAN MACs count toward the limit
Sticky learned the wrong device's MAC

Check	Indicates
`show port-security interface` counts	How many MACs the port actually sees.
`show port-security address`	Which MACs were secured — is the phone's there?
Err-disable reason in `show interfaces status err-disabled`	Confirms psecure-violation vs other causes.

Correction: Raise maximum (e.g., 2–3) or adjust sticky handling for the phone+PC pattern.

Port stays up with both devices learned; violation count stops growing.

On this page

Port security
DHCP snooping and DAI
Verification

Related resources

Practise this topic Source topic 49: Port Security Practise topic 49 deck Source topic 50: DHCP Snooping Practise topic 50 deck Source topic 51: Dynamic ARP Inspection (DAI)Practise topic 51 deck

Sources

Cisco CCNA 200-301 v1.1 Exam Topics (official PDF) — reviewed 2026-11-02
Cisco — LAN Switching Command Reference — reviewed 2026-11-02

Targets CCNA 200-301 v1.1 objectives. Supplemental blocks are labeled beyond exam scope.