mail

Dynamic ARP Inspection (DAI) and IP Source Guard are Layer 2 features that validate ARP and IP traffic against the DHCP snooping binding table.

DAI – protects against ARP spoofing/poisoning

Facts

Topic Must-know
Layer Layer 2 (switch)
Inspects ARP requests and replies
Source of truth DHCP snooping binding table
Validates IP ↔ MAC ↔ VLAN ↔ interface (sender/target MAC and IP)
Dependency Requires DHCP snooping
Default All ports untrusted; untrusted = inspect & validate, trusted = pass through
On mismatch ARP packet dropped
Stops Man-in-the-middle, ARP poisoning, gateway spoofing

ARP is stateless and unauthenticated – an attacker can claim to be the default gateway. DAI validates every ARP against the binding table and drops forged packets. Without DHCP snooping, DAI doesn’t work correctly – the exam classic: “DAI not working → DHCP snooping missing”.

Configuration

ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet1/0/1
 ip dhcp snooping trust
!
ip arp inspection vlan 10
interface GigabitEthernet1/0/1
 ip arp inspection trust          ! uplinks = trusted, access ports = untrusted
!
interface GigabitEthernet1/0/10   ! rate limit against ARP floods
 ip arp inspection limit rate 15

Static IPs aren’t in the DHCP table → traffic would be dropped. Fix with a manual static binding or an inspection filter:

ip dhcp snooping binding 0011.2233.4455 vlan 10 192.168.10.50 interface Gi1/0/10
ip arp inspection filter STATIC_ARP vlan 10

Verification

show ip arp inspection
show ip arp inspection vlan 10
show ip arp inspection statistics
show ip dhcp snooping binding
debug ip arp inspection

Exam scenarios: users lose network after DAI enabled → static IP or missing DHCP snooping; ARP replies dropped → wrong uplink trust or binding mismatch; only the gateway broken → gateway port not trusted.

IP Source Guard – protects against IP spoofing

Allows IP traffic only when IP + MAC + switchport match the DHCP snooping binding.

  1. Client gets an IP via DHCP → binding stored (IP, MAC, VLAN, interface)
  2. IP source guard is enabled on the interface
  3. Only traffic matching the binding is allowed – everything else dropped at ingress

Without it a malicious client can set a static IP, spoof another user’s address, bypass ACLs and run MITM/session hijacking. IPSG gives per-port IP validation – a client cannot pretend to have another IP.

ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
!
interface GigabitEthernet0/10
 ip verify source          ! classic IOS: ip verifysource
! static IP allowed via ACL:
ip access-list standard STATIC-IP
 permit 192.168.10.50
interface GigabitEthernet0/10
 ip verifysource acl STATIC-IP
show ip verify source
show ip dhcp snooping binding
show ip interface GigabitEthernet0/10

Exam tips ⚠️

Feature Protects against
DHCP snooping Rogue DHCP
DAI ARP spoofing
IP Source Guard IP spoofing
Port security MAC spoofing
Tagged , ,