DAI & IP Source Guard — the Binding-Table Duo

Dynamic ARP Inspection validates every ARP packet on untrusted ports against the DHCP snooping binding table — forged “I am the gateway” replies (ARP spoofing / MITM) are dropped. Trusted ports skip validation. ip arp inspection vlan 10,20 interface Gi1/0/24 ip arp inspection trust IP Source Guard closes the other half: on untrusted ports, frames […]

DHCP Snooping — Rogue Servers & the Binding Table

The switch becomes an active DHCP referee: untrusted ports (all by default) may send Discover/Request; Offers and ACKs only come from trusted ports. Rogue DHCP server on a desk switch simply gets its replies dropped. ip dhcp snooping ip dhcp snooping vlan 10,20 interface Gi1/0/24 ip dhcp snooping trust ! optional armour: ip dhcp snooping […]

Port Security — Sticky MACs & Violation Modes

Per access port: learn/limit MACs, act on violations. Default violation mode is shutdown (err-disable); protect drops silently, restrict drops and logs. interface Gi1/0/1 switchport mode access switchport port-security switchport port-security maximum 2 switchport port-security mac-address sticky switchport port-security violation shutdown switchport port-security aging time 10 type inactivity Sticky converts learned MACs into config — survives […]

ACL Design & Troubleshooting — Placement, Order, Counters

Design law: extended near the source, standard near the destination — stop unwanted traffic before it crosses the network. Named ACLs with sequence numbers for editable production lists; least privilege; no accidental permit ip any any. Types: standard = source only; extended = proto + src/dst + ports; time-range ACLs for business-hours rules; prefix-lists/route-maps when […]

Routing Protocol Authentication & Passive Interfaces

If routing updates are unauthenticated, anyone on-path can inject a better route. Per-interface (IGP) or per-session (BGP) authentication fixes it — and a mismatch simply means no adjacency, which is also how you spot a partially-broken design. ! EIGRP key chain AUTH key 1 key-string cisco123 interface Gi0/0 ip authentication mode eigrp 100 md5 ip […]

CoPP — Protecting the CPU That Protects Everything

Packets destined to the router (OSPF, BGP, SSH, SNMP, ARP, ICMP-to-interface) get punted to the CPU. Without protection, one ICMP flood overloads the CPU, adjacencies flap — data plane healthy, network dead. CoPP rate-limits the punts. Only protects traffic addressed to the device. Transit traffic is not CoPP’s job. Implements as plain MQC: named ACLs […]