5.4Layer 2 security

Even if you harden L3 and above with firewalls and ACLs, an attacker who plugs a device into an internal-LAN switch port can carry out Layer 2 attacks such as MAC flooding, a rogue DHCP server, and ARP spoofing. Because L2 attacks occur "within the same segment," L3 controls cannot stop them. This section covers the three representative L2 security features you should enable on access switches, focusing on "which attack each one stops and by what mechanism."

5.4.1Port security

• Port security limits the number and identity of MAC addresses allowed on an access port. When the allowed count is exceeded or a disallowed MAC appears, it is handled as a "violation." The baseline config is switchport mode access → switchport port-security → switchport port-security maximum N (the maximum). The default maximum is 1.
• Allowed MACs can be registered manually (switchport port-security mac-address ADDRESS) or via sticky MAC (switchport port-security mac-address sticky), which dynamically learns the first MAC into the allow list and saves it to the running-config. This pins "the legitimate device currently connected" without manual entry.
• The violation action is chosen from three via switchport port-security violation. protect silently drops violating frames (no log or counter increment). restrict drops violating frames and sends an SNMP trap/Syslog and increments the counter. shutdown (the default) puts the port into an err-disabled state, shutting it down, and notifies; recovery requires shutdown then no shutdown, or errdisable recovery.

5.4.2DHCP snooping and DAI

• DHCP snooping has the switch monitor DHCP messages to prevent a rogue DHCP server from handing out a fake default gateway, etc. It classifies ports as trusted/untrusted, marking only uplinks toward the legitimate DHCP server as trusted. DHCP server replies (OFFER/ACK) arriving on an untrusted port are dropped. Enable with ip dhcp snooping plus ip dhcp snooping vlan X, and ip dhcp snooping trust on trusted ports.
• DHCP snooping records legitimately issued leases in a binding table (a mapping of MAC, IP, VLAN, port, and lease info). This table becomes the foundation for DAI, described next.
• Dynamic ARP Inspection (DAI) prevents man-in-the-middle attacks via ARP spoofing (ARP poisoning). It inspects ARP packets received on untrusted ports against the DHCP snooping binding table and drops forged ARP whose IP-MAC mapping is inconsistent. Thus DAI depends on DHCP snooping, and in dynamic environments snooping must be enabled first (static environments use ARP ACLs). Enable with ip arp inspection vlan X.

Suppose you operate the internal access switches and are investigating an incident on one floor: "some users suddenly lost internet access, and their traffic is suspected of being eavesdropped." You find that someone connected a small router to an empty conference-room port and (A) that router acts as a rogue DHCP server distributing a fake default gateway, and (B) it also forges ARP replies to lure victims' traffic through itself (the attacker) in a man-in-the-middle attack. Mitigating both attacks at once takes more than a single feature. For (A), the rogue DHCP, enable DHCP snooping and trust only the uplink toward the legitimate DHCP server while leaving user-side ports untrusted, so forged DHCP replies (OFFER/ACK) arriving on untrusted ports are dropped. For (B), the ARP spoofing, enable DAI—but the key is the dependency that DAI validates IP-MAC legitimacy by referencing the binding table that DHCP snooping builds. In other words, DAI will not work correctly unless DHCP snooping is enabled first. Additionally, to deter "plugging an unauthorized device into an empty port" in the first place, limit the allowed MAC count with port security and handle violations with restrict (drop + notify) or shutdown, detecting and blocking the unauthorized connection itself. The crux of the judgment is to combine, in layers rather than singly, "rogue DHCP = DHCP snooping," "ARP spoofing = DAI (but dependent on snooping)," and "unauthorized physical connection = port security."

5.4.3Section summary

• Port security limits allowed MACs; on violation choose protect (silent drop), restrict (drop + notify), or shutdown (default, err-disabled). Sticky MAC saves learned MACs to config
• DHCP snooping eliminates rogue DHCP via trusted/untrusted ports and records legitimate leases in a binding table
• DAI prevents ARP spoofing but depends on DHCP snooping because it references the binding table (snooping must be enabled first)