Layer 2 Security Hardening Topology

Lab Objective: Prevent rogue endpoints from acting as DHCP servers or spoofing ARP responses, and enforce dynamic MAC address binding to automatically shut down ports when unauthorized cable moves occur.

📁 Lab File: Download the Layer 2 Security Hardening Packet Tracer Lab (.pkt).

Topology

The topology uses a single Catalyst 2960 switch connecting legitimate endpoints, an authorized DHCP server, and a rogue device acting as a fake DHCP server.

Source DeviceInterfaceDestination DeviceInterfacePort Security Role
PC0 (Legitimate Host)Fa0Switch0Fa0/1Untrusted (Sticky MAC)
Server1 (Rogue DHCP/Host)Fa0Switch0Fa0/2Untrusted (Sticky MAC)
PC1 (Legitimate Host)Fa0Switch0Fa0/3Untrusted (Sticky MAC)
Server0 (Legitimate DHCP)Fa0Switch0Fa0/24Trusted (Infrastructure)

Global Configuration (Switch)

Enable DHCP Snooping and DAI globally, then mark the DHCP server port (Fa0/24) as trusted.

enable
configure terminal
hostname Switch0

! --- Enable DHCP Snooping Globally and per VLAN ---
ip dhcp snooping
ip dhcp snooping vlan 1
no ip dhcp snooping information option

! --- Enable Dynamic ARP Inspection (DAI) ---
ip arp inspection vlan 1
ip arp inspection validate src-mac dst-mac ip

! --- Configure Trusted Port ---
interface FastEthernet0/24
 description Legitimate DHCP Server Uplink
 ip dhcp snooping trust
 ip arp inspection trust
exit

Access Port Configuration (Untrusted Ports) - (Switch)

Access interfaces (Fa0/1 - 3) handle untrusted endpoint traffic. Port security binds each port to its first learned MAC address; any violation triggers a port shutdown.

! --- Secure Access Interfaces ---
interface range FastEthernet0/1 - 3
 switchport mode access
 switchport access vlan 1
 switchport port-security
 switchport port-security mac-address sticky
 switchport port-security violation shutdown
exit

Verification

Validate the security using show commands on Switch0.

  1. Verify the DHCP Snooping Binding Table:

    Confirm the switch successfully logs IP-to-MAC bindings for legitimate dynamic leases:

    Switch0# show ip dhcp snooping binding
MacAddress            IpAddress         Lease(sec)  Type           VLAN  Interface
------------------    ----------------  ----------- -------------- ----- --------------------
00:01:C9:2C:43:C5     192.168.1.101     86400       dhcp-snooping  1     FastEthernet0/1
Total number of bindings: 1

    Result: The binding table contains IP-to-MAC mappings that DAI uses to validate ARP traffic.

  2. Verify Dynamic ARP Inspection Status:

    Check the validation and operational status for VLAN 1:

    Switch0# show ip arp inspection vlan 1

Source Mac Validation      : Enabled
Destination Mac Validation : Enabled
IP Address Validation      : Enabled

Vlan    Configuration    Operation    ACL Match    Static ACL
----    -------------    ---------    ---------    ----------
   1    Enabled          Active

Vlan    ACL Logging      DHCP Logging    Probe Logging
----    -----------      ------------    -------------
   1    Deny             Deny            Off

    Result: ARP inspection is active on VLAN 1 with src-mac, dst-mac, and IP validation enabled.

  3. Verify Port Security Interface State:

    Inspect the operational state and sticky MAC binding on access interface Fa0/1:

    Switch0# show port-security interface fa0/1
Port Security              : Enabled
Port Status                : Secure-up
Violation Mode             : Shutdown
Aging Time                 : 0 mins
Aging Type                 : Absolute
SecureStatic Address Aging : Disabled
Maximum MAC Addresses      : 1
Total MAC Addresses        : 1
Configured MAC Addresses   : 0
Sticky MAC Addresses       : 1
Last Source Address:Vlan   : 0001.C92C.43C5:1
Security Violation Count   : 0

    Result: Interface Fa0/1 is Secure-up with 0001.C92C.43C5 learned dynamically as a sticky MAC address.