DEV Community

Frank Zhang
Frank Zhang

Posted on

Hardening Enterprise Layer 2: How DHCP Snooping, DAI, and IP Source Guard Work in Tandem

#security #networking #sysadmin #infrastructure

When engineering network security, teams often fixate on perimeter firewalls, WAFs, and endpoint EDR agents. Yet, inside flat campus and branch networks, the Layer 2 broadcast domain remains one of the softest targets. Once a rogue actor plugs into an open Ethernet jack or lands on an internal SSID, the absence of Layer 2 verification turns the entire local subnet into a playground.

Without proper safeguards, an unprivileged attacker can:

  • Stand up a rogue DHCP server to distribute malicious default gateways and DNS servers.
  • Broadcast forged Gratuitous ARPs to execute Man-in-the-Middle (MitM) eavesdropping.
  • Forge arbitrary source IPs to launch spoofed volumetric attacks or bypass IP-based ACLs and log audits.

Access layer switches must do more than blindly forward frames—they must act as zero-trust gatekeepers for network identity. In enterprise designs, this resilience is built on three tightly coupled mechanisms: DHCP Snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG).

The Dependency Chain: One Source of Truth

These three features do not operate as isolated silos. Instead, they form a strict, hierarchical enforcement chain:

               +----------------------------------+
               |          DHCP Snooping           |
               | (Builds the Trusted State Table) |
               +-----------------+----------------+
                                 │
                 ┌───────────────┴───────────────┐
                 ▼                               ▼
  +-----------------------------+ +-----------------------------+
  | Dynamic ARP Inspection(DAI) | |   IP Source Guard (IPSG)    |
  |  Validates ARP frames via   | |  Injects dynamic TCAM PACLs |
  |       Control Plane         | |     to filter Source IPs    |
  +-----------------------------+ +-----------------------------+
Enter fullscreen mode Exit fullscreen mode

If DHCP Snooping fails to build or maintain an accurate binding database, both DAI and IPSG lose their reference point and fail to operate correctly.

Architectural Scenario & Packet Enforcement Flow

Below is a breakdown of how an access switch armed with this triad inspects both legitimate endpoints and hostile traffic across trusted and untrusted interfaces:

+--------------------------------------------------------------------------------------------------+
|                                    ENTERPRISE L2 SWITCH FABRIC                                   |
|                                                                                                  |
|   [Port Gi1/0/24: TRUSTED] <=============================> Legitimate Core / DHCP Server         |
|   - Allows incoming DHCP Offer / ACK messages                                                    |
|   - Bypasses DAI & IPSG inspection filters                                                       |
+--------------------------------------------------------------------------------------------------+
          ▲                                                   ▲
          │                                                   │
[Port Gi1/0/1: UNTRUSTED]                           [Port Gi1/0/2: UNTRUSTED]
          │                                                   │
+---------┴-----------------------+                 +---------┴-----------------------+
|        LEGITIMATE CLIENT        |                 |            ATTACKER             |
| MAC:  00:aa:bb:cc:dd:01         |                 | MAC:  00:de:ad:be:ef:99         |
| IP:   10.10.10.101 (via DHCP)   |                 | IP:   Self-assigned / Rogue     |
+---------------------------------+                 +---------------------------------+
  │                                                   │
  ├─ 1. DHCP DORA Handshake                           ├─ [ATTACK A] Rogue DHCP Server
  │     └─► Switch builds Binding Entry:              │     └─► Sends DHCP Offer
  │         [00:aa:bb:... | 10.10.10.101 | Gi1/0/1]   │         └─► DROPPED by DHCP Snooping
  │                                                   │
  ├─ 2. ARP Request / Reply                           ├─ [ATTACK B] ARP Poisoning / Spoofing
  │     └─► DAI checks Binding Database:              │     └─► Sends: "10.10.10.1 is at 00:de:ad:..."
  │         Matches entry -> PASSED                   │         └─► DROPPED by DAI (Sender mismatch)
  │                                                   │
  └─ 3. Standard IP Data Frames                       └─ [ATTACK C] IP Impersonation
        └─► IPSG checks TCAM filter:                        └─► Forges Source IP: 10.10.10.100
            Src IP = 10.10.10.101 -> FORWARDED                  └─► DROPPED by IPSG (Hardware line-rate)
Enter fullscreen mode Exit fullscreen mode

1. DHCP Snooping: Establishing the Binding Database

DHCP Snooping acts as a layer-2 stateful inspection engine for DHCP traffic. It performs two critical tasks:

  1. Rogue DHCP Mitigation: Switch ports are designated as either Trusted or Untrusted. All end-user access ports are Untrusted by default. If a DHCP server message (such as DHCPOFFER, DHCPACK, or DHCPNAK) arrives on an untrusted port, the switch discards it immediately. Only ports connecting directly to legitimate upstream DHCP servers or DHCP relays are configured as Trusted.
  2. Dynamic Database Construction: As valid endpoints complete the standard DORA exchange (Discover, Offer, Request, ACK), the switch snoops on the DHCPACK packet and records an entry in the DHCP Snooping Binding Table:
    • Client MAC Address
    • Leased IP Address
    • Lease Duration
    • VLAN ID
    • Ingress Physical Port 
MAC Address          IP Address       Lease(sec)  Type            VLAN  Interface
------------------   ---------------  ----------  --------------  ----  ------------------
00:aa:bb:cc:dd:01   10.10.10.101     86400       dhcp-snooping   10    GigabitEthernet1/0/1
Enter fullscreen mode Exit fullscreen mode

This binding database is the single source of truth for downstream filtering engines.

2. Dynamic ARP Inspection (DAI): Eliminating ARP Poisoning

The Address Resolution Protocol (ARP) is stateless and insecure by design. Any host can transmit an unsolicited Gratuitous ARP declaring ownership of an IP address, and adjacent hosts will blindly update their local ARP caches.

DAI remedies this by validating ARP traffic on all untrusted interfaces:

  • When an ARP frame enters an untrusted port, the switch intercepts it and checks the payload's Sender MAC and Sender IP fields against the DHCP Snooping Binding Table.
  • Match Found: The frame is forwarded normally.
  • Mismatch or Missing Record: The frame is dropped, and a violation is logged.

Operational Note on Control Plane Protection:

Unlike standard line-rate frame switching handled by ASICs, DAI requires the switch CPU to parse the ARP payload. A malicious host can easily flood thousands of forged ARP packets to overwhelm the switch processor. Always enforce ARP rate limiting on untrusted ports (typically 15–30 packets per second) to prevent control plane denial of service.

3. IP Source Guard (IPSG): Stopping Spoofed Packets in Hardware

DAI defends against ARP manipulation, but an attacker can still configure a static IP on their network interface and transmit raw IP packets directly (e.g., launching UDP floods or evading identity-based firewalls).

IP Source Guard addresses this vulnerability in the data plane:

  • When IPSG is enabled on an access interface, the port initially blocks all IP traffic except essential DHCP exchanges.
  • Once an endpoint receives an IP via DHCP, IPSG reads the snooping table and dynamically compiles a Port Access Control List (PACL) straight into the switch’s TCAM (Ternary Content-Addressable Memory).
  • Only frames whose source IP (and optionally, source MAC) match the active hardware entry are permitted. Mismatched packets are dropped at wire speed by the ASIC without consuming CPU cycles. 
DAI  ──► Inspects ARP payloads in software/CPU plane
IPSG ──► Filters IP packet headers in hardware/TCAM plane
Enter fullscreen mode Exit fullscreen mode

4. The Fallacy: Why Port Security Is Not Enough

A frequent misconception among administrators is that enabling Port Security eliminates the need for DHCP Snooping, DAI, and IPSG.

Port Security operates strictly at Layer 2:

  • It tracks how many source MAC addresses appear on a physical port and limits unauthorized MAC learning.
  • It is completely blind to Layer 3 and Layer 2.5 protocols.

If an employee brings an unauthorized device and clones their company-issued laptop’s MAC address, Port Security sees a legitimate MAC and permits the frame. That rogue device can then forge ARP packets or hijack another node's IP unimpeded.

Port Security prevents physical port piggybacking (such as an unmanaged mini-hub under a desk); it does not protect the integrity of network identities.

5. Production Pitfalls and Failure Modes

Deploying these protocols in enterprise environments without proper planning can easily cause network outages. Keep the following gotchas in mind:

Pitfall 1: Silent Drops on Static-IP Endpoints

Not every enterprise asset uses DHCP. Printers, IP cameras, video endpoints, building management systems, and specialized industrial controllers are often assigned static addresses.

Because these devices bypass the DHCP handshake, they never register in the DHCP Snooping database. Turning on DAI or IPSG indiscriminately will instantly blackhole them.

Mitigation:

Audit all non-DHCP assets prior to rollout. Define static bindings manually in the switch configuration or construct tailored ARP Access Lists (ARP ACLs) to explicitly authorize static hosts.

ip source binding 00:11:22:33:44:55 vlan 10 10.10.10.50 interface Gi1/0/5
Enter fullscreen mode Exit fullscreen mode

Pitfall 2: The "All Trunks Are Trusted" Assumption

A naive rule of thumb claims that Access ports are Untrusted, and Trunk ports are Trusted. This is dangerous.

The Trusted designation must be reserved exclusively for uplinks heading directly toward legitimate DHCP infrastructure. If an inter-switch trunk leading to a downstream access switch is marked as Trusted, any untrusted client connected to that downstream switch can bypass snooping checks if the edge switch is misconfigured.

Pitfall 3: Err-Disable Outages Caused by ARP Bursts

Operating systems frequently send sudden bursts of ARP requests upon waking from sleep or renegotiating connections. Furthermore, dual-homed setups (such as a laptop tethered to an IP Phone’s passthrough port) can generate bursts that exceed conservative rate limits.

If a port exceeds its configured ARP threshold, many switches automatically transition the interface to the err-disable state, causing complete loss of connectivity.

Mitigation:

Tune the burst rate thresholds based on port workload, and always enable automated recovery timers so ports recover without administrative intervention:

errdisable recovery cause arp-inspection
errdisable recovery interval 30
Enter fullscreen mode Exit fullscreen mode

6. Phased Rollout Blueprint

Do not enable all three features at once on an active production network. Adopt an Observe → Validate → Enforce strategy across distinct phases:

  1. Phase 1: Foundation (DHCP Snooping) Enable DHCP Snooping globally and define upstream uplinks as Trusted. Let the network run undisturbed for several days while reviewing the binding table to confirm leases are reliably captured.
  2. Phase 2: Static Inventory Reconciliation Cross-reference the binding table against network inventory. Create static binding entries or ARP ACLs for all non-DHCP infrastructure devices.
  3. Phase 3: DAI Canary Deployment Enable DAI on a single non-critical VLAN. Configure generous ARP rate limits and set DAI logging to notify on drops. Review the Syslog output to ensure legitimate nodes are not triggering violations before rolling it out across access VLANs.
  4. Phase 4: Hardware-Level Lockdown (IPSG) Apply IP Source Guard to client-facing access ports to seal IP spoofing vectors in the TCAM.
  5. Phase 5: Complementary Access Hardening Layer on supplemental port-level defenses:
    • 802.1X (NAC) for client authentication.
    • BPDU Guard & Root Guard to prevent spanning-tree manipulation.
    • Storm Control to suppress broadcast storms.

Summary

Layer 2 security cannot rely on a single magic toggle. True defense-in-depth requires cohesive, layered enforcement:

Threat Vector Mitigation Engine Inspection Layer
Rogue DHCP / Man-in-the-Middle DHCP Snooping Layer 7 (DHCP Payload)
ARP Cache Poisoning / Spoofing Dynamic ARP Inspection (DAI) Layer 2.5 (ARP Payload)
Source IP Impersonation / Leakage IP Source Guard (IPSG) Layer 3 (IP Header / TCAM)
MAC Flooding / Unauthorized Hardware Port Security / 802.1X Layer 2 (MAC / EAPOL)

By tying Layer 3 IP allocations to physical switch ports and Layer 2 MAC addresses, you transform your access switches from unauthenticated dumb pipes into an integrated zero-trust perimeter.

Top comments (0)