DHCP Snooping, Dynamic ARP Inspection (DAI), and IP Source Guard (IPSG) are complementary Layer 2 security features that protect against spoofing and man-in-the-middle attacks. They build on each other — DHCP Snooping is the foundation.

How They Work Together

DHCP Snooping builds a binding database of (MAC, IP, VLAN, Port)
  ├─ DAI uses the database to validate ARP packets
  └─ IPSG uses the database to filter IP traffic on access ports

Enable them in this order: DHCP Snooping → DAI → IPSG.

DHCP Snooping

DHCP Snooping filters DHCP messages by treating some ports as trusted (where legitimate DHCP servers connect) and others as untrusted (where clients connect).

Configuration

! Enable DHCP snooping globally
ip dhcp snooping
 
! Enable for specific VLANs
ip dhcp snooping vlan 10,20,30
 
! Trust the port where the DHCP server is connected
interface Gi0/24
 ip dhcp snooping trust
 
! All other ports are untrusted by default
! Optionally set rate limit on untrusted ports
interface range Gi0/1-22
 ip dhcp snooping limit rate 10

DHCP Snooping Binding Database

! Verify bindings
show ip dhcp snooping binding
 
MacAddress        IpAddress       Lease   Type       VLAN  Interface
----------------  ------------    ------  ---------  ----  ------------
0050.7966.6801    192.168.10.10   86400   dhcp-snoop 10    GigabitEthernet0/1
0050.7966.6802    192.168.10.11   86400   dhcp-snoop 10    GigabitEthernet0/2
0050.7966.6803    192.168.20.10   86400   dhcp-snoop 20    GigabitEthernet0/3

Each entry maps a MAC address to an IP, VLAN, and port. When a host moves to a different port, the old entry is cleared.

Verify DHCP Snooping Statistics

show ip dhcp snooping statistics
show ip dhcp snooping

What DHCP Snooping Prevents

Dynamic ARP Inspection (DAI)

DAI intercepts ARP packets on untrusted ports and validates them against the DHCP Snooping binding database. Invalid ARP packets are dropped.

Configuration

! Enable DAI for specific VLANs
ip arp inspection vlan 10,20,30
 
! Trust the port connecting to the router/switch (upstream)
interface Gi0/24
 ip arp inspection trust
 
! All other ports are untrusted by default
! Validate MAC address consistency
ip arp inspection validate src-mac dst-mac ip

DAI Validation Options

ip arp inspection validate src-mac       ! Check source MAC matches ARP body
ip arp inspection validate dst-mac       ! Check destination MAC matches ARP body
ip arp inspection validate ip            ! Check IP addresses are valid

Enable all three for maximum protection:

ip arp inspection validate src-mac dst-mac ip

DAI Verification

show ip arp inspection
show ip arp inspection interfaces
show ip arp inspection statistics
show ip arp inspection vlan 10

DAI Statistics

show ip arp inspection statistics vlan 10

Vlan     Forwarded    Dropped     DHCP Drops  ACL Drops
----     ---------    -------     ----------  ---------
10       15234        23          23          0

ACL Stats for VLAN 10:
  Interface     ACL    Forwarded    Dropped
  ---------     ---    ---------    -------
  Gi0/1         -      4500         0
  Gi0/2         -      3200         0

Any dropped ARP packets should be investigated.

What DAI Prevents

IP Source Guard (IPSG)

IPSG filters IP traffic on a per-port basis, allowing only traffic from the IP/MAC learned by DHCP Snooping.

Configuration

! Enable IPSG on access ports
interface range Gi0/1-22
 ip verify source
 ip verify source port-security

The ip verify source command filters based on source IP matching the DHCP snooping binding. Adding port-security also validates the source MAC.

IPSG with Static IP Hosts

For devices with static IPs, create manual bindings:

ip source binding 0050.7966.6899 vlan 10 192.168.10.99 interface Gi0/5

Or use an ACL on the port:

interface Gi0/5
 ip verify source
 ip source binding 0050.7966.6899 vlan 10 192.168.10.99

IPSG Verification

show ip verify source
show ip source binding
show ip verify source interface Gi0/1

Output:

Interface  Filter-type  Filter-mode  IP-address       Mac-address        Vlan
---------  -----------  -----------  ---------------  -----------------  ----
Gi0/1      ip-mac       active       192.168.10.10    0050.7966.6801     10
Gi0/2      ip-mac       active       192.168.10.11    0050.7966.6802     10
Gi0/3      ip-mac       active       192.168.20.10    0050.7966.6803     20

What IPSG Prevents

Deployment Order

Follow this sequence to avoid disruption:

! Step 1: Enable DHCP Snooping
ip dhcp snooping
ip dhcp snooping vlan 10,20,30
interface Gi0/24
 ip dhcp snooping trust
no interface Gi0/24
interface Gi0/24
 ip dhcp snooping trust
 
! Step 2: Verify DHCP bindings are populated
show ip dhcp snooping binding
 
! Step 3: Enable DAI
ip arp inspection vlan 10,20,30
interface Gi0/24
 ip arp inspection trust
ip arp inspection validate src-mac dst-mac ip
 
! Step 4: Enable IPSG
interface range Gi0/1-22
 ip verify source

Deploy on one VLAN at a time and verify that legitimate traffic is not dropped.

Troubleshooting

Scenario 1: “IP phones not getting DHCP addresses”

show ip dhcp snooping statistics
# DHCP packets dropped: 523
 
show ip dhcp snooping | include Gi0/2
# Gi0/2 is untrusted

The port connecting to the DHCP server (or the upstream switch that relays DHCP) must be trusted. If the DHCP server is on a different switch, trust the uplink port.

Scenario 2: “ARP inspection blocking valid traffic”

show ip arp inspection statistics vlan 10 | include Dropped
# Dropped: 45
 
show ip arp inspection vlan 10
# ACL drops: 0, DHCP drops: 45

The DHCP binding is missing for those devices. Check if they use static IPs — add manual bindings.

Scenario 3: “Host can not ping after IPSG enabled”

show ip verify source interface Gi0/5
# Interface  Filter-type  Filter-mode  IP-address  Mac-address  Vlan
# Gi0/5      ip-mac       active       none        none         10

No binding exists for that port. The device may have a static IP or the DHCP lease expired.

DHCP Snooping Binding Database Backup

The binding database is stored in memory by default. On reload, it is lost and must be rebuilt as devices renew DHCP leases.

! Persistent storage for DHCP bindings (requires USB flash)
ip dhcp snooping database flash:/dhcp-snooping-db
write memory

Recovery on reload is automatic from the flash file.

Rate Limiting Recommendations

interface Gi0/1
 ip dhcp snooping limit rate 10
 ip arp inspection limit rate 15

Best Practices

• Deploy all three features together — Each one fills gaps the others miss
• Trust only uplink ports — Every access port should be untrusted
• Use rate limiting — Prevent DoS on the control plane
• Enable all DAI validations — src-mac dst-mac ip
• Create static bindings for static IPs — Avoid false positives
• Monitor drop counters — Unexpected drops indicate an attack or misconfiguration
• Save the DHCP snooping database — Prevents service disruption after reload
• Disable on management VLAN — DAI on the management VLAN can lock you out if the switch has a static management IP

Quick Reference