Examkin

Question

Difficulty: MediumLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

A network engineer completes the configuration of Layer 2 security features on a Cisco Catalyst switch connecting client workstations to an upstream router. After enabling DHCP snooping and Dynamic ARP Inspection (DAI) globally and on VLAN 20, client devices on untrusted access ports fail to obtain IPv4 addresses from the DHCP server, and ARP packets arriving from the default gateway on interface GigabitEthernet0/1 are discarded by DAI. Which two configuration steps are required on interface GigabitEthernet0/1 to resolve these issues? (Select two.)

  1. Configure `ip dhcp snooping trust` on interface GigabitEthernet0/1 to allow incoming DHCP server offer and acknowledgment messages.Answer
  2. Configure `ip arp inspection trust` on interface GigabitEthernet0/1 to bypass DAI validation for incoming ARP traffic from the router.Answer
  3. C
    Change the native VLAN on interface GigabitEthernet0/1 to match VLAN 20 to bypass Layer 2 inspection processes.
  4. D
    Configure `ip helper-address` on the client-facing access interfaces to relay DHCP requests directly to the server.

Answer

Configure `ip dhcp snooping trust` and `ip arp inspection trust` on interface GigabitEthernet0/1.
When DHCP snooping and DAI are enabled on a VLAN, interfaces default to an untrusted state. Uplink interfaces connected to legitimate DHCP servers and routers must be configured as trusted using `ip dhcp snooping trust` and `ip arp inspection trust` so server replies and gateway ARP messages are permitted.

Step-by-Step Solution

1
Identify the cause of DHCP packet drops on uplink GigabitEthernet0/1.
By default, all switch interfaces are untrusted when DHCP snooping is enabled, causing the switch to drop incoming DHCP server reply messages (OFFER/ACK). Setting `ip dhcp snooping trust` on GigabitEthernet0/1 permits these responses.
Client ports require an authorized path to receive DHCP leases from the server.
2
Identify the cause of ARP packet drops on uplink GigabitEthernet0/1.
By default, DAI treats all ports as untrusted and intercepts all ARP traffic for validation against the DHCP snooping binding table. Setting `ip arp inspection trust` on GigabitEthernet0/1 bypasses this check for legitimate router ARP messages.
Router ARP packets arriving from the core network might not exist in the local DHCP snooping binding table and will be dropped unless the interface is trusted.

Key Concept

Layer 2 Security Interface Trust States for DHCP Snooping and DAI
Estimated Time:1m 30s
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic