Examkin

Question

Difficulty: HardLayer 2 Security Features (Port Security, DHCP Snooping, DAI)

An administrator attempts to secure VLAN 20 on a Cisco Catalyst switch by executing the commands `ip dhcp snooping vlan 20` and `ip arp inspection vlan 20`. Access interface GigabitEthernet0/2 is in VLAN 20 and remains in its default untrusted state for both security features. Clients connected to GigabitEthernet0/2 are configured with static IP addresses, but all outgoing ARP packets from these clients are intercepted and dropped by the switch, preventing any network communication. Which root cause explains why Dynamic ARP Inspection (DAI) is dropping this ARP traffic?

  1. Global DHCP snooping was not activated using the `ip dhcp snooping` command, causing the DHCP binding database to remain unpopulated and DAI to reject all ARP packets on untrusted ports.Answer
  2. B
    Port security was configured with sticky MAC address learning on GigabitEthernet0/2, but the administrator failed to save the running configuration to the startup configuration.
  3. C
    The access port GigabitEthernet0/2 has a native VLAN mismatch with the upstream switch trunk link, causing DAI to inspect ARP frames against the incorrect VLAN context.
  4. D
    The `ip helper-address` command was misconfigured directly on GigabitEthernet0/2 rather than on the Layer 3 Switched Virtual Interface (SVI) for VLAN 20.

Answer

Global DHCP snooping was not activated using the `ip dhcp snooping` command, preventing the switch from building the DHCP binding database required by Dynamic ARP Inspection (DAI) to validate ARP packets on untrusted ports.
The correct option explains that Dynamic ARP Inspection (DAI) depends directly on the DHCP snooping binding database to inspect ARP packets received on untrusted ports. Enabling DHCP snooping on a VLAN (`ip dhcp snooping vlan 20`) without executing the global `ip dhcp snooping` command leaves DHCP snooping globally disabled. As a result, the switch does not build a binding database. When DAI is enabled on VLAN 20 (`ip arp inspection vlan 20`), it intercepts all ARP packets on untrusted ports; because the binding table is empty and no ARP ACL is defined for static hosts, DAI drops all incoming ARP packets.

Step-by-Step Solution

1
Analyze how Dynamic ARP Inspection (DAI) validates ARP packets.
DAI inspects incoming ARP requests and responses on untrusted ports and verifies the sender IP and MAC addresses against the DHCP Snooping Binding Database (or configured ARP ACLs).
Untrusted ports drop ARP packets if no corresponding IP-to-MAC entry exists in the binding table.
2
Evaluate the switch configuration sequence provided in the scenario.
The administrator configured `ip dhcp snooping vlan 20`, but omitted the global `ip dhcp snooping` command.
In Cisco IOS, VLAN-level DHCP snooping does not take effect unless DHCP snooping is enabled globally.
3
Determine the impact on static IP hosts on untrusted ports.
Because global DHCP snooping is disabled, no DHCP binding database is built. Additionally, statically assigned hosts generate no DHCP transactions to populate the database.
Without static ARP ACL mappings or an active DHCP binding database entry, DAI drops all ARP traffic on untrusted interfaces like GigabitEthernet0/2.

Key Concept

Dynamic ARP Inspection (DAI) reliance on the DHCP Snooping Binding Database and global feature enablement prerequisites.
Rate this question

Topics

Layer 2 Security Features (Port Security, DHCP Snooping, DAI)

More questions from this topic