Harden the access switch
Finish hardening SW1's user ports (fa0/1 - fa0/3) and uplink (Gi0/1):
- Port security on every user port: access mode, sticky, max 1, default (shutdown) violation.
- DHCP snooping on VLAN 1, option 82 off, uplink trusted; PC1 must still lease.
- Dynamic ARP inspection on VLAN 1, uplink trusted, so a poisoned ARP from PC2 is dropped.
- Broadcast storm control at 30% on the user ports.
- An RA guard policy
HOSTS(device-role host) on the user ports.
How it works: this is VulnTech NetLab, a network simulator running in your browser. Click a device in the diagram to open its console and type commands, just like on real equipment (? shows help, Tab finishes a word). Click a cable to inspect it. Tasks tick themselves off as you complete them; questions are answered in the box under each task. Your work is kept if you reload; Reset starts the network over.
Solution explanation
The order matters: DHCP snooping must be on (and PC1 must lease) before DAI has a binding to trust. The uplink is trusted for both snooping and DAI; the user ports carry port security, storm control and the RA guard host policy. A poisoned ARP from PC2, a rogue DHCP server, a MAC flood, a broadcast storm and a rogue IPv6 RA are now all stopped at the edge.
Show solution
[SW1]
enable
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 1
no ip dhcp snooping information option
ip arp inspection vlan 1
ipv6 nd raguard policy HOSTS
device-role host
exit
interface g0/1
ip dhcp snooping trust
ip arp inspection trust
exit
interface range fa0/1 - 3
switchport mode access
switchport port-security
switchport port-security mac-address sticky
storm-control broadcast level 30.00
ipv6 nd raguard attach-policy HOSTS
exit
end
[PC1]
sudo dhclient eth0
[SW1]
show ip dhcp snooping binding
show ip arp inspection