Exercise 8: Advanced Network Security – Secure
Management, DHCP Snooping & Dynamic ARP
Inspection
Objective
Harden a switched network by securing management access, preventing rogue DHCP servers, and
mitigating ARP spoofing using DHCP Snooping and Dynamic ARP Inspection (DAI).
Step 1: Build Advanced Secure Topology
Devices: 2960 Switch (Core-Switch), Router, DHCP Server, Admin-PC, User-PC, Attacker-PC. Use
Copper Straight-Through cables.
Step 2: VLAN Creation and Port Assignment
Switch> enable
Switch# configure terminal
Switch(config)# hostname Core-Switch
Switch(config)# vlan 10
Switch(config-vlan)# name MANAGEMENT
Switch(config-vlan)# exit
Switch(config)# vlan 20
Switch(config-vlan)# name USERS
Switch(config-vlan)# exit
! Admin-PC
Switch(config)# interface fastethernet0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 10
Switch(config-if)# exit
! User and Attacker PCs
Switch(config)# interface range fastethernet0/2-3
Switch(config-if-range)# switchport mode access
Switch(config-if-range)# switchport access vlan 20
Switch(config-if-range)# exit
! DHCP Server
Switch(config)# interface fastethernet0/24
Switch(config-if)# switchport mode access
Switch(config-if)# switchport access vlan 20
Switch(config-if)# exit
Step 3: Secure Switch Management (SSH Only)
Core-Switch(config)# ip domain-name [Link]
Core-Switch(config)# crypto key generate rsa
Core-Switch(config)# username admin privilege 15 secret SecureAdmin@123
Core-Switch(config)# service password-encryption
Core-Switch(config)# banner motd # AUTHORIZED ACCESS ONLY #
Core-Switch(config)# line vty 0 4
Core-Switch(config-line)# login local
Core-Switch(config-line)# transport input ssh
Core-Switch(config-line)# exit
Step 4: Router-on-a-Stick Configuration
Router> enable
Router# configure terminal
Router(config)# hostname KASNeb-Router
Router(config)# interface gigabitethernet0/0.10
Router(config-subif)# encapsulation dot1Q 10
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Router(config)# interface gigabitethernet0/0.20
Router(config-subif)# encapsulation dot1Q 20
Router(config-subif)# ip address [Link] [Link]
Router(config-subif)# exit
Router(config)# interface gigabitethernet0/0
Router(config-if)# no shutdown
Router(config-if)# exit
Step 5: DHCP Snooping Configuration
Core-Switch(config)# ip dhcp snooping
Core-Switch(config)# ip dhcp snooping vlan 20
Core-Switch(config)# interface fastethernet0/24
Core-Switch(config-if)# ip dhcp snooping trust
Core-Switch(config-if)# exit
Step 6: Dynamic ARP Inspection (DAI)
Core-Switch(config)# ip arp inspection vlan 20
Core-Switch(config)# interface fastethernet0/24
Core-Switch(config-if)# ip arp inspection trust
Core-Switch(config-if)# exit
Step 7: Verification Commands
show vlan brief
show ip dhcp snooping
show ip dhcp snooping binding
show ip arp inspection
show ip arp inspection statistics
show logging
Step 8: Save Configuration
Core-Switch# copy running-config startup-config
KASNeb-Router# copy running-config startup-config
Student Tasks
1. Explain how DHCP Snooping protects the network. 2. Describe the role of Dynamic ARP
Inspection. 3. Identify trusted vs untrusted ports. 4. Recommend two additional Layer 2 security
controls.
Expected Learning Outcomes
Students will secure switch management, prevent rogue DHCP attacks, mitigate ARP spoofing, and
apply enterprise-grade Layer 2 security controls.