CCNA Foundations: DHCP Snooping — Trust the Right Edge Ports

Today's daily lab

Harden the access layer against rogue DHCP servers by enabling DHCP snooping on an L2 access switch and trusting only the legitimate server-facing port. You will validate that client access ports remain untrusted and that rogue DHCP offers are dropped while legitimate offers are permitted.

Learning objectives

• Explain how DHCP snooping protects against rogue DHCP servers at the access edge
• Enable DHCP snooping globally and for the user VLAN on a Cisco IOS L2 switch
• Designate only the server/uplink-facing port as trusted; keep client-facing ports untrusted
• Validate the behavior with show commands and optional host-side DHCP discovery
• Relate legitimate vs rogue DHCP offers to snooping trust state

Troubleshooting focus

• Clients fail to obtain leases when snooping is enabled but the correct server-facing port is not trusted
• Rogue DHCP server offers are blocked only on untrusted ports in VLANs where snooping is active
• Snooping is inert if not enabled globally and per-VLAN