DHCP Snooping Rate Limiting

Bundle lab · $29.99

Harden the Layer-2 access edge by rate-limiting DHCP messages on untrusted ports. SW1 already has DHCP snooping enabled for VLAN 10 with the uplink trusted. Your task is to apply a per-interface rate limit on the host-facing access ports to blunt DHCP starvation attacks while leaving the trusted uplink unlimited.

Learning objectives

• Identify the DHCP snooping trust boundary on an access switch
• Apply deterministic DHCP rate limiting to untrusted access ports only
• Avoid rate-limiting the trusted uplink toward the legitimate DHCP server
• Verify configuration with show ip dhcp snooping and per-interface settings
• Explain how exceeding the limit triggers errdisable and how to observe it

Troubleshooting focus

• If hosts fail to obtain an address, confirm the uplink is trusted and not rate-limited
• If a port goes down unexpectedly, check for errdisable due to dhcp-rate-limit
• If show output does not list a rate on the access ports, the limit was not applied at interface scope
• If the DHCP server stops working, ensure the rate limit was not configured on the uplink