Dynamic ARP Inspection

Bundle lab · $29.99

Harden the Layer-2 access edge by enabling Dynamic ARP Inspection (DAI) on a single access switch. DHCP Snooping is already in place and the uplink toward the DHCP server/gateway is trusted. Your job: enable DAI for VLAN 10 and trust the uplink so ARP on host-facing ports is validated against the DHCP Snooping bindings.

Track

CCNA

Est. time

35 minutes

Difficulty

Intermediate

Topics

CCNA, Switching, Layer 2 Security, DHCP Snooping, Dynamic ARP Inspection

Learning objectives

Explain how DAI uses the DHCP Snooping binding table to validate ARP
Enable DAI for a specific VLAN while preserving a correct trust boundary
Trust the uplink toward the DHCP server/gateway and leave host-facing ports untrusted
Verify DAI state and port roles using show commands

Troubleshooting focus

Forgetting to trust the uplink for DAI causes legitimate upstream ARP to be inspected and can drop traffic
Enabling DAI on the wrong VLAN yields no protection on the target VLAN
If DHCP Snooping is not enabled for the VLAN, DAI has no bindings and will drop ARP from untrusted ports
Mismatched access VLAN assignments on host ports prevent DHCP from working, so no bindings are learned

Topology

Own this lab's topology — and every lab — in Layer 2 Security Hardening.

Unlock with Layer 2 Security Hardening

What's included in the package

Work / baseline CML import — lab-work.yaml
Topology diagram — topology.svg
Print-ready topology diagram (PDF) — topology.pdf
Step-by-step learner guide (Markdown — for Obsidian/VS Code) — lab-guide.md
Branded PDF lab guide — open in any viewer (Adobe/Preview) — lab-guide.pdf
Getting-started README — README.md
Verification checklist — verification-checklist.md

Download access

New here? See how the download → build in CML → grade loop works.

This lab is part of the Layer 2 Security Hardening bundle — own every lab in it permanently for a one-time $29.99.

Own the Layer 2 Security Hardening bundle — $29.99 Sign in Back to archive Today's lab

Create a free account, then own the Layer 2 Security Hardening bundle for a one-time $29.99 — buy once, keep every lab forever.

Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.

Grade your work

Create a free account to submit your completed lab for grading.

Create a free account

Dynamic ARP Inspection

Learning objectives

Troubleshooting focus

Topology

Related labs

Study this topic

Grade your work