Goldfish Networks wordmark
AdvancedPublished 2026-07-04

Defense in Depth: DHCP Snooping + DAI

Bundle lab

Harden the Layer-2 access edge by deploying a unified trust boundary for DHCP Snooping and Dynamic ARP Inspection (DAI) on a single access switch. R1 is both the default gateway and DHCP server for VLAN 10. You will enable DHCP Snooping and DAI globally for VLAN 10 and set the same uplink interface as trusted for both features, leaving host-facing access ports untrusted. This lab emphasizes the dependency and synergy between DHCP Snooping and DAI for blocking rogue DHCP/ARP activity. Grade scope: SW1 config only.

Track
Est. time
40 minutes
Difficulty
Advanced
Topics

Learning objectives

  • Establish a single, consistent trust boundary for DHCP Snooping and DAI on an access switch
  • Enable DHCP Snooping and DAI globally for a specific user VLAN
  • Apply trust on the uplink while keeping access ports untrusted
  • Verify feature state and alignment with show commands and basic reachability tests

Troubleshooting focus

  • If ARP is being dropped, verify that ip dhcp snooping is enabled globally and for the correct VLAN
  • Confirm the uplink to the DHCP server/gateway is trusted for BOTH snooping and DAI
  • Ensure VLAN 10 exists and all access ports are in VLAN 10 so DHCP bindings, if generated, match the host ports
  • Check that DAI is enabled for the same VLAN(s) as DHCP Snooping

Topology

Subscribe to preview this lab's topology.

See plans

Related labs

More hands-on Cisco Modeling Labs practice on the same track and topics.

Study this topic

Free guides, a command cheat sheet, and graded practice for this lab's topic.

Learn Device Security & SSH

Grade your work

How this lab is graded
  • Build it your way. Where a lab lets you choose a value — a VLAN name, an interface description — grading checks that you configured it, not which name you picked. Names that another line has to reference, like an ACL applied with access-class, are stated in the guide and do have to match.
  • Addresses, modes and protocol keywords are exact. An IP address, a subnet mask, switchport mode trunk, an encapsulation — these carry the meaning of the lab, so they are graded as written in the guide.
  • Grading reads your saved configuration. Export the lab from CML after you have configured it, and make sure anything you set is in the running-config — a change that only exists in a terminal session never reaches the grader.
  • You can submit as many times as you like. Your best score stands, and each attempt tells you which checks passed so you can work the gaps.
  • Scored something you believe is correct? Use Report an issue on this page — that is exactly how the grading fixes in the changelog got found.

Create a free account to submit your lab for grading.

Create a free account
Found a problem with this lab?

Please sign in to report a problem — tying it to your attempts lets us reproduce and fix it faster.