L2 Security Troubleshooting Capstone: Trust Boundary

Bundle lab

Advanced Layer-2 security capstone. Neither PC on the access switch can get an address, and the help desk has already 'checked the DHCP server'. You get the symptoms and the requirements — no fault list. Work from show output to find every misconfiguration across the switch and the router, repair them, and prove both hosts recover. Several faults are layered: fixing the first one changes the symptom without ending the outage.

Learning objectives

• Diagnose a DHCP outage end to end from operational state alone, without a list of what was broken
• Read DHCP Snooping and Dynamic ARP Inspection state to locate a trust boundary that is inverted in two directions
• Recognise that DHCP Snooping stamps Option 82 by default and that a non-relay server drops those requests
• Find a second-order fault that only becomes visible once the first is fixed, rather than stopping at the first success
• Correct configuration on whichever device is at fault — the switch is not the only suspect

Troubleshooting focus

• Correlate DHCP failure symptoms (no lease) with DHCP Snooping trust on the uplink
• Correlate legitimate ARP drops with DAI enforcement and missing/incorrect trust placement
• Leverage show ip dhcp snooping, show ip dhcp snooping binding, show ip arp inspection, and show running-config interface to triangulate the boundary