9 hands-on Layer 2 Security scenarios you build in your own Cisco Modeling Labs instance and grade against the answer key. Layer 2 Security configuration and troubleshooting practice for CCNA and CCNP.
Included with a subscription
Harden a small campus Layer-2 triangle so a downstream access switch cannot become root. You will verify DSW1 is already the STP root for VLAN 20, then apply Root Guard on each distribution switch’s access-facing trunk to the access layer. Confirm steady-state reachability between users and that a superior BPDU would put those ports into root-inconsistent instead of re-rooting the campus.
Harden Dynamic ARP Inspection (DAI) on an access switch by enabling additional packet validation checks: source MAC, destination MAC, and IP sanity. The uplink toward the DHCP server/gateway is trusted, access ports are untrusted. DHCP Snooping and baseline DAI are already enabled for VLAN 10; your task is to add the global DAI validation knobs and verify the change deterministically via show commands.
Advanced Layer-2 security capstone. Neither PC on the access switch can get an address, and the help desk has already 'checked the DHCP server'. You get the symptoms and the requirements — no fault list. Work from show output to find every misconfiguration across the switch and the router, repair them, and prove both hosts recover. Several faults are layered: fixing the first one changes the symptom without ending the outage.
Harden the campus access edge by isolating same-switch hosts using protected ports. You will configure switchport protected on both host-facing access interfaces so PC1 and PC2 cannot communicate at Layer 2, while all endpoints still reach the default gateway R1. This is a deterministic Layer-2 security control that mimics lightweight private-VLAN isolation on a single switch. Focus is on SW1 only; R1 and hosts are pre-provisioned.
Harden the Layer-2 access edge by enabling DHCP Snooping on a single access switch and placing the trust boundary only toward the legitimate DHCP server/gateway. Validate with show commands and end-host connectivity.
Free with an account
Layer 2 Security Hardening, Lab 9/10. You will enable automatic errdisable recovery on a campus access switch so ports shut down by Layer-2 security (Dynamic ARP Inspection, DHCP rate-limit, or storm control) can return to service automatically after a safe interval. The switch already enforces DHCP snooping with a correct trust boundary, DAI validation, and broadcast/multicast/unicast storm-control with shutdown actions. Your job: turn on errdisable auto-recovery for arp-inspection, dhcp-rate-limit, and storm-control, and set the interval to 60 seconds. Verify with show errdisable recovery.
Harden the Layer-2 access edge by deploying a unified trust boundary for DHCP Snooping and Dynamic ARP Inspection (DAI) on a single access switch. R1 is both the default gateway and DHCP server for VLAN 10. You will enable DHCP Snooping and DAI globally for VLAN 10 and set the same uplink interface as trusted for both features, leaving host-facing access ports untrusted. This lab emphasizes the dependency and synergy between DHCP Snooping and DAI for blocking rogue DHCP/ARP activity. Grade scope: SW1 config only.
Harden the Layer-2 access edge by rate-limiting DHCP messages on untrusted ports. SW1 already has DHCP snooping enabled for VLAN 10 with the uplink trusted. Your task is to apply a per-interface rate limit on the host-facing access ports to blunt DHCP starvation attacks while leaving the trusted uplink unlimited.
Harden the Layer-2 access edge by enabling Dynamic ARP Inspection (DAI) on a single access switch. DHCP Snooping is already in place and the uplink toward the DHCP server/gateway is trusted. Your job: enable DAI for VLAN 10 and trust the uplink so ARP on host-facing ports is validated against the DHCP Snooping bindings.
Most security effort points outward at the perimeter, but the access layer is where an attacker is already inside the broadcast domain. From a single unsecured switch port you can exhaust the CAM table, hand out DHCP leases pointing at yourself, or poison ARP so traffic between two other hosts flows through your laptop first. None of these need a sophisticated tool, and none of them are visible from the router.
These labs make those attacks concrete and then shut them down on real Cisco IOS. You'll configure port security with maximum MAC counts, sticky learning and violation actions, build a DHCP snooping trust boundary so only the real server's offers survive, and layer dynamic ARP inspection on top of the snooping binding table so ARP replies have to agree with a lease that was actually issued. The order matters and the labs teach it in that order, because DAI depends on the binding table snooping builds. Verification uses show port-security, show ip dhcp snooping binding and show ip arp inspection, and grading checks the trust boundary is drawn in the right place — trusting the wrong port is the classic mistake and it silently disables the entire protection.
DAI validates ARP replies against the DHCP snooping binding table. Without snooping populating that table first, DAI has nothing to check against, so the two features are configured and taught together.
Only the ones facing the real DHCP server or another switch on the path to it. Trusting an access port that faces users defeats the feature entirely — which is exactly what several of these labs have you diagnose.
It bounds how many MAC addresses can appear on a port and what happens when that is exceeded, which stops CAM-table exhaustion and casual unauthorised devices. It is not authentication — 802.1X is the answer to that question.
Study the theory behind these labs — the concept explainer and step-by-step guides.
Looking for something else? Browse the full lab archive, narrow it to self-standing labs, or see today's daily lab.