← All articles

LAN EDGE SECURITY · 27 OCTOBER 2026

DHCP snooping, DAI and IP Source Guard: a commissioning worksheet

A segmented LAN can still be disrupted by an accidental DHCP server, forged ARP messages or a device using another host's IPv4 address. DHCP snooping, Dynamic ARP Inspection and IP Source Guard form a linked first-hop security system, but a wrong trust boundary or an incomplete binding table can also disconnect legitimate users. This worksheet focuses on safe design, staged activation and proof at handover.

Cyber FTTH Mart · Engineering worksheet · 11-minute read

Visual reference photographs

Illustrative enterprise access-switch rack used for DHCP and ARP security controls
First-hop controls depend on a documented path from each access port to the authorized DHCP service.
Illustrative labeled network patching used to map access ports and trusted uplinks
Physical labels must map cleanly to switch ports, VLANs, clients and security exceptions.
Illustrative managed enterprise network supporting protected wired access
Commission controls on the real switch topology, including trunks, relays and redundant paths. All photographs are illustrative, not completed Cyber FTTH Mart project evidence.

Understand the dependency chain

DHCP snooping observes DHCP exchanges on selected VLANs, rejects invalid server-side messages arriving from untrusted ports and builds a binding database containing details such as VLAN, client MAC address, leased IPv4 address, interface and lease time. Dynamic ARP Inspection, commonly called DAI, uses those bindings to validate ARP messages. IP Source Guard uses bindings or supported static entries to filter source traffic on untrusted Layer 2 interfaces.

The order matters. If the binding table is empty or incomplete, DAI and IP Source Guard may treat valid traffic as untrusted. Cisco's current guidance explicitly links both controls to the DHCP snooping database, while Juniper notes that enabling DAI or IP Source Guard can automatically enable DHCP snooping on supported platforms. Confirm the behavior of the exact switch model and software release before applying a template.

Dependency record: VLAN · authorized DHCP server · relay or gateway · trusted path · binding source · static-host method · DAI scope · source-guard scope · persistence method · rollback owner.

Draw the trust boundary port by port

Trust only interfaces that legitimately carry DHCP server responses, normally the server-facing or upstream path. Do not mark every trunk as trusted by habit. In stacked, multi-chassis or redundant designs, trace every valid server response path during normal operation and failover. Platform behavior can differ, and Juniper documents limitations for some DAI and IP Source Guard combinations in MC-LAG scenarios.

Create a matrix for access ports, uplinks, server ports, wireless access-point trunks, IP-phone pass-through ports, hypervisor connections and inter-switch links. Record which VLANs cross each port and whether DHCP client or server messages are expected. The trust decision must follow the traffic role, not the physical cable label alone.

Inventory clients that will not create dynamic bindings

Printers, CCTV cameras, access-control panels, building controllers, NVRs, servers and infrastructure devices often use static IPv4 addresses. They may not appear in a DHCP snooping table. If DAI or IP Source Guard is enabled without a supported static binding, ARP ACL or other documented exception, these devices can lose connectivity.

For every static endpoint, record switch, port, VLAN, IPv4 address, MAC address, owner and approved exception method. Avoid broad bypasses that weaken an entire VLAN. Cisco advises against applying its static-host IP Source Guard function on uplink or trunk ports. Keep exceptions narrow and test them after reload.

Plan binding persistence and recovery

Dynamic bindings have a lifecycle tied to DHCP leases. A switch reload, stack change or control-plane event can temporarily leave dependent inspection features without the entries they need. Cisco recommends a DHCP snooping database agent where supported so bindings can be retained, and warns that lost dynamic bindings can interrupt connectivity when DAI or IP Source Guard remains active.

Document the storage destination, write interval, reachability, file ownership and behavior when the database cannot be read or written. Test a controlled reload during commissioning. Confirm whether clients recover through lease renewal, persisted bindings or another supported method, and record the time to restore normal service.

Calculate safe DHCP rate limits

Rate limiting on untrusted ports can reduce DHCP starvation attempts, but an arbitrary low value can block valid bursts after a building power restoration. Estimate the busiest credible event rather than copying a default.

Expected DHCP message rate per access port = maximum simultaneous clients × expected DHCP messages per client ÷ renewal window in seconds

Example: an access-point port serving 80 clients, with an assumed four DHCP messages per client over a 20-second recovery window, produces an estimated average of 16 messages per second. Apply a documented safety margin and confirm vendor-specific counting behavior. This example is illustrative, not a universal limit.

Shared device ports, wireless AP trunks and downstream switches need different treatment from a single-user wall outlet. Monitor violation counters during a staged pilot before enforcing the final threshold.

Stage activation instead of making one blind change

  1. Back up the switch configuration and capture the current topology, VLAN and DHCP paths.
  2. Enable DHCP snooping only on a pilot VLAN and verify authorized leases.
  3. Confirm trusted and untrusted ports using live counters and packet evidence.
  4. Verify dynamic bindings for representative wired and wireless clients.
  5. Add approved static-host bindings or ARP exceptions using the platform-supported method.
  6. Enable DAI on the pilot VLAN and test valid and forged ARP behavior.
  7. Enable IP Source Guard on selected access ports and test valid, changed and spoofed source addresses.
  8. Expand by VLAN or access-switch block while watching drops, help-desk incidents and recovery behavior.

Run positive and negative acceptance tests

A positive test proves that authorized clients still work. Verify lease acquisition, renewal, gateway ARP, DNS, application access, roaming where relevant, IP-phone operation and static-device connectivity. Test after port flap, client reboot, switch reload and upstream-path failover where those events are in scope.

A negative test proves that enforcement works without harming production. In an isolated test port and approved maintenance window, connect a controlled unauthorized DHCP service and verify that offers from the untrusted port are dropped. Test a mismatched IPv4-to-MAC binding and a source address not present in the authorized table. Record the drop reason, interface counter, log or alert, and recovery after the test configuration is removed.

Never run spoofing tests against live tenant, resident, payment, life-safety or security-control networks without an approved test plan and isolation. The objective is evidence, not disruption.

Separate IPv4 and IPv6 controls

DAI is an IPv4 ARP control. IPv6 uses Neighbor Discovery rather than ARP, and clients may use SLAAC, DHCPv6 or both. A site using IPv6 needs a separate design for controls such as RA Guard, DHCPv6 Guard, IPv6 source guard and Neighbor Discovery inspection where supported. Do not label an IPv4-only deployment as complete LAN first-hop security.

Commissioning worksheet

  1. Authorized DHCP servers, relays and gateways are listed by VLAN.
  2. Every trusted port has a documented traffic reason.
  3. Access, trunk, AP, phone, hypervisor and downstream-switch ports are classified.
  4. Representative DHCP clients appear with correct VLAN, MAC, IPv4 address and interface bindings.
  5. Static cameras, printers, controllers and servers have narrow approved exceptions.
  6. Binding persistence and post-reload recovery are verified.
  7. DHCP rate limits are based on client density and recovery demand.
  8. Valid DHCP discovery, offer, request, acknowledgement and renewal behavior is witnessed.
  9. An unauthorized server test is blocked on an isolated untrusted port.
  10. DAI permits valid ARP and rejects an approved forged-binding test.
  11. IP Source Guard permits valid traffic and rejects an unauthorized source address.
  12. Normal operation is retested after port flap, switch reload and planned failover.
  13. Drop counters, logs and alerts identify the tested interface and reason.
  14. IPv6 use is either covered by separate controls or explicitly recorded as out of scope.
  15. Rollback commands, owners, backups and exception expiry dates are included in handover.

Minimum handover pack

Provide the topology, VLAN and DHCP-service matrix, port trust schedule, binding database evidence, static-host register, rate-limit rationale, persistence settings, configuration backup, positive and negative test results, logs, counter snapshots, reload and failover results, IPv6 scope statement, exception register and rollback plan. Link the record to the VLAN and switch handover worksheet, IP addressing and DHCP worksheet and wired 802.1X and NAC worksheet.

Primary technical references

Hardening a managed LAN for a commercial property or campus?

Share the switch models, topology, VLAN plan, DHCP path and device inventory. We can coordinate access switching, structured cabling, fiber uplinks, endpoint mapping and commissioning records around the actual operating environment.

Discuss LAN edge security ↗