Layer 2 Security Controls Quick Reference for CCNA 200-301 v2.0

Cisco's published 200-301 v2.0 blueprint requires configuration of Dynamic Host Configuration Protocol (DHCP) snooping, Dynamic ARP Inspection (DAI), storm control, IPv6 Router Advertisement (RA) Guard, and port security. Cisco says v2.0 begins February 3, 2027.

These controls are easier to separate when you start with the role of the switchport. A client-facing port should not suddenly behave like a DHCP server, IPv6 router, or unrestricted source of arbitrary MAC addresses.

1. Layer 2 security decision map

2. Use DHCP snooping to control the address-assignment path

DHCP snooping distinguishes ports that are allowed to carry DHCP server replies from ports that are expected to behave as clients.

• Trusted: path toward a legitimate DHCP server or relay
• Untrusted: typical client-facing port

Example:

ip dhcp snooping
ip dhcp snooping vlan 10,20
!
interface GigabitEthernet1/0/48
 ip dhcp snooping trust

Useful verification:

show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping statistics

The binding table is important because it records learned relationships such as MAC address, assigned IP address, VLAN, and interface.

Trust the infrastructure path that should carry legitimate server messages. Trusting a client-facing port simply to stop DHCP snooping from dropping traffic defeats the purpose of the control.

3. Treat DAI as ARP validation built on trusted information

Dynamic ARP Inspection validates Address Resolution Protocol (ARP) messages against trusted information, commonly the DHCP snooping binding table.

Example:

ip arp inspection vlan 10,20
!
interface GigabitEthernet1/0/48
 ip arp inspection trust

Useful evidence:

show ip arp inspection
show ip arp inspection interfaces
show ip arp inspection statistics
show ip dhcp snooping binding

DHCP snooping and DAI solve different problems:

Static-address devices require deliberate design because they may not have DHCP snooping bindings. Depending on the supported design, ARP ACLs or another valid source of bindings may be needed.

Do not solve a static-host problem by trusting every client port.

4. Use storm control to limit excessive Layer 2 traffic

Storm control monitors selected traffic levels on an interface and acts when configured thresholds are exceeded.

Traffic categories can include:

• Broadcast
• Multicast
• Unknown unicast

A platform-supported example might look like:

interface GigabitEthernet1/0/10
 storm-control broadcast level 1.00 0.50
 storm-control multicast level 1.00 0.50

The first value is a rising threshold and the second is a falling threshold in this style of configuration.

Verification can include:

show storm-control
show storm-control interface GigabitEthernet1/0/10
show logging

Storm control limits impact. It does not explain why the storm exists. A loop, malfunctioning device, or attack still needs investigation.

5. Use RA Guard to protect the IPv6 router role

IPv6 Router Advertisement messages can tell hosts about routers and prefixes. A client-facing host should not normally be able to present itself as the local IPv6 router.

A policy example:

ipv6 nd raguard policy HOST-PORT
 device-role host
!
interface GigabitEthernet1/0/10
 ipv6 nd raguard attach-policy HOST-PORT

Useful verification:

show ipv6 nd raguard policy
show running-config interface GigabitEthernet1/0/10
show logging

The role matters. An actual router-facing interface and a host-facing interface should not receive the same treatment merely because both carry IPv6.

RA Guard protects Router Advertisement behavior. It is not a replacement for IPv6 routing, Neighbor Discovery, or every other IPv6 security control.

6. Use port security when the edge has predictable MAC behavior

Port security limits which Media Access Control (MAC) addresses may use a switchport and defines what happens when the rule is violated.

Example:

interface GigabitEthernet1/0/10
 switchport mode access
 switchport access vlan 20
 switchport port-security
 switchport port-security maximum 2
 switchport port-security mac-address sticky
 switchport port-security violation restrict

Common violation modes:

Verify:

show port-security
show port-security interface GigabitEthernet1/0/10
show mac address-table interface GigabitEthernet1/0/10
show interfaces status err-disabled

Sticky learning places learned secure MAC addresses into the running configuration. If the learned entries are intended to survive reload, the configuration must be saved deliberately.

Port security fits stable edge-port expectations better than links that legitimately carry many changing MAC addresses, such as some uplinks and virtualized hosts.

7. Keep the control dependencies visible

Some Layer 2 controls depend on state created elsewhere.

A useful dependency chain is:

DHCP snooping → binding information → DAI validation

That means a DAI problem can originate in:

• DHCP snooping not enabled for the correct VLAN
• Binding missing or incorrect
• Static host not represented in the expected binding source
• Wrong trusted/untrusted interface
• DAI applied to the wrong VLAN or interface role

Other controls are more independent:

• Storm control depends on configured traffic thresholds and interface behavior.
• RA Guard depends on IPv6 device-role policy and interface attachment.
• Port security depends on secure-MAC learning/configuration, maximums, violation mode, and aging.

Do not troubleshoot the last control in the chain without verifying the state it relies on.

8. IOS evidence map

9. Scenario comparisons

A user connects a small DHCP server to an access port

DHCP snooping should treat that client-facing port as untrusted and prevent it from becoming an unauthorized server path.

DAI drops ARP from a statically addressed printer

Check whether the printer has valid binding information for the design. Do not immediately trust the access port.

Broadcast traffic spikes and affects the switch

Storm control can limit the selected traffic category while you investigate the loop, malfunction, or attack that caused the spike.

An IPv6 host advertises itself as a default router

RA Guard on the host-facing port is the relevant control.

A desk port is expected to learn one workstation and one phone

Port security can allow a planned maximum and enforce a defined violation response. The maximum should match the actual edge design.

A port is error-disabled after a new device appears

Check port-security state and violation evidence before treating the physical link as failed.

10. Common exam traps

• Trusting every uplink-looking port without checking what device or role is actually attached.
• Trusting a client port to make DHCP snooping or DAI "work."
• Treating DHCP snooping and DAI as the same control.
• Forgetting that DAI commonly depends on DHCP snooping bindings.
• Ignoring static-address devices in a DAI design.
• Treating storm control as the root-cause fix for a Layer 2 storm.
• Applying RA Guard without considering whether the attached device is a host or router.
• Assuming port-security protect, restrict, and shutdown produce the same operational evidence.
• Forgetting to save sticky secure MAC information when persistence is intended.
• Using strict port-security assumptions on an interface that legitimately carries many changing MAC addresses.
• Diagnosing an error-disabled port as a cabling problem before checking security violations.

11. Rapid review grid

12. Official references

• Cisco 200-301 CCNA v2.0 Exam Topics
• Cisco DHCP Snooping Configuration
• Cisco Dynamic ARP Inspection Configuration
• Cisco Storm Control Configuration
• Cisco IPv6 Router Advertisement Guard
• Cisco Port Security Configuration