A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
SW1(config)# interface gi0/1SW1(config-if)# switchport port-securitySW1(config-if)# switchport port-security maximum 2SW1(config-if)# switchport port-security violation restrictSW1(config-if)# switchport port-security mac-address stickySW1(config-if)# exitSW1(config)# ip dhcp snoopingSW1(config)# ip dhcp snooping vlan 10,20SW1(config)# interface gi0/24SW1(config-if)# ip dhcp snooping trustSW1(config-if)# ip arp inspection trustSW1(config-if)# exitSW1(config)# ip arp inspection vlan 10,20
Lab 8 layers security on the Lab 3 topology. Configure extended ACLs to restrict inter-VLAN traffic — for example, only the IT subnet can reach the server VLAN. Configure port security on access ports to prevent MAC flooding. Configure DHCP snooping and DAI to prevent rogue DHCP and ARP spoofing.
Configure the ACL and Layer 2 security features. Verify each: check ACL hit counters, check port-security state, check DHCP snooping binding table. Then test: try to send an ARP reply spoofing the gateway from a client — should be dropped by DAI. Try to exceed port security MAC limit — port should enter restrict mode.
Layer 2 security isn't just configuration — it's a mindset. Every port that could be attacked needs to be protected. Every trusted resource needs to be explicitly trusted. The two mistakes above are the two most common in real deployments: trusting a port that shouldn't be trusted, and forgetting to trust the port that should be.
Finish the lesson once you have worked through the material. This awards ★ 20 XP.
Select each vulnerable line, then classify the finding.
Findings
Review target: 15 lines · 2 expected findings