DHCP Snooping, Port Security and Storm Control Playbook

What problem these features solve

Access ports are where unmanaged endpoints enter the network. A user can accidentally connect a small router, loop two ports, flood broadcasts, or introduce an unauthorised DHCP server. Managed switches provide controls that limit the damage and make the event visible.

DHCP snooping

DHCP snooping distinguishes trusted directions, where legitimate server replies are expected, from untrusted client-facing ports. Cisco's Catalyst 9000 guidance states that interfaces are untrusted by default and shows the uplink toward the DHCP server configured as trusted. The switch builds a binding table from observed DHCP exchanges and can rate-limit DHCP messages on untrusted ports.

Cisco IOS XE example

ip dhcp snooping
ip dhcp snooping vlan 10,20,30

interface GigabitEthernet1/0/48
 description Uplink-to-DHCP-path
 switchport mode trunk
 ip dhcp snooping trust

interface GigabitEthernet1/0/7
 description STAFF-07
 switchport mode access
 switchport access vlan 10
 ip dhcp snooping limit rate 15

The rate value above is an example only. Choose a rate appropriate to the device and platform, and verify how phones, PXE clients or other boot processes behave before applying a restrictive threshold broadly.

Verify

show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping statistics

Port security

Port security can limit or identify MAC addresses accepted on an access port. It can be useful where a port is expected to serve one fixed endpoint or a tightly controlled device set. It is less suitable for locations where docking stations, hypervisors, phones with downstream PCs, or legitimate device changes create multiple MAC addresses.

What works

• Use it where the expected endpoint count is understood.
• Choose the violation behaviour deliberately.
• Document sticky or manually configured MAC addresses.
• Have a recovery process for legitimate hardware replacement.

What does not work

• Setting maximum MAC count to one on a phone-plus-PC port without understanding the topology.
• Using shutdown violation mode everywhere without operational monitoring.
• Leaving old sticky MAC entries after replacing devices.

Storm control

Storm control can rate-limit or react to excessive broadcast, multicast or unknown-unicast traffic. Cisco documents percentage, bps and pps style thresholds depending on platform, with optional trap or shutdown actions. Threshold selection should be based on normal measured traffic and the switch's implementation, not a universal percentage copied from another site.

Example

interface GigabitEthernet1/0/20
 storm-control broadcast level pps 5000
 storm-control multicast level pps 5000
 storm-control action trap

This is a syntax example, not a recommended threshold. Measure the site first.

Client benefit

Correct access-layer controls reduce the chance that one rogue DHCP server, broadcast loop or accidental device connection takes down an entire VLAN. They also create logs and state that make incidents easier to diagnose.

Acceptance checklist

• Trusted DHCP ports match the actual server path.
• No ordinary client-facing port is trusted without a reason.
• Binding table populates for expected VLANs.
• Port-security limits match the endpoint topology.
• Storm thresholds are based on observed normal traffic.
• Violation actions are monitored and documented.