I'm trying to work out how to enable dhcp snooping and dynamic arp inspection on our guest network and I'm a little confused....

Here's the situation:

We have a hub and spoke topology, with a main core switch connecting to multiple layer 3/distribution switches. The edge switches all carry guest network traffic on guest vlan 10. That traffic is then separated from the rest of the network on layer 3 via a VRF. Between each distribution switch and the main core is a different guest network vlan, vlan 8xx. The access layer switches are Cisco 2960S and the core/distribution switches are 4507's.

The dhcp server connects to the main core.

I know I need to enable dhcp snooping on vlan 10 and set the trunk interfaces as trusted interfaces, but where I'm confused is at the distribution layer where it passes to the vrf. Do I need to also enable snooping on the vrf guest vlans (8xx)?

1 Answer 1


If no DHCP clients are connected directly to your distribution or core then you wouldn't need to configure DHCP snooping there. You would just configure your access layer switches to untrust every port except for your uplinks to the distribution switches.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.