From a networking course I am following, I've learned that in D. ARP Inspection, ports connected to routers or to other switches should be configured as trusted while the user ports should remain untrusted. enter image description here

Why isn't this the same with DHCP Snooping? enter image description here

The course states that in case of DHCP Snooping, all downlink ports should be left untrusted.

However, couldn't the port on SW2 that connects to SW1 simply be configured as trusted, too? Since SW1 would already inspect any DHCP messages before sending them to SW2.

1 Answer 1


Yes, it could. If the interlink isn't trusted downstream, the IP-MAC combinations are checked twice.

Whether your security policy requires that, makes it optional, or even disallows that is up to that policy. Given clean core/edge roles for the switches I'd check on access only.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.