A trusted port is an interface where a security feature permits specific control messages without inspection. DHCP Snooping allows all DHCP messages received on trusted ports, while Dynamic ARP Inspection (DAI) allows all ARP messages received on trusted ports. All ports are untrusted by default, so trust must be configured deliberately. section 13.2.1 section 14.2.1
Configure trust according to the feature and the direction of the connection:
- For DHCP Snooping, trust ports leading toward the DHCP server; leave ports toward end hosts untrusted so server messages such as OFFER, ACK, and NAK can be discarded from those ports. section 13.2.1
- For DAI, trust ports connected to network infrastructure such as routers and switches; leave end-host ports untrusted so ARP messages are inspected. section 14.2.1
- Trusting a port bypasses the relevant message inspection, so trusting an end-host port can allow rogue DHCP or spoofed ARP traffic. section 13.2.1 section 14.2.1
- DHCP Snooping and DAI use different trust guidelines: a switch-to-switch port can be untrusted for DHCP Snooping but trusted for DAI. section 14.2.1
Configure and verify a trusted interface
For DHCP Snooping, enter interface configuration mode and apply `ip dhcp snooping trust`. For DAI, apply `ip arp inspection trust` instead. Verification displays the resulting state: `show ip dhcp snooping` reports GigabitEthernet0/1 as `Trusted yes`, while `show ip arp inspection interfaces` reports it as `Trusted`.
