Cisco APIC Security Configuration Guide, Release 6.2(x)

First-hop security

Updated: April 17, 2026

Want to summarize with AI?

Describes how first-hop security features protect IPv4 and IPv6 address assignment and link operations from unauthorized devices and malicious endpoints on Layer 2 networks.

First-hop security (FHS) is a set of features that secures IPv4 and IPv6 address management and link operations on Layer 2 networks.

FHS provides these capabilities:

FHS controls address assignment, Duplicate Address Detection, and address resolution.
FHS mitigates threats such as man-in-the-middle attacks and IP address theft by building a secure endpoint database.
FHS is enabled per tenant bridge domain and supports bridge domains deployed on one or multiple leaf switches.

First-hop security features

These features secure network protocols and help build the endpoint database on fabric leaf switches:

Table 1. Supported first-hop security features
Feature	Behavior
ARP inspection	Intercepts, logs, and discards ARP packets that contain invalid MAC address-to-IP address bindings.
ND inspection	Learns and secures bindings for stateless autoconfiguration addresses in Layer 2 neighbor tables.
DHCP inspection	Validates DHCP messages from untrusted sources and filters invalid messages.
RA Guard	Blocks or rejects unwanted or rogue router advertisement (RA) messages.
IPv4 and IPv6 source guard	Blocks data traffic from unknown sources.
Trust control	Distinguishes trusted devices under administrative control from untrusted sources. Switches, routers, and servers in the fabric are typically trusted. Host ports and devices outside the network are typically untrusted.

First-hop security measures

FHS provides these security measures:

Table 2. First-hop security measures
Measure	Purpose
Role enforcement	Prevents untrusted hosts from sending messages outside the scope of their role.
Binding enforcement	Prevents address theft.
Denial-of-service attack mitigation	Prevents malicious endpoints from exhausting the endpoint database and disrupting network services.
Proxy services	Improves the efficiency of address resolution.

VMware VMM domain support

Beginning with Cisco APIC Release 6.0(2), FHS is supported on VMware distributed virtual switch (DVS) virtual machine manager (VMM) domains.

To enforce FHS within an EPG, enable intra-EPG isolation. Without intra-EPG isolation, endpoints in the same VMware ESX port group can bypass FHS. FHS continues to protect endpoints in different port groups and prevents a compromised virtual machine from poisoning the ARP table of a virtual machine in another port group.

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.