A network administrator discovers that an attacker on the LAN is sending forged ARP replies to associate the attacker's MAC address with the default gateway's IP, allowing the attacker to intercept traffic. DHCP snooping is already enabled on the switch. Which additional Layer 2 security feature should be configured to mitigate this specific attack?