1

Consider the following scenario

  • I have 2 switches, A and B connected via Po1 (LACP).
  • IP DHCP Snooping turned on for both Switch-A and Switch-B.
  • Dynamic ARP Inspection trust is configured on (Ppo1) on both switches.
  • PC-A is originally connected to Switch-A (port24), and it retrieve DHCP IP address assigned from the uplink of Switch-A (say Router-A).
  • DHCP binding table (SwitchA) is populated with PC-A binding.
  • DHCP binding table (SwitchB) is not populated with PC-A bindings.

......... Sometime later ........

User moves PC-A and plugs it into Switch-B which has no binding information for PC-A. PC-A tries to communicate with a PC-B on Switch-A.

Assume PC-A and Switch-B has MAC address of PC-B in their MAC table. What will happen when Switch A receives a packet/frame from Po1 (coming from PC-A via SwitchB)? -- Switch-A has a binding for PC-A at port 24, but trusted Po1 as well.

Will PC-A be able to communicated with PC-B after moving to Switch-B?

Improve this question
3
  • Switches do not share the DHCP snooping database, and you need to configure trust on the connected interfaces of the switches for this to work correctly.
    – Ron Maupin ♦
    Sep 19, 2017 at 16:07
  • @RonMaupin thanks for your reply. so am i right to say host A if connected to another switchport in SwitchA will be blocked (by DAI) but there will be no impact at all if hostA move to switchB and talk to another host on switch B
    – Noob
    Sep 19, 2017 at 16:10
  • I posted an answer.
    – Ron Maupin ♦
    Sep 19, 2017 at 16:13

1 Answer 1

Reset to default
1

Dynamic ARP Inspection and IP Source Guard require DHCP Snooping to function.

What happens, assuming you do not have trust configured between the switches is that PC-A will not work when connected to Switch-B because Switch-A knows the IP address of PC-A belongs only on the original interface to which it was connected on Switch-A.

The DHCP Snooping on each switch is independent of the other switch; the switches do not share this information. You configure it on each switch, and you configure trust for that between the switches. Each switch then manages this for the devices connected to itself, and trusts that the other switch is doing the same.

Edit:

You have really changed the question. (Bad form; you should ask a new question instead of changing the original question, which was already answered. If you want a discussion, then use Network Engineering Chat because this is not a discussion forum.)

If PC-A (originally on Switch-A) is moved to Switch-B, and trust exists between the switches, then PC-A will continue to work correctly. Switch-B didn't originally have PC-A in its database, and now it does, and Switch-A trusts traffic from Switch-B.

Note:

The switches have MAC address tables, but the PCs do not. PCs are layer-3 devices, and they maintain ARP tables, while switches, as layer-2 devices, do not. The switches have MAC address table to tell them to which interfaces a MAC address belong, but the PCs have ARP table to tell them which MAC address belongs to which IP address. A switch MAC address table will be updated every time it receives a frame on an interface.

Improve this answer
1
  • noted on the edit and my bad on the pc portion (yeap they do not have mac table)
    – Noob
    Sep 19, 2017 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.