It is mentioned that DAI check for correct IP/MAC combination using the DHCP binding database. It is also mentioned that DAI is turned on for an entire VLan and not on a per port basis.
- If PCA (macA,ipA) was originally connected to port1 ( binding - macA,ipA,port1 ) and PCA was relocated to port2 with its original macA,ipA.
Will DAI take port into consideration when checking the binding in the database? Will DAI block PCA now, since it is on port2 - but PCA (macA, ipA still remain the same)?
- What's the point of having DAI when we can enable IP Source with port security?
I have added a static binding using (e.g.)
"ip source binding xxx1.yyy1.zzz1 vlan4 192.168.1.1 interface gi1/0/1"
After which my host with the static ip (192.168.1.1) started to send traffic through since (DAI checked the DHCP binding database). (it is unable to send traffic before addin the static binding)
Once the traffic ping through, I move the connected port from gi1/0/1 to gi1/0/2 (since it is a static configuration), there is no dhcp involved and the static binding did not reflect the updated port (to gi1/0/2) and it still worked. ( I also done a arp -d on the host and ping to new host , so it will do an arp request )
q1) From the test above, can I conclude that DAI checks only IP/MAC combi but not the port ?
q2) I realize my static entry in ip source binding is not reflected in dhcp snoop binding table, so can I say that dhcp snoop binding table is a subset of the ip source binding table ? (since ip source binding contain static entry too) It also seems like the DAI references the source binding table (since my static entry works after adding it in), is there any difference between source binding and dhcp snoop table ?
q3) Lastly, I could not understand why when we activate ip source guard + port security, there is a need to turn on option82 in the switch ? Why would the adding of "port-security" require option 82 setting ? ?