I am using 802.1x authentication with dynamic Vlan assignment(CPPM). As you may know, when a user logges in to their computer, SW attaches the user port to related Vlan. Thinking the scenario in which machine authenticated (no user logged in) port is in Vlan 10, for example. And, when Tom logges in, the port is attached to Vlan 20. My problem is arp-protection; I want to apply arp-protection on those swithces but it does not allow new Vlan attachment because there will be two entry on dhcp snoop binding that triggers arp-protection as an arp-spoof clue.
To overcome the problem what should I do? Any technical practice or advice is welcome.