I'm using Cisco 3750s, with DAI and DHCP Snooping enabled.

We have a couple.. lets say "overly inexpensive" IP phones in the building that will periodically loose their lease and not attempt to renew while still using the same IP address. If we were in the building we'd just look up the MAC and reboot the device. This isn't possible with COVID-19.

That lost lease causes the DHCP snooping to fire, which then makes its way into our SIEM and causes some confusion.

Anyways... Shouldn't the port be put into errdisable from this happening? I haven't seen anything indicating this is working.

CiscoStack1(config)#do sh ip arp ins log
Total Log Buffer Size : 32
Syslog rate : 5 entries per 1 seconds.

Interface   Vlan  Sender MAC      Sender IP        Num Pkts   Reason        Time
----------  ----  --------------  ---------------  ---------  ------------  ----
Gi3/0/35    22    0008.5d6e.d4e1           1  DHCP Deny     13:19:17 UTC Thu Apr 23 2020

show ip arp inspection

Source Mac Validation      : Enabled
Destination Mac Validation : Enabled
IP Address Validation      : Enabled

 Vlan     Configuration    Operation   ACL Match          Static ACL
 ----     -------------    ---------   ---------          ----------
   22     Enabled          Active

 Vlan     ACL Logging      DHCP Logging      Probe Logging
 ----     -----------      ------------      -------------
   22     Deny             Deny              Off

 Vlan      Forwarded        Dropped     DHCP Drops      ACL Drops
 ----      ---------        -------     ----------      ---------
   22      140732088       12858535       12772795              0

CiscoStack1#sh errdisable recovery
ErrDisable Reason            Timer Status
-----------------            --------------
arp-inspection               Enabled
Timer interval: 300 seconds

Interfaces that will be enabled at the next timeout:

CiscoStack1#sh ip arp inspection interfaces GigabitEthernet 3/0/35

 Interface        Trust State     Rate (pps)    Burst Interval
 ---------------  -----------     ----------    --------------
 Gi3/0/35         Untrusted               15                 1

Although DHCP snooping and ARP inspection are related, dependent features, they do different things.

DHCP snooping filters DHCP packets on untrusted ports

The switch drops a DHCP packet when one of these situations occurs:

A packet from a DHCP server, such as a DHCPOFFER, DHCPACK, DHCPNAK, or DHCPLEASEQUERY packet, is received from outside the network or firewall.

A packet is received on an untrusted interface, and the source MAC address and the DHCP client hardware address do not match.

The switch receives a DHCPRELEASE or DHCPDECLINE broadcast message that has a MAC address in the DHCP snooping binding database, but the interface information in the binding database does not match the interface on which the message was received.

A DHCP relay agent forwards a DHCP packet that includes a relay-agent IP address that is not, or the relay agent forwards a packet that includes option-82 information to an untrusted port.

It also builds a list of leases to be used by ARP inspection.

ARP inspection

  • Intercepts all ARP requests and responses on untrusted ports

  • Verifies that each of these intercepted packets has a valid IP-to-MAC address binding before updating the local ARP cache or before forwarding the packet to the appropriate destination

  • Drops invalid ARP packets

ARP inspection also rate-limits ARP packets. It will err-disable the port only if the rate is exceeded, not if the ARP is invalid.

If your device fails to renew its lease, then ARP inspection will drop packets when the lease is no longer valid. But it won't disable the port.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.