IP Snooping\ARP Inspection With Static Devices On DHCP VLAN

Question

Consider this network:

I have enabled DHCP snooping on my system. Switch A has the DHCP connected and the port on VLAN 70 for DHCP has been trusted to allow for reading the database and passing addresses. VLAN 70 rides the Fiber Trunk to Switch B where the Client on VLAN 70 is connected on port 10. The trunk line has also been trusted on either end to allow to enable snooping. I have also enabled ip arp inspection vlan 70 on just SWITCH B.

Here is where the question gets tough. Due to the nature of the client machine it is required to have a static address which it has of 192.168.1.10. As a safeguard in case the network on the client resets the DHCP has a reservation for that device on it as well to the same address.

The issue I am facing is since I having enabled snooping on the device and arp inspection all the DHCP clients have no problem getting onto the network on switch B. But the client with the static address is getting no connection. It is showing up as Unidentified Network. ARP inspection is sending a SYSLOG entry on the port with a DAI-4DHCP_SNOOPING_DENY. If I turn ARP Inspection off that syslog entry goes away but I continue to not get a valid connection. What am I missing to allow my static client to get a valid connection?

I can say I have tried an arp access-list entry for that client but that didn't do anything for the connection.

The Switch B has the following commands enabled:

ip dhcp snooping
ip dhcp snooping vlan 70
int range gi1-24 ip verify source
ip arp inspection vlan 70

Switch A has the ip dhcp snooping trust on the DHCP server ports and the trunk but does not have snooping enable.

Answer 1

IF the device has a reservation, you should enable DHCP so it gets the correct address from the server.

If you can't enable DHCP on the device, you can create a static binding in the snooping database:

ip dhcp snooping binding 0000.1111.2222 vlan 70 192.0.2.1 interface  gi 1/0/1

Answer 2

Thanks to Ron for the help and understanding as we worked through this problem. Because ip arp inspection must be tied to a specific port we are unable to do this. Changing our IP Addresses on our clients to DHCP and extending the DHCP lease to a longer period of time a allows us to keep ip dhcp snooping running on all user VLANs and keep ip arp inspection running on all DHCP VLANs and excluding static VLANs. I understand the DAI but because of the need and the requirements it doesn't make sense to put it across all user VLANs.