Consider this network:enter image description here

I have enabled DHCP snooping on my system. Switch A has the DHCP connected and the port on VLAN 70 for DHCP has been trusted to allow for reading the database and passing addresses. VLAN 70 rides the Fiber Trunk to Switch B where the Client on VLAN 70 is connected on port 10. The trunk line has also been trusted on either end to allow to enable snooping. I have also enabled ip arp inspection vlan 70 on just SWITCH B.

Here is where the question gets tough. Due to the nature of the client machine it is required to have a static address which it has of As a safeguard in case the network on the client resets the DHCP has a reservation for that device on it as well to the same address.

The issue I am facing is since I having enabled snooping on the device and arp inspection all the DHCP clients have no problem getting onto the network on switch B. But the client with the static address is getting no connection. It is showing up as Unidentified Network. ARP inspection is sending a SYSLOG entry on the port with a DAI-4DHCP_SNOOPING_DENY. If I turn ARP Inspection off that syslog entry goes away but I continue to not get a valid connection. What am I missing to allow my static client to get a valid connection?

I can say I have tried an arp access-list entry for that client but that didn't do anything for the connection.

The Switch B has the following commands enabled:

ip dhcp snooping
ip dhcp snooping vlan 70
int range gi1-24 ip verify source
ip arp inspection vlan 70

Switch A has the ip dhcp snooping trust on the DHCP server ports and the trunk but does not have snooping enable.

  • Did you trust the ARP inspection on the interface?
    – Ron Maupin
    Mar 19, 2021 at 18:02
  • @RonMaupin Which interface?
    – JukEboX
    Apr 5, 2021 at 21:53

2 Answers 2


IF the device has a reservation, you should enable DHCP so it gets the correct address from the server.

If you can't enable DHCP on the device, you can create a static binding in the snooping database:

ip dhcp snooping binding 0000.1111.2222 vlan 70 interface  gi 1/0/1
  • 2
    You can also trust on the interface: ip arp inspection trust.
    – Ron Maupin
    Mar 19, 2021 at 18:05
  • Can you set a static binding without the calling out the interface? The device will jump around the switch depending where it is.
    – JukEboX
    Mar 22, 2021 at 11:55
  • @RonTrunk ip dhcp snooping binding is not a valid command. ip dhcp snooping has acl, database, glean, information, verify, vlan, wireless.
    – JukEboX
    Mar 22, 2021 at 12:35
  • What version do you have?
    – Ron Trunk
    Mar 22, 2021 at 18:43

Thanks to Ron for the help and understanding as we worked through this problem. Because ip arp inspection must be tied to a specific port we are unable to do this. Changing our IP Addresses on our clients to DHCP and extending the DHCP lease to a longer period of time a allows us to keep ip dhcp snooping running on all user VLANs and keep ip arp inspection running on all DHCP VLANs and excluding static VLANs. I understand the DAI but because of the need and the requirements it doesn't make sense to put it across all user VLANs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.