I am running a set of Cisco C9300s. I have them configured with
ip dhcp snooping, and
ip arp inspection with
ip dhcp snooping trust and
ip arp inspection trust set on the fiber link between the 2 using fiber as a Trunk. On the access ports they are set with
ip source verify and
spanning tree guard root. This issue I am calling into is that the
ip dhcp snooping is set on all 4 VLANS (10, 20 , 30, 40). DHCP is running on VLANs 30 and 40. On ports that are set to VLAN 30 & 40 I am able to connect without an issue. On ports using VLAN 10 and 20 I don't get any connection. The difference between them is that VLAN 10 & 20 are static networks and VLAN 30 & 40 are DHCP networks.
When I turn off
ip dhcp snooping,
ip arp inspection and
ip source verify my static networks start to work again. I did some looking into IP Source Guard on static networks and found this: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/ipsrcgrd.pdf
It says I can set a VLAN for
ip source verify to be enabled and check against but these commands don't show up on my switch. Are these commands degraded? And if so how can I keep DHCP snooping and only set the
ip source verify to the VLANs that run DHCP? When changing a port to a different VLAN do I need to turn source verify on and off when changing between DHCP VLANs and static networks?