0

I am running a set of Cisco C9300s. I have them configured with ip dhcp snooping, and ip arp inspection with ip dhcp snooping trust and ip arp inspection trust set on the fiber link between the 2 using fiber as a Trunk. On the access ports they are set with ip source verify and spanning tree guard root. This issue I am calling into is that the ip dhcp snooping is set on all 4 VLANS (10, 20 , 30, 40). DHCP is running on VLANs 30 and 40. On ports that are set to VLAN 30 & 40 I am able to connect without an issue. On ports using VLAN 10 and 20 I don't get any connection. The difference between them is that VLAN 10 & 20 are static networks and VLAN 30 & 40 are DHCP networks.

When I turn off ip dhcp snooping, ip arp inspection and ip source verify my static networks start to work again. I did some looking into IP Source Guard on static networks and found this: https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/ipsrcgrd.pdf It says I can set a VLAN for ip source verify to be enabled and check against but these commands don't show up on my switch. Are these commands degraded? And if so how can I keep DHCP snooping and only set the ip source verify to the VLANs that run DHCP? When changing a port to a different VLAN do I need to turn source verify on and off when changing between DHCP VLANs and static networks?

Improve this question

1 Answer 1

Reset to default
4

There's no point to enabling DHCP snooping on VLANs that don't have DHCP. There's nothing to "snoop."

ARP inspection and Source Verify use the snooping database to inspect addresses. Since there's nothing in the database, these features don't work.

Improve this answer
2
  • So is it pointless to run DHCP snooping on VLANs that are exclusively static? Or does the DHCP listen for fake DHCP packets on the static network and would therefore be the reason to start an investigation of intrusion or strange behavoir.
    – JukEboX
    Apr 29, 2021 at 18:56
  • 1
    All it would do is block anyone from trying to be a DHCP server in those VLANs. But since nothing is using DHCP, it wouldn't matter. Of course, the other features that depend on the dhcp db still won't work if dhcp isn't being used.
    – Ricky
    Apr 29, 2021 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.