You turn on DHCP snooping, DAI and IP Source Guard across a production access layer. What can go wrong, and how do you avoid it?
Show the answer
Say this first
Four classics. Clients stop getting leases because the access switch inserts option 82 with a zero gateway address and the upstream IOS relay or DHCP server drops it. Static-IP devices are cut off by DAI and IPSG because they have no binding. After a reload the binding table is empty and clients are blocked until they renew. And the 15 pps ARP limit err-disables ports that legitimately carry many hosts. The fixes are option 82 handling, static entries, the snooping database agent and rate tuning, rolled out in stages with snooping first and IPSG last.
Go deeper
Option 82
The access switch is a layer 2 device, not a relay, so when it adds option 82 (circuit ID with VLAN
and port, remote ID with the switch MAC) the giaddr field stays 0.0.0.0. Cisco IOS relays and DHCP
servers treat option 82 with a zero giaddr as invalid and drop it by default. debug ip dhcp server packet on an IOS DHCP server shows DHCPD: inconsistent relay information.
Three ways out:
- Stop inserting it on the access switch:
no ip dhcp snooping information option. - Accept it on the IOS relay or server:
ip dhcp relay information trustedon the SVI, orip dhcp relay information trust-allglobally. - If an upstream switch also runs snooping and receives it on an untrusted port:
ip dhcp snooping information option allow-untrustedthere.
Static hosts
ARP ACLs for DAI (arp access-list plus ip arp inspection filter) and ip source binding for IPSG.
Keep the list in the source of truth, because a printer replaced with a new MAC breaks again.
Persistence
ip dhcp snooping database flash:dhcp-snooping.dbWithout it, a reload empties the table and DAI and IPSG block every client until it renews.
Rate limits
Raise ip arp inspection limit rate on ports with many hosts, and set
errdisable recovery cause arp-inspection and dhcp-rate-limit so one burst does not leave a port
down until someone notices.
Rollout order
- DHCP snooping only, uplinks trusted. Watch the binding table fill.
- Wait at least half a lease time so every active client has renewed through the switch.
- Add static entries for fixed-address hosts.
- DAI on a pilot VLAN, check the drop counters, then expand.
- IP Source Guard last.
They will ask next
How long until the binding table is complete?
Clients renew at half their lease time, and the unicast renewal ACK passes through the switch and creates the binding. So after half a lease period every active client is learned. With 8 day leases that is 4 days, which is why you shorten leases or force renewals before enabling DAI.
Is option 82 ever useful?
Yes. The DHCP server can see which switch and port a request came from, so it can apply per-port address policies, limit leases per port, and help locate devices.
Traps
- Enabling all three features across a campus in one night.
- Disabling snooping to fix option 82 drops, instead of fixing option 82 handling.