Question

A network engineer is hardening access-layer Nexus switches in a data center. Users report intermittent connectivity, and investigation reveals a rogue device on an access port replying to DHCP requests with false gateway addresses, plus ARP spoofing attempts. The engineer enables DHCP snooping and Dynamic ARP Inspection (DAI) on the user VLAN. After enablement, legitimate clients on that VLAN can no longer obtain IP addresses, and the uplink toward the aggregation switch drops all DHCP replies. What is the MOST likely cause and correct remediation?

Accepted Answer

The uplink port toward the aggregation switch (and DHCP server path) must be configured as a DHCP snooping trusted port; by default all ports are untrusted and DHCP server-to-client messages are dropped on untrusted ports.

Answer

DAI must be disabled because it is incompatible with DHCP snooping on the same VLAN; the two features cannot coexist without a separate ARP ACL.

Answer

The access ports facing clients must be configured as trusted so that DHCP DISCOVER messages are forwarded upstream.

Answer

DHCP snooping rate limiting must be raised on the uplink because the default limit of 15 packets per second blocks all server replies.