CSCvn04524 - IP Source Guard blocks traffic after host IP renewal

[Thomas Schier]

Unfortunately, after installing 16.9.3 we have the same problem as noted in the description :(.

Is this Bug really fixed in 16.9.3 ? Cannot find any hint in the Release Notes under Resolved Caveats in Cisco IOS XE Fuji 16.9.3.

regards Thomas

[JAKUB CHYTRACEK]

Hello Thomas,

we have the same issue, I have opened the TAC SR today. It seems that it should be fix in 16.9.3, but it's not. The TAC enginner will contact the owner in dev team. So if you wish I can give you feedback when they will provide me more information ....

Regards,

Jakub

[Thomas Schier]

Hello Jakub,

thanks for your comment. Good to hear that we are not alone with this issue ;) . I've also opened a TAC SR. At present the TAC engineer is trying to reproduce the issue in the lab. I would be happy to share the feedback with you.

Regards
Thomas

[JAKUB CHYTRACEK]

Hello Thomas,
we are using our Cisco Catalyst 9300 switches in DNA Fabric - SDA Access. The TAC/engineering found that we are hitting following bug id: 

CSCvq08649 - Security features (IPSG and DAI) are not fully supported on SDA Edge device access ports

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvq08649

It should be fixed in the IOS XE 16.12.2.

Do you have also your switches in DNA Fabric - SD Access or not? If not please could you send me info what was your result with TAC. Of course we have another deployments without SDA Access where the IP Snooping/IP Source Guard is required...

Thanks

Jakub