DAI for New users !

[TrickTrick]

Hello,

I'm a bit confused regarding the correct implementation of DAI, I've read somewhere that the DHCP snooping binding table should be populated first before activating DAI, and it always work good like that, but what about new devices/users ? whenver I try to connect a new machine, it doesn't work until I disable DAI of that vlan, the device receive its IP, enable DAI again and it works

The switch platform is Catalyst 2960X, version 15.2.(7)E6

What to do to avoid this situation ?

Thank you

[MHM Cisco World]

00:E0:4C:36:01:E9   192.168.246.134  433348      dhcp-snooping   246   GigabitEthernet1/0/1

00:E0:4C:36:01:E9   192.168.200.17   434603      dhcp-snooping   20   GigabitEthernet1/0/1

same MAC differ VLAN same interface ? that what you meaning binding not update ?

[TrickTrick]

No, This is my testing machine, I assigned different vlans in early stages just to see if the behaviour is still the same

The original issue is that, when enabling DAI before the host get an IP from the DHCP, it will never connect to the network, until I disable DAI, wait for DHCP process, the IP appears in the DHCP snooping binding table, enable DAI again, and it works then... my question is applied to any other new host in the network, how new hosts are supposed to get access  if they've never had an IP before (no binding in the DHCP snooping table)

NB : I might need to enable DAI and DHCP snooping in the upstreams as well (distribution / core layers) and see the behaviour, since DHCP snooping is working fine in the Access layer only, I didn't enable it in the distribution and Core layer as those equipments are physically secure

[MHM Cisco World]

sorry I read your last post again, 
what you meaning that you run ip arp inspection in access SW and not config in Core SW ?

[TrickTrick]

Yes, Arp inspection is configured only in the Access switches side only, uplinks are trusted, and access ports are not.
DHCP Snooping working good that way, DAI is not, I"m aware in some configs we need to enable both sides, and trust trunks (upstream to Core, and downstram to distribution/access), in our case we want it to be enabled only in the acces layer since the untrusted ports are only there
DAI can't work that way ?

[MHM Cisco World]

let explain to you case here which need to match 
there are three protcol 
DHCP snooping 
ARP inspection 
IP tacking 
so according to your new info. I must dive deep to see if one feature effect other. 
I will update you today hope

[TrickTrick]

Thank you,

Well, i know DHCP snooping and DAI are related,  Never dealt with IP tracking honestly, I didn't try the command you've suggested yet, I never had such issue with DAI, we have a lot of deployment that work good with the shared config, it's the first I face this

[MHM Cisco World]

https://bst.cisco.com/bugsearch/bug/CSCui65252

I found this bug, 
and I see you config two interface as port member of PO connect Access to Core/Agg SW but only one is connect
so can you change remove the port-channel and check again.