I did a workaround to override the problem by adding ip device tracking maximum <value> ; ip device tracking probe auto-source fallback
ip device tracking probe auto-source fallback 0.0.0.253 255.255.255.0 override
interface fa0/1
switchport mode access
switchport port-security maximum 5
switchport port-security
ip device tracking maximum 5
ip verify source port-security
interface Vlan1
ip address 10.0.0.253 255.255.255.0
Alter the tracking probe source VLAN 1 address to avoid APR source header send out but reply by hosts with duplicated source ip warning.
Enter the ip device tracking probe auto-source
If the switch sends out an ARP Probe for the client while the host (for example, a Microsoft Windows PC) is in its Duplicate-Address Detection phase, the host detects the probe as a duplicate IP address and presents the user with a message that a duplicate IP address was found on the network. The PC might not obtain an address, and the user must manually release/renew the address, disconnect and reconnect to the network, or reboot the PC in order to gain network access.
ip device tracking maintains port ACL in another form in order to keep both static and DHCP client sources verified. Although only static hosts should be configured tracking as described officially--
Configuring IP Source Guard for Static Hosts on a Layer 2 Access Port
If you only configure the ip verify source tracking [port-security] interface configuration command on a port without enabling IP device tracking globally or setting an IP device tracking maximum on that interface, IPSG with Static Hosts will reject all the IP traffic from that interface.
