A logistics company's Nexus switch has Dynamic ARP Inspection enabled on a VLAN, and ARP from legitimate hosts is dropped. DHCP snooping is not enabled on that VLAN. Why is the valid ARP being dropped?
Select an answer to reveal the explanation.
Short Explanation
DAI is a bouncer with a clipboard that DHCP snooping is supposed to fill in. You turned on the bouncer and never started the clipboard, so every untrusted host fails the check, including the real ones. MACsec is not the missing clipboard.
Full Explanation
Dynamic ARP Inspection validates ARP packets on untrusted ports against the DHCP snooping binding table, or against a static ARP ACL when you build one. The binding table is populated by DHCP snooping as hosts lease addresses. With snooping disabled, that table stays empty, so DAI treats the logistics hosts as forged and drops their ARP. The fix is to enable DHCP snooping on the VLAN, trust the port toward the DHCP server, and then let DAI use the bindings. MACsec encrypts data frames on a link and is not a prerequisite for ARP inspection. DAI is an NX-OS first-hop feature on classic VLANs and does not require an ACI tenant. A Fibre Channel default zone policy applies to a VSAN on an MDS. It has no role in Ethernet ARP inspection. Caveat: ports that should not be validated, such as the uplink toward an already-trusted switch, need to be trusted or DAI will drop legitimate ARP that did not originate from a local DHCP binding. Operational check: enable snooping, confirm bindings appear as hosts renew, and confirm DAI permits those hosts while still dropping a spoofed ARP on an untrusted port.