A government agency enabled DHCP snooping on a Nexus VLAN. Clients send discovers, but offers never arrive. The port that faces the DHCP server is untrusted. What should change?
Select an answer to reveal the explanation.
Short Explanation
DHCP snooping is a guard who only trusts the door you mark. You trust the port toward the DHCP server so offers are allowed in, and you leave the access ports untrusted. Dynamic ARP Inspection does not carry those offers.
Full Explanation
DHCP snooping allows client discovers on untrusted access ports and drops DHCP server messages that arrive on those same untrusted ports. Offers and acknowledgements from the real server are server messages. When the agency port that faces the DHCP server is untrusted, the switch drops those offers, so clients never get an address. Trusting that server-facing port lets the offers through while the access ports stay untrusted and still block a rogue server. Dynamic ARP Inspection validates ARP against the binding table. It does not forward DHCP offers, and enabling it on the server port does not change the snooping trust decision. Trusting every access port would accept a DHCP server plugged into any desk, which removes the protection snooping was enabled to provide. MACsec encrypts a link. It does not mark a port as a trusted DHCP snooping port and it does not pass offers that snooping is dropping. Caveat: if the server is several hops away, the uplink toward that server is the port to trust, not an unrelated access port that happens to be up. Operational check: trust the server-facing port, confirm clients receive leases, and confirm a DHCP offer injected on an access port is still dropped.