A government agency enabled DHCP snooping on a Nexus VLAN, and hosts never receive addresses. The port toward the DHCP server is untrusted, and the host ports are untrusted as well. What should change?
Select an answer to reveal the explanation.
Short Explanation
DHCP snooping is a clipboard that only trusts the door the real server uses. You left the port toward the DHCP server untrusted, so its offers are dropped and the hosts never get an address. Trust that server-facing port, and leave the host ports untrusted.
Full Explanation
DHCP snooping inspects DHCP on untrusted ports and builds a binding table from the leases it sees. Server messages such as offers and acknowledgements are accepted on trusted ports and dropped on untrusted ports, because an untrusted port is assumed to face a client. The agency left the port toward the DHCP server untrusted, so the offers never reach the hosts and no bindings are learned. Trusting that server-facing port lets the real offers through. Host ports should stay untrusted so a rogue server on an access port cannot answer. Disabling snooping would stop the drops and would also remove the binding table other first-hop features rely on. Dynamic ARP Inspection is a separate check on ARP, and turning it off is not what allows DHCP offers. MACsec encrypts data frames on a link. DHCP offers are not encrypted ARP replies, and MACsec is not required for snooping. A Fibre Channel default zone policy applies to unzoned members of a VSAN. It has no effect on an Ethernet VLAN or on DHCP. Caveat: if the DHCP server is several hops away, trust the uplink that leads toward it, not every access port along the path. Operational check: trust the server-facing port, confirm hosts receive leases, and confirm the binding table records those leases while a host port stays untrusted.