A government agency enabled IP Source Guard on an access VLAN. DHCP clients pass traffic. A server with a static IP address cannot. Why is that server blocked?
Select an answer to reveal the explanation.
Short Explanation
IP Source Guard is a bouncer who only admits people wearing a wristband from the list. You let DHCP clients through because their leases created bindings, and the static server never got one. Add a binding for that server, or the bouncer keeps turning its traffic away.
Full Explanation
IP Source Guard checks the source of IP traffic on an untrusted port against the DHCP snooping binding table, plus any static bindings you add. DHCP clients in this agency pass because snooping learned their addresses. The static server never leased an address, so it has no binding and its traffic is dropped even though the address is legitimate. Dynamic ARP Inspection trust changes how ARP is validated on a port. Trust does not create an IP binding, and it is not the feature that is forwarding or dropping this server's data frames. RA guard filters IPv6 router advertisements. A static IPv4 address is not a router advertisement, and RA guard is not what blocked this server. MACsec encrypts a link. It is not a prerequisite for IP Source Guard, and enabling it would not insert the missing binding. Caveat: the port toward a trusted upstream switch should not be subject to the same host check, or legitimate transit traffic can be dropped for lack of a local binding. Operational check: add a static binding for the server IP and MAC on its port, then confirm that server passes while a spoofed source on an untrusted port still fails.