A government access VLAN has DHCP snooping enabled, and the DHCP server port is trusted. Clients receive addresses. They cannot learn the gateway MAC. Dynamic ARP inspection is on, and the uplink toward the router is an untrusted DAI port. What is being dropped?
Select an answer to reveal the explanation.
Short Explanation
Your guests have room keys, and the front desk phone is on a line nobody trusts. DHCP snooping already did its job, and dynamic ARP inspection is dropping the router's ARP because the uplink is an untrusted DAI port.
Full Explanation
DAI checks ARP against the DHCP snooping binding table and drops ARP on untrusted ports that does not match a binding. The router's gateway address was not handed out by DHCP on that uplink, so an untrusted DAI port drops the router's ARP replies. Trust the uplink for DAI, and leave the host ports untrusted. DHCP offers are already arriving. The server port is trusted, which is why clients have addresses. Blaming snooping contradicts the leases. RA Guard drops rogue IPv6 router advertisements. This failure is IPv4 ARP for the gateway, and RA Guard is not the feature described. MACsec must-secure drops frames that lack MACsec headers on a link where that policy is set. Nothing in this VLAN says MACsec is on, and the symptom is a failed ARP for the gateway, not an encrypted hop. Caveat: a host that uses a static IP also needs a static binding or DAI drops that host too. Trusting the uplink does not create those host bindings. Operational check: trust the router uplink for DAI, then confirm a client resolves the gateway MAC and still cannot spoof a neighbor from an untrusted access port.