Port Security and DHCP Snooping in a 40-Person Office

DHCP snooping is dropping the server's replies.

Every port is untrusted until explicitly trusted. Client-originated messages (DISCOVER, REQUEST) from untrusted ports are allowed and forwarded normally. Server-originated messages (OFFER, ACK, NAK) arriving on an untrusted port are dropped. The offer comes back through the trunk from R1 acting as relay agent, so SW-A discards it at Gi0/1, the client never gets a lease, and the operating system self-assigns a 169.254.x.x link-local address. That address means "no DHCP lease", not a VLAN or routing fault, which is why users can still reach each other.

Confirm:

show ip dhcp snooping              ! VLAN 30 enabled; Gi0/1 listed as untrusted
show ip dhcp snooping binding      ! empty - no leases were ever recorded

Fix:

interface gi0/1
 ip dhcp snooping trust

Trust only the path toward the DHCP server or relay agent, never user ports. If the relay or server mishandles option 82, no ip dhcp snooping information option is the follow-up, but only after you see that specific symptom.

Caution: if dynamic ARP inspection is enabled later, that empty binding table would cause those hosts' ARP to be dropped too. Fix the trust boundary first.

Cause: an IP phone with a PC behind it presents two source MAC addresses on one port. With maximum 1, the second MAC is a violation and violation shutdown err-disables the port. Once err-disabled, the port stays down until it is manually reset or errdisable recovery is enabled.

interface range gi0/2 - 48
 switchport port-security maximum 2
 switchport port-security violation shutdown

Use 3 if a desk may also carry a softphone or a spare dock.

Judgement on the violation mode: for a requirement of "an unknown device must not get on the network", keep shutdown. restrict only logs and drops the offending MAC while leaving the port up, which is a valid choice for a shared desk but weakens the control. If you want to keep shutdown without truck rolls, add errdisable recovery cause psecure-violation with a 300-second interval, and accept the trade-off: an attacker gets one retry every five minutes. For 40 users that trade is usually worth it.

What else must be cleared: the sticky MAC table. When a laptop is swapped, the old sticky entry stays permanently, so with maximum 2 you have quietly lost a slot and the next change trips the port again. Run clear port-security sticky interface gi0/x, or remove and re-apply sticky learning, then let the port relearn the current phone and PC. Also reset each err-disabled port with shutdown / no shutdown - nothing recovers on its own without errdisable recovery configured.

Order:

1. Trust the trunk - ip dhcp snooping trust on Gi0/1. This restores addressing for 30 users with one line and no per-port work.
2. Clear the err-disabled ports - shutdown / no shutdown on each, so the phones and PCs come back.
3. Raise the port-security maximum to 2 on phone ports and clear stale sticky entries wherever hardware has been swapped.
4. Verify - show ip dhcp snooping binding populates, show port-security interface shows the expected two MACs per desk, and show interfaces status err-disabled is empty. Confirm the trunk is the only path to the server, so trusting Gi0/1 does not accidentally trust a user port.

Refuse: trusting the access ports. Adding ip dhcp snooping trust to user-facing ports makes the symptom disappear while removing the control entirely - any user could plug in a rogue DHCP server and hand out a gateway address, and snooping would happily forward the offers. DHCP snooping's whole value is the trusted/untrusted boundary.

The same category of shortcut: setting violation restrict on every port purely to stop the err-disables, or turning port security off. Both are legitimate decisions, but only if the business has decided it no longer wants the control - not as a reaction to a ticket. At this site port security is the only Layer 2 access control there is.