Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Switch - ip verify source port-security - Bug can't have dhcp address

Hi,

No idea why but if I have the "  ip verify source port-security  " enable, I can't get an Ip address.  Is there any special configuration missing, is there any global config for that ?? I think something goes wrong here.

If I put my computer on a port that don't have "  ip verify source port-security  " I get the IP address, as soon as I get my computer in a port that have " ip verify source port-security " nothing....

IOS : c3560-ipbasek9-mz.122-53.SE2.bin

Thanks

interface FastEthernet0/43
switchport access vlan 107
switchport mode access
switchport voice vlan 187
switchport port-security maximum 2
switchport port-security
switchport port-security aging time 2
switchport port-security violation restrict
switchport port-security aging type inactivity
srr-queue bandwidth share 10 10 60 20
srr-queue bandwidth shape 10 0 0 0
mls qos trust device cisco-phone
mls qos trust cos
macro description cisco-phone
spanning-tree portfast
spanning-tree bpduguard enable

ip verify source port-security
ip dhcp snooping limit rate 10

Trunk that goest to Core switch where dhcp is :

interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
switchport nonegotiate
ip arp inspection trust
srr-queue bandwidth share 10 10 60 20
srr-queue bandwidth shape 10 0 0 0
queue-set 2
mls qos trust cos
auto qos voip trust
macro description cisco-switch
spanning-tree link-type point-to-point
ip dhcp snooping trust

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: Switch - ip verify source port-security - Bug can't have dhc

Typically you would just want this configuration at your access layer.

You can deploy it elsewhere, however it becomes complicated with which

ports to trust etc.

5 REPLIES
Cisco Employee

Re: Switch - ip verify source port-security - Bug can't have dhc

Does your DHCP server support option-82?  If I recall correctly for IP source guard and Port security to work together the server needs to support option 82.

Community Member

Re: Switch - ip verify source port-security - Bug can't have dhc

I think it wasn't working  because this configuration was missing :

conf t

ip dhcp snooping

ip dhcp snooping vlan x,y,z

ip dhcp snooping information option.

Cisco Employee

Re: Switch - ip verify source port-security - Bug can't have dhc

Ahhh yes, that could explain it.

Community Member

Re: Switch - ip verify source port-security - Bug can't have dhc

Do you know if I need to do that config only at the access layer or at the distribution layer also ?

Cisco Employee

Re: Switch - ip verify source port-security - Bug can't have dhc

Typically you would just want this configuration at your access layer.

You can deploy it elsewhere, however it becomes complicated with which

ports to trust etc.

927
Views
0
Helpful
5
Replies
CreatePlease to create content