A device (for example an IP camera) connected to a Juniper EX access switch authenticates successfully through 802.1X/MAC-RADIUS, but it is not reachable from the network gateway. The gateway never learns the ARP for the device. The same device works normally when it gets its IP address through DHCP, but stops working when the IP address is configured statically.

• The device shows as authenticated on the switch (show dot1x interface <interface> detail).
• The device MAC address is learned in the ethernet-switching table on the correct VLAN.
• The gateway cannot ping the device and does not learn its ARP entry.
• Devices using DHCP on the same VLAN and port work without issues.
• The VLAN has DHCP security with ARP inspection enabled.

ARP inspection validates ARP packets against a table of IP/MAC bindings that the switch builds from DHCP transactions. A device with a static IP address never goes through DHCP, so it has no entry in that table. As a result, the switch drops the ARP packets from the device and the gateway can never resolve its address. Authentication is not related to the problem, which is why the device shows as authenticated the whole time.

Solution

There are two ways to fix this while keeping ARP inspection enabled:

• Add a static binding on the switch for the device:

set vlans <vlan-name> forwarding-options dhcp-security group <group-name> interface <interface> static-ip <ip-address> mac <mac-address>

Verify with show dhcp-security binding — the device should appear with a static entry. After this, the gateway learns the ARP and the device becomes reachable.

Note: if the switch is managed through Mist, apply the configuration from the Mist portal so it is not overwritten on the next configuration push.

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/configuring-static-dhcp-ip-addresses.html#id-configuring-static-dhcp-ip-addresses-for-dhcp-snooping-els