Description

For Juniper Networks EX/QFX Series Switches, when port security features are configured such as DHCP Snooping, IP Source Guard and or ARP Inspection, wireless clients disconnect when roaming between different locations and their respective access points.

Symptoms

You find that after roaming, clients are no longer able to get their VLAN assigned by the Radius Server or cannot obtain an IP address or Dynamic ARP Inspection drops their ARP packets.

Solution

DHCP Snooping, Dynamic ARP Inspection (DAI) and IP Source Guard are only meant to work within the same switch, as the DHCP Snooping table is not shared between switches. Essentially this will break any client that previously obtained an IP and needs to roam between switches. 

This happens for wireless clients that roam between APs serviced by different switches.

 

Modification History

2023-12-11 : Article Created

Related Information

https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/concept/port-security-dhcp-snooping-els.html#understanding-dhcp-snooping-els__d5225e194
https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/topic-map/understanding-and-using-dai.html
https://www.juniper.net/documentation/us/en/software/junos/security-services/topics/concept/port-security-ip-source-guard.html