This article describes how Dynamic Arp Inspection configured on a Juniper Networks switch at the incorrect network layer may cause DHCP IP address assignment issues on user devices.

One of the EX4300 VC in our network, user cannot connect to net work with DHCP. After troubleshooting, we found the errors:

Mar 25 15:45:00 OLD-CORE fpc0 AS_PKT_DAI_FAILED: DAI FAILED: ARP REQUEST received, interface ge-0/0/8.0 [index 622], vlan-id 50, sender ip/mac 192.168.0.1/aa:aa:aa:aa:aa:aa, receiver ip/mac 192.168.0.3/00:00:00:00:00:00

Mar 25 15:45:01 OLD-CORE fpc0 AS_PKT_DAI_FAILED: DAI FAILED: ARP REPLY received, interface ge-0/0/8.0 [index 622], vlan-id 50, sender ip/mac 192.168.0.2/bb:bb:bb:bb:bb:bb, receiver ip/mac 192.168.0.3/00:00:00:00:00:00

When dynamic ARP inspection (DAI) is enabled, the switch logs the number of invalid ARP packets that it receives on each interface, along with the sender’s IP and MAC addresses. You can use these log messages to discover ARP spoofing on the network.

Dynamic ARP inspection (DAI) protects switching devices against Address Resolution Protocol (ARP) packet spoofing (also known as ARP poisoning or ARP cache poisoning).

DAI inspects ARPs on the LAN and uses the information in the DHCP snooping database on the switch to validate ARP packets and to protect against ARP spoofing. ARP requests and replies are compared against entries in the DHCP snooping database, and filtering decisions are made based on the results of those comparisons. When an attacker tries to use a forged ARP packet to spoof an address, the switch compares the address with entries in the database. If the media access control (MAC) address or IP address in the ARP packet does not match a valid entry in the DHCP snooping database, the packet is dropped.

In this scenario, the switch was previously implemented at the Core layer, then it was moved to the Access layer, but the Dynamic Arp Inspection configuration was not removed and it is causing packet drops, resulting in intermittent DHCP IP address assignment issues. The observed logs are illustrating that different sender MAC addresses have been detected at the interface ge-0/0/8, possibly because the user devices are jumping from one Access Point to another, which means that different devices may connect to the AP connected to the interface ge-0/0/8. Due to the expected DAI behavior, packets may be dropped after comparing the source MAC address with the entries from the DHCP snooping database.

To resolve this issue, you should evaluate if Dynamic Arp Inspection is required to be configured at the access switch, and if not, the same should be removed. Examples below:

Legacy

[edit ethernet-switching-options secure-access-port]
user@switch# delete interface ge-0/0/8 dhcp-trusted
user@switch# delete vlan VLAN-NAME examine-dhcp
user@switch# delete vlan VLAN-MANE arp-inspection

Enhanced Layer2 Software (ELS)

[edit vlans VLAN-NAME]
user@switch# delete forwarding-options dhcp-security arp-inspection

https://supportportal.juniper.net/s/article/QFXEX-Dynamic-ARP-inspection-DAI-on-ELS