This article describes the behavior of devices using static IP addresses when the DHCP snooping is enable

• DHCP Snooping is enabled on (MIST/or CLI config) with DAI and Source guard

• If the device uses DHCP works fine
• If the device uses static IP doesn't work
• When the host uses DHCP, it successfully obtains an IP address and can reach its default gateway

When switching to a static IP, it fails to reach the gateway.

After changing the port to trusted, the host with a static IP can reach the gateway.

Based on these facts

By default, access ports are untrusted, and trunk ports are trusted for DHCP snooping. DHCP snooping enhances network security by verifying DHCP messages from untrusted devices (untrusted ports) that are connected to the switch and prevents unauthorized DHCP servers from sending DHCPOFFER packets on untrusted ports.

Working scenario with DHCP enabled:

When using DHCP on your laptop the device sends a DCHP request to the DHCP server. During this process, the switch learns and records the IP–MAC–port–VLAN mapping in the DHCP Snooping Binding Table. So everything works fine when using DHCP because the switch knows the host is legitimate.

Non-working scenario with IP static enabled:

Why Static IP Fails - The host does not send a DHCP request, so the switch has no valid DHCP Snooping binding entry. There's no binding entry confirming the IP–MAC–port relationship, so the switch considers it potentially spoofed or unauthorized.

When you make ge-0/0/14 a trusted port, the switch allows the traffic from static IP hosts even without a DHCP exchange (no entry on the DHCP binding table)