Assume that an AOS-CX switch is already implementing DHCP snooping and ARP inspection successfully on several VLANs. What should you do to help minimize disruption time if the switch reboots?

Dynamic ARP Inspection (DAI) relies on the IP-to-MAC address bindings learned and stored by the DHCP snooping feature. This binding database is held in the switch's memory (RAM) and is lost when the switch reboots. After a reboot, DAI will start with an empty database and will drop ARP packets from existing, legitimate clients because it has no trusted binding for them. This causes a network outage for those clients until their DHCP lease is renewed. To prevent this disruption, the DHCP snooping database can be configured to be saved to persistent storage (e.g., a file on the switch's flash or a remote server). Upon reboot, the switch reloads this database, allowing DAI to validate existing clients' ARP packets immediately.

A. Configure the switch to act as an ARP proxy. ARP proxy is a feature for answering ARP requests on behalf of other hosts and is unrelated to preserving the DHCP snooping database across reboots.
B. Create static IP-to-MAC bindings for the DHCP and DNS servers. This is a good practice for static devices but does not solve the problem for the numerous dynamic clients that would be disrupted after a switch reboot.
D. Configure the IP helper address on this switch, rather than a core routing switch. The location of the DHCP relay (IP helper) configuration does not affect the persistence of the DHCP snooping database on the local switch.

1. HPE ArubaOS-CX 10.12 Security Guide

Page 229

Chapter "DHCP Snooping"

Section "Saving the DHCP snooping binding database".

The document states: "The DHCP snooping binding database is not persistent across switch reboots. To save the database

you must configure a location to which the database can be written. The database can be saved to a local file on the switch or to a remote server." This directly supports saving the database to prevent loss upon reboot.

2. HPE ArubaOS-CX 10.12 Security Guide

Page 229

Command Syntax section.

The guide provides the specific command for this function: dhcp-snooping database file [delay ]. This command configures the switch to write the binding database to a file

ensuring its persistence.