topic Re: Clearing Ip-security dhcp-snooping violation list in ExtremeSwitching (EXOS/Switch Engine)

Clearing Ip-security dhcp-snooping violation list

Walt_Witkowski — Mon, 25 Mar 2024 18:49:52 GMT

I am not able to clear the violation entry. I've tried " clear ip-security dhcp-snooping entries vlan STUDENT_ITTSTAFF_849" and "clear ip-security dhcp-snooping entries STUDENT_ITTSTAFF_849 ports 5" Neither works.

M_RM_4277_SW_TES_EX.dccc.edu.40 # clear ip-security dhcp-snooping entries vlan STUDENT_ITTSTAFF_849
M_RM_4277_SW_TES_EX.dccc.edu.41 # show ip-security dhcp-snooping violations STUDENT_ITTSTAFF_849
------------------------------------
Port Violating MAC
------------------------------------
5 c0:3e:ba:4c:47:64

Re: Clearing Ip-security dhcp-snooping violation list

Stefan_K_ — Mon, 25 Mar 2024 19:32:00 GMT

Hi!

Your first command is the correct one. Does disabling and re-enabling the port helps?

What if you disable the port, issue your commands and re-enabling it? Maybe there is still DHCP-Traffic seen on that Port?

And some further questions:
Is this the first time that you see this issue? Did you just recently configure DHCP-Snooping or was it running fine for a long time?

Re: Clearing Ip-security dhcp-snooping violation list

Walt_Witkowski — Tue, 26 Mar 2024 13:12:05 GMT

This is a x460 code ExtremeXOS version 31.6.2.1

This is a test switch that we are configuring before mass deployment to the existing network.

1) I removed the test device from the port 5 so there is no link on port 5 now 2) Disabled the port. 3) Ran the clear commands. 4) Ran the show violations cmd. -- violating mac and port is still there.

Any other suggestions welcomed.

Re: Clearing Ip-security dhcp-snooping violation list

Walt_Witkowski — Wed, 27 Mar 2024 13:39:46 GMT

Once the port is placed in the violations list

show ip-security dhcp-snooping violations STUDENT_ITTSTAFF_849
Port Violating MAC
5 c0:3e:ba:4c:47:64

The only way I found to remove it was to "disable ip-security dhcp-snooping vlan STUDENT_ITTSTAFF_849 port 5".

Of course the port would have to be enabled again

Re: Clearing Ip-security dhcp-snooping violation list

Gabriel_G — Fri, 29 Mar 2024 20:05:29 GMT

I think that clearing 'entries' is not the same as clearing 'violations'.

"clear ip-security dhcp-snooping entries vlan STUDENT_ITTSTAFF_849" will clear the info in "show ip-security dhcp-snooping entries vlan STUDENT_ITTSTAFF_849".

However, I don't see a similar command to clear the violations in "show ip-security dhcp-snooping violations STUDENT_ITTSTAFF_849"

Is this causing an issue for your use case or is the command/output just confusing?