You should be able to downgrade, but I would check the release notes for the latest update to see if there are any downgrade restrictions.
We have configured port-security on the access switches and now I have been trying to add DHCP snooping feature to this. It seems that DHCP snooping allows the host connected to the port-security protected port to obtain IP address, however further communication is blocked. Below I have reproduced steps and pasted CLI output to demonstrate how I executed my configuration and testing. Step 1. Port security configured with 1 static MAC address learned in sticky mode, DHCP snooping enabled and port is not trusted. Port-security is enabled: globally ...and on the port: This mac address is loaded into MAC address table: Also, DHCP snooping is enabled: Step 2. Host is hooked up to the port and DHCP snooping shows a lease assigned to this MAC address: Step 3. When I go to the host and spoof its MAC address (001A.4DAB.CDEF), I will get another DHCP binding even though my port-security is allowing only one MAC address Going further, the MAC address table still shows only the legitimate address: ... and there is port-security violation on that port: I was expecting port-security would block ALL traffic if it comes from unwanted MAC addresses, in the above it looks like enabling DHCP snooping feature it bypasses port-security, potentially allows malicious client to exhaust DHCP pool. Has anyone similar experience with port-security and DHCP snooping on N2000 series switches? Thanks in advance! Sebastian
Port security with DHCP snooping on N2000 does not work as expected