Troubleshooting Tip: S148F and S148F-PoE showing high CPU with process dhcprd when ARP inspection and DHCP snooping are enabled

When ARP Inspection (DAI) and DHCP-Snooping are enabled, an S148 model FortiSwitch shows a drastic increase in CPU usage:

fnsysctl top

dhcprd 275 R 99.9 3.1
dhcprd 275 R 99.9 3.1
dhcprd 275 R 99.9 3.1

1. A quick workaround is to disable DAI, or both DAI and DHCP-snooping under FortiSwitch.

When FortiSwitch is managed by FortiGate, disable DAI on the controlled side:

config switch-controller managed-switch

    edit <FortiSwitch_serial_number>

        config ports

            edit <port_name>

                arp-inspection-trust untrusted 

            next

        end

2. When FortiSwitch is managed by FortiGate, disable DHCP-Snooping under the VLANs by the controlled side: 

config system interface

    edit "VLAN-Test"

        set switch-controller-igmp-snooping disable
    set switch-controller-dhcp-snooping disable

end

3. If DAI and DHCP snooping must be enabled because this feature is needed, install it under FortiSwitch firmware 7.6.6 GA.