1

edit: Simplified (drastically) question:

Problem: I have a Cisco IE3000 L2 switch with SVI and DHCP support that needs to be connected to our LAN via the uplink port and to field equipment via the downlink? ports. I need the equipment connected to the downlink ports to ignore the upstream DHCP server and only receive ip addresses from the switch itself. I also need the switch to 'switch' network traffic between the uplink and downlink ports.

Right now, the only way i can do this is by disconnecting the uplink while the switch and downstream equipment boots up and assigns/receives IP addresses from the switch DHCP server. Then I reconnect the uplink and all is good.

If I leave the uplink connected while switch and downlink equipment boots, the downlink equipment receives ip addresses from the upstream DHCP server. This is a problem.

  • side question - when uplink is connected, what mechanism allows upstream dhcp server to override the local switch dhcp server? why doesn't the switch dhcp answer/assign an ip address to the downlink ports before main dhcp server does?

I also tried assigning all the downlink ports to a separate VLAN on the switch. This allowed the downlink ports to get proper IP addresses from the switch, even with the uplink connected, but obviously communication between the uplink port and downlink ports is not possible because they are on separate VLANS.

The vendor's solution is to put their dual-homed application computer between the field equipment switch and rest of the upstream network, but that seems a bit of a hack, and the field equipment environment is not conducive to PC longevity.

obviously any other methods are welcome if they achieve the same end.

Switch does not support inter-vlan communication/SVI routing but even if it did I think I would end up with the same result as option 1.

Improve this question
4
  • 1
    If you are assigning addresses in a different subnet (b) than your uplink (a), than you have to route between them. You also have to inform devices on (a) that subnet (b) exists and your router/switch is the way to get there. If you can't manage that, there's no point worrying about DHCP. Even f you could statically assign addresses, you would have this problem.
    – Ron Trunk
    Mar 19, 2015 at 2:14
  • Honestly, this large wall of text is kindof confusing. Would it be too much trouble to draw a diagram and include your IE3000 switch, the thing that needs your own DHCP address, the boundaries of various vlans, and where the "other" DHCP server is? Please consider this guidance as well.
    – Mike Pennington
    Mar 19, 2015 at 3:41
  • Sorry Guys.. I tried to be as explicit as I could. main dhcp server (subnet A), and application computer (statically-assigned subnet B) are 'upstream' of the switch. The equipment that needs DHCP-assigned subnet B addresses is downstream from the switch. Routing is not needed because it's all one physical network on one native VLAN. I am going to give DHCP snooping a try. May post a diagram if that fails. I will report back!
    – goofology
    Mar 19, 2015 at 9:15
  • edit: Routing is not needed because it's all one physical network on one native VLAN - for option 1 at least.
    – goofology
    Mar 19, 2015 at 9:22

3 Answers 3

Reset to default
6

Your scenario is somewhat confuse. If I uderstand well you want to filtered DHCP request on L2.

You can achieve it by using the function DHCP Snooping features available on your platform.

You could set all ports in untrusted mode so only DHCP reply from the switch will be accepted.

DHCP Snooping - configuration guide

DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You use DHCP snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another switch.

Which is what you are looking, filtering DHCP communication between your hosts and upstream DHCP.

Improve this answer
3
  • Yes it is a strange, confusing scenario! I had read about DHCP snooping but wasn't sure exactly how it would work/need to be configured in this situation. I will set all ports to untrusted and give it a shot!
    – goofology
    Mar 19, 2015 at 9:14
  • I set all ports on the switch (downstream and uplink) as un-trusted. this appears to have worked. Can you explain a bit more how this works in my scenario? The cisco documentation seems to suggest it is to be used to make sure that equipment on the downstream side of the switch has acquired proper ip address/mac address pairing (from an upstream DHCP server), while 'trusting' the upstream port. But it's not clear how it works in my scenario, where the switch itself is the dhcp server and i want to block downstream equipment from receiving addresses from another upstream dhcp server.
    – goofology
    Mar 20, 2015 at 17:49
  • I started to write an explanation but I found online a better and easy to understand one on DHCP snooping features. Go to packetpushers.net/five-things-to-know-about-dhcp-snooping
    – cgasp
    Mar 23, 2015 at 5:16
2

As I understand it, you want your LAN to receive IP address assignments only from the IE3000 switch. If there is an IP helper address set up in your running-config, you should disable that as a first step. That might clear up the issue by itself, and keep things simple.

Improve this answer
-1

Not sure why you would want to ignore the upstream DHCP server? Can't you disable the switch's DHCP and use only the upstream? You just want the downstream clients to get the IP addresses.

Did you try static routing between the two VLANs? You don't need to enable routing.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.