1

Everything I've read on this says this should work, but for some reason it's just not happening.

I've got a switch connected to a DHCP server (192.168.10.3) in VLAN 10, and two machines in VLAN 7: a client and a rogue DHCP server.

Switch configuration:

version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
system mtu routing 1500
ip routing
!
!
!
ip dhcp snooping vlan 7,10
ip dhcp snooping
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/1
 shutdown
!
interface FastEthernet0/2
 description Good DHCP server
 switchport access vlan 10
 ip dhcp snooping trust
!
interface FastEthernet0/3
 shutdown
!
interface FastEthernet0/4
 shutdown
!
interface FastEthernet0/5
 shutdown
!
interface FastEthernet0/6
 shutdown
!
interface FastEthernet0/7
 shutdown
!
interface FastEthernet0/8
 switchport access vlan 7
!
interface FastEthernet0/9
 shutdown
!
interface FastEthernet0/10
 shutdown
!
interface FastEthernet0/11
 shutdown
!
interface FastEthernet0/12
 shutdown
!
interface FastEthernet0/13
 shutdown
!
interface FastEthernet0/14
 shutdown
!
interface FastEthernet0/15
 shutdown
!
interface FastEthernet0/16
 shutdown
!
interface FastEthernet0/17
 shutdown
!
interface FastEthernet0/18
 shutdown
!
interface FastEthernet0/19
 shutdown
!
interface FastEthernet0/20
 description Client
 switchport access vlan 7
 spanning-tree portfast
!
interface FastEthernet0/21
 shutdown
!
interface FastEthernet0/22
 shutdown
!
interface FastEthernet0/23
 shutdown
!
interface FastEthernet0/24
 description Rogue DHCP server
 switchport access vlan 7
 spanning-tree portfast
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan7
 ip address 192.168.7.1 255.255.255.0
 ip helper-address 192.168.10.3
!
interface Vlan10
 ip address 192.168.10.1 255.255.255.0
!
ip http server
ip http secure-server
!
!
!
no cdp run
!
!
!
line con 0
 speed 19200
line vty 0 4
 login
line vty 5 15
 login
!
end

Observations:

  1. When the rogue server is down, the client gets an IP from the good DHCP server and the appropriate entries are populated in the DHCP snooping database

  2. When the good DHCP server is down, and the rogue server is up, the client gets an IP from the rogue DHCP server. By "down" I mean either the port is shutdown or I just remove the scope on the server so it doesn't respond.

  3. The DHCP snooping debugs show the good DHCP server sending a DHCPOFFER. Yet the rogue server still wins.

What am I missing here? The switch is a 3560 running 15.0(2)SE5. I'm not running IP source guard or DAI.

Improve this question
4
  • Putting the ip dhcp snooping trust on the port with the good server does nothing since the VLAN for that server is not participating in DHCP snooping. For VLAN 7, you have no trusted ports. Also, you should use copy and paste to show your configurations. What you leave out can make a difference.
    – Ron Maupin ♦
    Mar 7, 2016 at 0:13
  • You entirely missed the point since adding VLAN 10 to the DHCP snooping does nothing either. Trust is per VLAN, not per switch. VLANs are layer-2 entities which end where layer-3 begins. What DHCP snooping does is only on the VLAN(s) where it is configured, and trust given to a VLAN 10 port has no effect on anything on VLAN 7, or any other VLAN.
    – Ron Maupin ♦
    Mar 7, 2016 at 1:01
  • DHCP snooping does work inasmuch as the switch shows DHCP snooping bindings. The problem is that it still allows the rogue server's DHCP messages onto the VLAN. BTW I based this configuration on the one in Wendell Odom's R&S v4 text.
    – user6423
    Mar 7, 2016 at 1:07
  • I wan't giving you an answer, I was merely pointing out that the trust, or lack of it, on VLAN 10 does nothing for you on VLAN 7.
    – Ron Maupin ♦
    Mar 7, 2016 at 3:01

1 Answer 1

Reset to default
1

From what I see your configuration should work. Also, the goal of DHCP snooping on untrusted ports is to filter out the DHCP-server specific messages, like OFFERs. Please, provide us with the show ip dhcp snooping output, and with the show ip dhcp snooping statistics detail output as well.

Also, if you still have debug ip dhcp snooping output, it would probably help to see it as well. Right now for me it looks like a software bug. Probably you should at least search the Cisco BST tool for this.

Improve this answer
1
  • You're right. It was bug CSCug52922 and is fixed in 15.0(2)SE6.
    – user6423
    Mar 7, 2016 at 15:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.