Everything I've read on this says this should work, but for some reason it's just not happening.
I've got a switch connected to a DHCP server (192.168.10.3) in VLAN 10, and two machines in VLAN 7: a client and a rogue DHCP server.
Switch configuration:
version 15.0
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!
boot-start-marker
boot-end-marker
!
!
!
no aaa new-model
system mtu routing 1500
ip routing
!
!
!
ip dhcp snooping vlan 7,10
ip dhcp snooping
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0/1
shutdown
!
interface FastEthernet0/2
description Good DHCP server
switchport access vlan 10
ip dhcp snooping trust
!
interface FastEthernet0/3
shutdown
!
interface FastEthernet0/4
shutdown
!
interface FastEthernet0/5
shutdown
!
interface FastEthernet0/6
shutdown
!
interface FastEthernet0/7
shutdown
!
interface FastEthernet0/8
switchport access vlan 7
!
interface FastEthernet0/9
shutdown
!
interface FastEthernet0/10
shutdown
!
interface FastEthernet0/11
shutdown
!
interface FastEthernet0/12
shutdown
!
interface FastEthernet0/13
shutdown
!
interface FastEthernet0/14
shutdown
!
interface FastEthernet0/15
shutdown
!
interface FastEthernet0/16
shutdown
!
interface FastEthernet0/17
shutdown
!
interface FastEthernet0/18
shutdown
!
interface FastEthernet0/19
shutdown
!
interface FastEthernet0/20
description Client
switchport access vlan 7
spanning-tree portfast
!
interface FastEthernet0/21
shutdown
!
interface FastEthernet0/22
shutdown
!
interface FastEthernet0/23
shutdown
!
interface FastEthernet0/24
description Rogue DHCP server
switchport access vlan 7
spanning-tree portfast
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface Vlan1
no ip address
shutdown
!
interface Vlan7
ip address 192.168.7.1 255.255.255.0
ip helper-address 192.168.10.3
!
interface Vlan10
ip address 192.168.10.1 255.255.255.0
!
ip http server
ip http secure-server
!
!
!
no cdp run
!
!
!
line con 0
speed 19200
line vty 0 4
login
line vty 5 15
login
!
end
Observations:
When the rogue server is down, the client gets an IP from the good DHCP server and the appropriate entries are populated in the DHCP snooping database
When the good DHCP server is down, and the rogue server is up, the client gets an IP from the rogue DHCP server. By "down" I mean either the port is shutdown or I just remove the scope on the server so it doesn't respond.
The DHCP snooping debugs show the good DHCP server sending a DHCPOFFER. Yet the rogue server still wins.
What am I missing here? The switch is a 3560 running 15.0(2)SE5. I'm not running IP source guard or DAI.
ip dhcp snooping trust
on the port with the good server does nothing since the VLAN for that server is not participating in DHCP snooping. For VLAN 7, you have no trusted ports. Also, you should use copy and paste to show your configurations. What you leave out can make a difference.