DHCP snooping problem

Question

I have some problems with a very simple DHCP snooping configuration.

I'm using a very simple topology using router on a stick. I use VLAN 10 and VLAN 20.

My Clients can get DHCP from my router when dhcp snooping is not enabled on my switch, but when I enable snooping they can no longer get an IP.

My switch has interface f0/6 and f0/11 as access ports, f0/6 is on vlan 10 and f0/11 is on vlan 20. f0/1 is in trunking mode.

My switch config:

Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
1-100
Insertion of option 82 is enabled
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Interface                  Trusted    Rate limit (pps)
-----------------------    -------    ----------------
FastEthernet0/1            yes        unlimited       

I have full connectivity when DHCP snooping is not enabled so I'm only asking why it doesn't work when snooping is enabled.

My "show run" config on switch:

!
ip dhcp relay information trust-all
!
ip dhcp snooping vlan 1-100
ip dhcp snooping
!
interface FastEthernet0/1
 switchport trunk native vlan 99
 ip dhcp snooping trust
 switchport mode trunk
!
interface FastEthernet0/6
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/11
 switchport access vlan 20
 switchport mode access
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 no ip address
 ip helper-address 192.168.1.1
!
interface Vlan20
 no ip address
 ip helper-address 192.168.2.1
!
interface Vlan99
 ip address 192.168.99.99 255.255.255.0
!
end

My "show run" config on router:

ip dhcp relay information trust-all
!
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool VLAN10
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
ip dhcp pool VLAN20
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.2.1 255.255.255.0

Answer 1

This is a limitation with packet tracer it seems. I quickly replicated your set up in PT 7.0 with no luck.

If you put a server on a new switchport, put the port on the correct vlan and mark that port as trusted DHCP will work fine. I think if you did this with real kit it would work fine.

Answer 2

If you use the following command, your problem will be solved.

 no ip dhcp snooping information option

for example,my configuration:

sw1-f1-msh-p#show run | s snooping 
ip dhcp snooping vlan 201,706,3200-3272 
no ip dhcp snooping information option 
ip dhcp snooping trust  

Answer 3

When using DHCP snooping, I have often seen that you need to apply the following command to disable the relaying of DHCP option 82 to the DHCP server for it to actually work. Unless, of course, your DHCP server is set up with regards to option 82, which it is not in your case.

no ip dhcp snooping information option

Answer 4

Look at the router. The debug below tells you if it is receiving DHCP requests. [source Cisco]

In global configuration mode, enter the following access-list:

access-list 100 permit ip host 0.0.0.0 host 255.255.255.255

In exec mode, enter the following debug command:

debug ip packet detail 100

Sample output:

Router#debug ip packet detail 100
IP packet debugging is on (detailed) for access list 100
Router#
00:16:46: IP: s=0.0.0.0 (Ethernet4/0), d=255.255.255.255, len 604, rcvd 2
00:16:46: UDP src=68, dst=67
00:16:46: IP: s=0.0.0.0 (Ethernet4/0), d=255.255.255.255, len 604, rcvd 2
00:16:46: UDP src=68, dst=67