1

I have some problems with a very simple DHCP snooping configuration.

My topology

I'm using a very simple topology using router on a stick. I use VLAN 10 and VLAN 20.

My Clients can get DHCP from my router when dhcp snooping is not enabled on my switch, but when I enable snooping they can no longer get an IP.

My switch has interface f0/6 and f0/11 as access ports, f0/6 is on vlan 10 and f0/11 is on vlan 20. f0/1 is in trunking mode.

My switch config:

Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
1-100
Insertion of option 82 is enabled
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Interface                  Trusted    Rate limit (pps)
-----------------------    -------    ----------------
FastEthernet0/1            yes        unlimited       

I have full connectivity when DHCP snooping is not enabled so I'm only asking why it doesn't work when snooping is enabled.

My "show run" config on switch:

!
ip dhcp relay information trust-all
!
ip dhcp snooping vlan 1-100
ip dhcp snooping
!
interface FastEthernet0/1
 switchport trunk native vlan 99
 ip dhcp snooping trust
 switchport mode trunk
!
interface FastEthernet0/6
 switchport access vlan 10
 switchport mode access
!
interface FastEthernet0/11
 switchport access vlan 20
 switchport mode access
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan10
 no ip address
 ip helper-address 192.168.1.1
!
interface Vlan20
 no ip address
 ip helper-address 192.168.2.1
!
interface Vlan99
 ip address 192.168.99.99 255.255.255.0
!
end

My "show run" config on router:

ip dhcp relay information trust-all
!
ip dhcp excluded-address 192.168.1.1
ip dhcp excluded-address 192.168.2.1
!
ip dhcp pool VLAN10
 network 192.168.1.0 255.255.255.0
 default-router 192.168.1.1
ip dhcp pool VLAN20
 network 192.168.2.0 255.255.255.0
 default-router 192.168.2.1
!
interface GigabitEthernet0/0.10
 encapsulation dot1Q 10
 ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet0/0.20
 encapsulation dot1Q 20
 ip address 192.168.2.1 255.255.255.0
  • Interface f0/1 needs to be marked as trusted. Could you supply full configuration to verify. – Datagram.Network Aug 11 '16 at 8:29
  • Well my g0/0 is on my router, DHCP snooping is configured on my switch. interface FastEthernet0/1 is configured with native vlan 99, ip dhcp snooping trust, switchport mode trunk – Bungicasse Aug 11 '16 at 8:31
  • I have added relevant configuration to my question. – Bungicasse Aug 11 '16 at 8:44
  • Could you please supply with output: #sh ip dhcp snooping – Datagram.Network Aug 11 '16 at 9:53
  • I already gave you the output of "show ip dhcp snooping" on my switch. – Bungicasse Aug 11 '16 at 9:58
1

This is a limitation with packet tracer it seems. I quickly replicated your set up in PT 7.0 with no luck.

If you put a server on a new switchport, put the port on the correct vlan and mark that port as trusted DHCP will work fine. I think if you did this with real kit it would work fine.

0

When using DHCP snooping, I have often seen that you need to apply the following command to disable the relaying of DHCP option 82 to the DHCP server for it to actually work. Unless, of course, your DHCP server is set up with regards to option 82, which it is not in your case.

no ip dhcp snooping information option
  • Trust me I have tried and it still doesn't work. It might be Cisco Packet Tracer having problems – Bungicasse Aug 11 '16 at 13:28
  • @Bungicasse just to be certain, I set up your configuration with a physical router and switch in the lab, and everything worked just fine with both VLANs. I also did some various configuration changes (option 82, relay trust, etc) and it still worked. This would indicate there might be an issue with the Packet Tracer as you say. – eriktm Aug 11 '16 at 15:48
0

Look at the router. The debug below tells you if it is receiving DHCP requests. [source Cisco]

In global configuration mode, enter the following access-list:

access-list 100 permit ip host 0.0.0.0 host 255.255.255.255

In exec mode, enter the following debug command:

debug ip packet detail 100

Sample output:

Router#debug ip packet detail 100
IP packet debugging is on (detailed) for access list 100
Router#
00:16:46: IP: s=0.0.0.0 (Ethernet4/0), d=255.255.255.255, len 604, rcvd 2
00:16:46: UDP src=68, dst=67
00:16:46: IP: s=0.0.0.0 (Ethernet4/0), d=255.255.255.255, len 604, rcvd 2
00:16:46: UDP src=68, dst=67

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.