Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Just a dumb question..
I have 1 core switch and 5 access switches.
Just wondering if it would be best to setup the IP helper on all access switches rather than just on the core switch?
Does this take a lot of processing resources for about 400 desks?
Thanks!
Most probably your core switch has the gateway ip of the subnet like 192.168.1.1. If you want to enable ip-helper on your access switches, then you need to assign ip to the vlan on access switches something like from 192.168.1.2 to 192.168.1.6.
In this case all 6 switches will translate broadcast DHCP discover to unicast and send to DHCP server. DHCP server will receive 6 Discover and reply with 6 Offer. These 6 DHCP Offer will be relayed by all switches to the host so host PC will receive 6 offer. This means a lot of process for everyone without a benefit.
DHCP relay is not something cause high cpu load. It is always best practice to enable ip-helper where your gateway ip is configured for the subnet.
The ip helper address goes on the layer 3 (vlan) interface.
IP Helper (in configuration mode: ip helper-address) is functioning on network layer, because it forwards dhcp clients to the dhcp server on another network (lan segment or VLAN).
SO if you are talking about core switch as Layer 3 switch then configure IP Helper Addressing only on the CORE SWITCH, not on all the switches (btw, for layer 2 switches you cannot even turn on the ip routing)
IP Helpers are used to translate a DHCP Broadcast into a Unicast message to be forwarded outside of a Broadcast domain. As a result, this helper needs to be configured on the edge of the Broadcast domain which will be a Layer 3 interface.
If you want to set IP helper configuration on layer-2 switches, that switch needs to have an SVI IP address on that VLAN. Layer 2 switch will still use the core layer-3 switch to send the request to the DHCP server. The only thing layer-2 switch will do is to convert the broadcast request to unicast. You won't achieve anything good and you will have additional security concerns for having switch IP addresses on user VLAN.
If you enable DHCP snooping to stop broadcasts between switches when enabling ip helper on those switches, it will allow you to terminate the DHCP broadcasting in the given switch, and send a single unicast onward through the remainder of the network.
This reduces the overhead of re-broadcasting the boot-p broadcasts through the rest of the switches that hold the given network segment, and thus reduces the impact of malicious or misconfigured clients from flooding the entire network segment with boot-p requests.
This will also help you locate the source switch where the device being plugged in is located, as it's local access switch will be the source of the unicast DHCP request received by the server.
If, however, you don't use DHCP, then while not providing these additional benefits, the additional overhead on any given network is negligible.
The Server will reply with only 1 IP address to the several unicast requests as a decently implemented DHCP server must needs track the client requests by their MAC addresses.
ie: If you have 30 switches on the segment, then you will only be adding 30 unicast packets out, 30 replies by the server all with the same IP offer, and 30 responses to the client, which will only reply to one of the offers, finishing the acceptance hand-shake.
Thus, the only real drawback is adding a small number of unicast communications for almost no over-head to the workload of the network, which is a minor matter.
However, as noted, when coupled with limiting the broadcasts per switch using DHCP snooping it moves from merely 'not a big deal if done' to actively providing benefits by reducing unneeded broadcast traffic and limiting DOS via DHCP to individual switches.
Just wondering if it would be best to setup the IP helper on all access switches rather than just on the core switch?
The "best" is always arguable.
If there's no redundancy between the access switches and the DHCP server there's little point in setting up more than one DHCP relay (on the core).
Assuming somewhat reasonable DHCP lease times, the generated traffic - whether broadcast or unicast - for a few hundred end nodes is negligible.
