0

I am working on implementing DHCP Snooping on my switches and have found that when I do so it kills the DHCP connection to the clients. The network is as such:

enter image description here

The server with DNS is providing DHCP to 2 (60 & 70) of the 5 (20, 30 , 40, 50, 60 & 70) VLANs on the system at the moment. Server plugs into Switch A with ethernet cables with VLAN separation to support the various networks.

Switch A does NOT have ip dhcp snooping enabled. Switch A connects to Switch B trunking all 5 VLANs through fiber.

Switch B of which I am starting this configuration with, I am going to enable ip dhcp snooping on because it is down stream and will cause least amount of impact.

The client is a domain joined machine on VLAN 70 and has a valid DHCP lease and address. Client is plugged into Switch B with an ethernet cable.

Upon enabling DHCP Snooping on Switch B, the the client that is plugged into Switch B looses its IP address and DHCP will not issue it one.

The switch does not give any DHCP Snooping deny errors or any information on the port the client is plugged into other than the port being turned on or off and the cable being unplugged.

Does the client lose its address or access to DHCP because ip dhcp snooping is not enabled on Switch A and the ports the DHCP server plugs into Switch A is not set as trusted with ip arp inspection? If not why is the client not getting a DHCP address?

UPDATE 1: Enabled trust on the ports of switch A that DHCP was plugged into. Ran the command ip dhcp snooping vlan 30 on the DHCP VLAN. Immediately before I got to Switch B the ports stopped working on Switch A. Config is as follows:

!
! Last configuration change at 19:07:51 UTC Tue Mar 9 2021
! NVRAM config last updated at 19:07:55 UTC Tue Mar 9 2021
!
version 16.12
no service pad
service tcp-keepalives-in
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no platform punt-keepalive disable-kernel-core
!
hostname SWITCH
!
!
vrf definition Mgmt-vrf
 !
 address-family ipv4
 exit-address-family
 !
 address-family ipv6
 exit-address-family
!
logging buffered 4096 informational
logging console notifications
enable secret 9 ###############
enable password 7 #################
!
aaa new-model
!
!
aaa group server radius INSTRU-NET
 server-private 192.168.0.1 auth-port 1812 acct-port 1813 key 7 ###########################
 server-private 192.168.0.2 auth-port 1812 acct-port 1813 key 7 ###########################
!
aaa authentication login default group radius local
aaa authentication enable default group radius enable
aaa authentication webauth default group radius local
aaa authorization console
aaa authorization exec default group RADIUS local if-authenticated 
!
!
!
!
!
!
aaa session-id common
boot system switch all flash:packages.conf
clock timezone UTC -4 0
clock calendar-valid
switch 1 provision c9300-24t
!
!
!
!
call-home
 ! If contact email address in call-home is configured as [email protected]
 ! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
 contact-email-addr [email protected]
 profile "CiscoTAC-1"
  active
  destination transport-method http
  no destination transport-method email
!
ip name-server 192.168.0.1 192.168.0.2
ip name-server vrf Mgmt-vrf 192.168.0.1
ip domain name DOMAIN.COM
!
ip dhcp pool PRODUCTION
 network 162.168.5.0 255.255.254.0
!
!
!
ip dhcp snooping
login on-failure log
login on-success log
!
!
!
!
!
no device-tracking logging theft
!
crypto pki trustpoint TP-self-signed-1367883796
 enrollment selfsigned
 subject-name cn=IOS-Self-Signed-Certificate-1367883796
 revocation-check none
 rsakeypair TP-self-signed-1367883796
!
crypto pki trustpoint SLA-TrustPoint
 enrollment pkcs12
 revocation-check crl
!
!
crypto pki certificate chain TP-self-signed-1367883796
 certificate self-signed 01 nvram:IOS-Self-Sig#2.cer
crypto pki certificate chain SLA-TrustPoint
 certificate ca 01 nvram:CiscoLicensi#1CA.cer
!
license boot level network-essentials addon dna-essentials
license smart reservation
!
!
diagnostic bootup level minimal
!
spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree extend system-id
memory free low-watermark processor 134335
!
username Netadmin privilege 15 password 7 ################
!
redundancy
 mode sso
!
!
!
!
!
transceiver type all
 monitoring
!
!
class-map match-any system-cpp-police-ewlc-control
  description EWLC Control 
class-map match-any system-cpp-police-topology-control
  description Topology control
class-map match-any system-cpp-police-sw-forward
  description Sw forwarding, L2 LVX data packets, LOGGING, Transit Traffic
class-map match-any system-cpp-default
  description EWLC Data, Inter FED Traffic 
class-map match-any system-cpp-police-sys-data
  description Openflow, Exception, EGR Exception, NFL Sampled Data, RPF Failed
class-map match-any system-cpp-police-punt-webauth
  description Punt Webauth
class-map match-any system-cpp-police-l2lvx-control
  description L2 LVX control packets
class-map match-any system-cpp-police-forus
  description Forus Address resolution and Forus traffic
class-map match-any system-cpp-police-multicast-end-station
  description MCAST END STATION
class-map match-any system-cpp-police-high-rate-app
  description High Rate Applications 
class-map match-any system-cpp-police-multicast
  description MCAST Data
class-map match-any system-cpp-police-l2-control
  description L2 control
class-map match-any system-cpp-police-dot1x-auth
  description DOT1X Auth
class-map match-any system-cpp-police-data
  description ICMP redirect, ICMP_GEN and BROADCAST
class-map match-any system-cpp-police-stackwise-virt-control
  description Stackwise Virtual OOB
class-map match-any non-client-nrt-class
class-map match-any system-cpp-police-routing-control
  description Routing control and Low Latency
class-map match-any system-cpp-police-protocol-snooping
  description Protocol snooping
class-map match-any system-cpp-police-dhcp-snooping
  description DHCP snooping
class-map match-any system-cpp-police-ios-routing
  description L2 control, Topology control, Routing control, Low Latency
class-map match-any system-cpp-police-system-critical
  description System Critical and Gold Pkt
class-map match-any system-cpp-police-ios-feature
  description ICMPGEN,BROADCAST,ICMP,L2LVXCntrl,ProtoSnoop,PuntWebauth,MCASTData,Transit,DOT1XAuth,Swfwd,LOGGING,L2LVXData,ForusTraffic,ForusARP,McastEndStn,Openflow,Exception,EGRExcption,NflSampled,RpfFailed
!
policy-map system-cpp-policy
policy-map QOS_POLICY_SWITCHPORT
 class class-default
  bandwidth percent 25 
!
! 
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
 vrf forwarding Mgmt-vrf
 no ip address
 shutdown
 negotiation auto
!
interface GigabitEthernet1/0/1
 switchport access vlan 20
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/2
 switchport access vlan 3
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/3
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
 ip dhcp snooping limit rate 200
 ip dhcp snooping trust
!
interface GigabitEthernet1/0/4
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
 ip dhcp snooping limit rate 20
 ip dhcp snooping trust
!
interface GigabitEthernet1/0/5
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/6
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/7
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/8
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/9
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/10
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/11
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/12
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/13
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/14
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/15
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/16
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/17
 switchport access vlan 3
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/18
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/19
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/20
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/21
 switchport access vlan 30
 switchport mode access
 switchport block unicast
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/22
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/23
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/0/24
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport block unicast
 shutdown
 storm-control broadcast level bps 20m
 storm-control unicast level bps 62m
 spanning-tree bpduguard enable
 ip verify source
!
interface GigabitEthernet1/1/1
 description Disabled
 switchport access vlan 100
 switchport trunk native vlan 100
 switchport mode access
 shutdown
!
interface GigabitEthernet1/1/2
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface GigabitEthernet1/1/3
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface GigabitEthernet1/1/4
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface TenGigabitEthernet1/1/1
 switchport trunk native vlan 11
 switchport trunk allowed vlan 20-70
 switchport mode trunk
 switchport nonegotiate
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/2
 switchport trunk native vlan 110
 switchport trunk allowed vlan 20,30,60,70
 switchport mode trunk
 switchport nonegotiate
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/3
 switchport trunk native vlan 110
 switchport trunk allowed vlan 20-40
 switchport mode trunk
 switchport nonegotiate
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/4
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport nonegotiate
 shutdown
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/5
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport nonegotiate
 shutdown
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/6
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport nonegotiate
 shutdown
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/7
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport nonegotiate
 shutdown
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/8
 description Disabled
 switchport access vlan 100
 switchport mode access
 switchport nonegotiate
 shutdown
 udld port aggressive
 service-policy output QOS_POLICY_SWITCHPORT
!
interface FortyGigabitEthernet1/1/1
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface FortyGigabitEthernet1/1/2
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface TwentyFiveGigE1/1/1
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface TwentyFiveGigE1/1/2
 description Disabled
 switchport access vlan 100
 switchport mode access
 shutdown
!
interface AppGigabitEthernet1/0/1
!
interface Vlan1
 no ip address
 shutdown
!
interface Vlan20
 ip address 192.168.0.50 255.255.255.0
!
interface Vlan30
 no ip address
!
interface Vlan40
 no ip address
!
interface Vlan50
 no ip address
!
interface Vlan60
 no ip address
!
interface Vlan70
 no ip address
!
interface Vlan100
 no ip address
!
interface Vlan110
 no ip address
!
ip forward-protocol nd
no ip http server
ip http authentication aaa login-authentication default
ip http secure-server
ip tftp source-interface Vlan2
ip ssh time-out 60
ip ssh version 2
ip ssh server algorithm mac hmac-sha1 hmac-sha1-96
ip ssh server algorithm encryption aes128-cbc aes192-cbc aes256-cbc
ip scp server enable
!
!
logging trap debugging
logging host 1.1.1.1
logging host 192.168.0.1
ip access-list standard 3
 50 permit 192.168.0.1 log
 10 permit 192.168.0.2 log
 40 permit 192.168.0.100 log
 20 permit 192.168.0.101 log
 30 permit 192.168.0.102 log
 60 deny   any log
!
!
!
radius server SERVER01
 address ipv4 192.168.0.1 auth-port 1645 acct-port 1646
 key 7 ###############################
!
radius server SERVER01
 address ipv4 192.168.0.2 auth-port 1645 acct-port 1646
 key 7 ###############################
!
!
control-plane
 service-policy input system-cpp-policy
!
!
line con 0
 stopbits 1
line vty 0 4
 access-class 3 in
 password 7 #######################
 length 0
 transport input ssh
line vty 5 15
 password 7 #######################
 transport input ssh
!
ntp authentication-key 1 md5 ############################ 7
ntp authenticate
ntp server 192.168.0.10 prefer
!
!
!
!
!
!
end
Improve this question
5
  • 3
    You need to set up a DHCP snooping trust for the inter-switch interface, towards the server.
    – Zac67 ♦
    Mar 3, 2021 at 13:19
  • @Zac67 so ip dhcp snooping needs to be enabled on Switch A and the port hosting the DHCP the server is on needs to be trusted as well as the Trunk ports?
    – JukEboX
    Mar 3, 2021 at 13:22
  • 1
    No - if you just enable snooping on SW B, there's no trusted server/port. You need to add trust to make it work again.
    – Zac67 ♦
    Mar 3, 2021 at 13:26
  • @Zac67 I have set the trunk as a trust but it still stops DHCP. This is still to say the SW A does not have it enabled and the Trunk on the SW A side is not trusted.
    – JukEboX
    Mar 3, 2021 at 13:57
  • 1
    Please add the switch model(s) and their relevant configs to your question. It's possible that you need to add trust based on server IP address, VLAN, ...
    – Zac67 ♦
    Mar 3, 2021 at 14:14

2 Answers 2

Reset to default
2

If you just enable DHCP snooping the switch begins to monitor and filter(!) DHCP traffic.

If you don't also set up trust for the server-facing port (or server IP address, depending on the exact switch model), DHCP stops working.

You need to trust the trunk to switch A to re-enable DHCP.

Improve this answer
4
  • so the trust needs to be set on both sides of the trunk. Correct? As well as the ports the DHCP server is plugged into. Correct?
    – JukEboX
    Mar 3, 2021 at 13:56
  • 2
    You need trust towards the server - SW B needs to trust the trunk port, and SW A (if set up with snooping) needs to trust the server port.
    – Zac67 ♦
    Mar 3, 2021 at 14:07
  • I enabled trust on the DHCP server based ports and turned on snooping and it still killed all the ports.
    – JukEboX
    Mar 10, 2021 at 12:43
  • Need to remember that we input the commands in the correct order after setting the trusts on all trunk links and DHCP servers. ip dhcp snooping, ip verify source.
    – JukEboX
    Mar 19, 2021 at 17:11
1

For Windows PCs and Windows DHCP server, you need to include these global commands:

no ip dhcp snooping information option
no ip dhcp snooping verify mac-address
no ip dhcp snooping verify no-relay-agent-address
Improve this answer
2
  • does this need to be set on the ports the DHCP servers are on or all other access ports?
    – JukEboX
    Mar 10, 2021 at 18:20
  • 1
    These are global commands
    – Ron Trunk
    Mar 10, 2021 at 18:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.