I am working on implementing DHCP Snooping on my switches and have found that when I do so it kills the DHCP connection to the clients. The network is as such:
The server with DNS is providing DHCP to 2 (60 & 70) of the 5 (20, 30 , 40, 50, 60 & 70) VLANs on the system at the moment. Server plugs into Switch A with ethernet cables with VLAN separation to support the various networks.
Switch A does NOT have ip dhcp snooping
enabled. Switch A connects to Switch B trunking all 5 VLANs through fiber.
Switch B of which I am starting this configuration with, I am going to enable ip dhcp snooping
on because it is down stream and will cause least amount of impact.
The client is a domain joined machine on VLAN 70 and has a valid DHCP lease and address. Client is plugged into Switch B with an ethernet cable.
Upon enabling DHCP Snooping on Switch B, the the client that is plugged into Switch B looses its IP address and DHCP will not issue it one.
The switch does not give any DHCP Snooping deny errors or any information on the port the client is plugged into other than the port being turned on or off and the cable being unplugged.
Does the client lose its address or access to DHCP because ip dhcp snooping
is not enabled on Switch A and the ports the DHCP server plugs into Switch A is not set as trusted with ip arp inspection
? If not why is the client not getting a DHCP address?
UPDATE 1: Enabled trust on the ports of switch A that DHCP was plugged into. Ran the command ip dhcp snooping vlan 30
on the DHCP VLAN. Immediately before I got to Switch B the ports stopped working on Switch A.
Config is as follows:
!
! Last configuration change at 19:07:51 UTC Tue Mar 9 2021
! NVRAM config last updated at 19:07:55 UTC Tue Mar 9 2021
!
version 16.12
no service pad
service tcp-keepalives-in
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
no platform punt-keepalive disable-kernel-core
!
hostname SWITCH
!
!
vrf definition Mgmt-vrf
!
address-family ipv4
exit-address-family
!
address-family ipv6
exit-address-family
!
logging buffered 4096 informational
logging console notifications
enable secret 9 ###############
enable password 7 #################
!
aaa new-model
!
!
aaa group server radius INSTRU-NET
server-private 192.168.0.1 auth-port 1812 acct-port 1813 key 7 ###########################
server-private 192.168.0.2 auth-port 1812 acct-port 1813 key 7 ###########################
!
aaa authentication login default group radius local
aaa authentication enable default group radius enable
aaa authentication webauth default group radius local
aaa authorization console
aaa authorization exec default group RADIUS local if-authenticated
!
!
!
!
!
!
aaa session-id common
boot system switch all flash:packages.conf
clock timezone UTC -4 0
clock calendar-valid
switch 1 provision c9300-24t
!
!
!
!
call-home
! If contact email address in call-home is configured as [email protected]
! the email address configured in Cisco Smart License Portal will be used as contact email address to send SCH notifications.
contact-email-addr [email protected]
profile "CiscoTAC-1"
active
destination transport-method http
no destination transport-method email
!
ip name-server 192.168.0.1 192.168.0.2
ip name-server vrf Mgmt-vrf 192.168.0.1
ip domain name DOMAIN.COM
!
ip dhcp pool PRODUCTION
network 162.168.5.0 255.255.254.0
!
!
!
ip dhcp snooping
login on-failure log
login on-success log
!
!
!
!
!
no device-tracking logging theft
!
crypto pki trustpoint TP-self-signed-1367883796
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-1367883796
revocation-check none
rsakeypair TP-self-signed-1367883796
!
crypto pki trustpoint SLA-TrustPoint
enrollment pkcs12
revocation-check crl
!
!
crypto pki certificate chain TP-self-signed-1367883796
certificate self-signed 01 nvram:IOS-Self-Sig#2.cer
crypto pki certificate chain SLA-TrustPoint
certificate ca 01 nvram:CiscoLicensi#1CA.cer
!
license boot level network-essentials addon dna-essentials
license smart reservation
!
!
diagnostic bootup level minimal
!
spanning-tree mode rapid-pvst
spanning-tree loopguard default
spanning-tree extend system-id
memory free low-watermark processor 134335
!
username Netadmin privilege 15 password 7 ################
!
redundancy
mode sso
!
!
!
!
!
transceiver type all
monitoring
!
!
class-map match-any system-cpp-police-ewlc-control
description EWLC Control
class-map match-any system-cpp-police-topology-control
description Topology control
class-map match-any system-cpp-police-sw-forward
description Sw forwarding, L2 LVX data packets, LOGGING, Transit Traffic
class-map match-any system-cpp-default
description EWLC Data, Inter FED Traffic
class-map match-any system-cpp-police-sys-data
description Openflow, Exception, EGR Exception, NFL Sampled Data, RPF Failed
class-map match-any system-cpp-police-punt-webauth
description Punt Webauth
class-map match-any system-cpp-police-l2lvx-control
description L2 LVX control packets
class-map match-any system-cpp-police-forus
description Forus Address resolution and Forus traffic
class-map match-any system-cpp-police-multicast-end-station
description MCAST END STATION
class-map match-any system-cpp-police-high-rate-app
description High Rate Applications
class-map match-any system-cpp-police-multicast
description MCAST Data
class-map match-any system-cpp-police-l2-control
description L2 control
class-map match-any system-cpp-police-dot1x-auth
description DOT1X Auth
class-map match-any system-cpp-police-data
description ICMP redirect, ICMP_GEN and BROADCAST
class-map match-any system-cpp-police-stackwise-virt-control
description Stackwise Virtual OOB
class-map match-any non-client-nrt-class
class-map match-any system-cpp-police-routing-control
description Routing control and Low Latency
class-map match-any system-cpp-police-protocol-snooping
description Protocol snooping
class-map match-any system-cpp-police-dhcp-snooping
description DHCP snooping
class-map match-any system-cpp-police-ios-routing
description L2 control, Topology control, Routing control, Low Latency
class-map match-any system-cpp-police-system-critical
description System Critical and Gold Pkt
class-map match-any system-cpp-police-ios-feature
description ICMPGEN,BROADCAST,ICMP,L2LVXCntrl,ProtoSnoop,PuntWebauth,MCASTData,Transit,DOT1XAuth,Swfwd,LOGGING,L2LVXData,ForusTraffic,ForusARP,McastEndStn,Openflow,Exception,EGRExcption,NflSampled,RpfFailed
!
policy-map system-cpp-policy
policy-map QOS_POLICY_SWITCHPORT
class class-default
bandwidth percent 25
!
!
!
!
!
!
!
!
!
!
interface GigabitEthernet0/0
vrf forwarding Mgmt-vrf
no ip address
shutdown
negotiation auto
!
interface GigabitEthernet1/0/1
switchport access vlan 20
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/2
switchport access vlan 3
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/3
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
ip dhcp snooping limit rate 200
ip dhcp snooping trust
!
interface GigabitEthernet1/0/4
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
ip dhcp snooping limit rate 20
ip dhcp snooping trust
!
interface GigabitEthernet1/0/5
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/6
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/7
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/8
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/9
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/10
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/11
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/12
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/13
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/14
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/15
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/16
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/17
switchport access vlan 3
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/18
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/19
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/20
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/21
switchport access vlan 30
switchport mode access
switchport block unicast
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/22
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/23
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/0/24
description Disabled
switchport access vlan 100
switchport mode access
switchport block unicast
shutdown
storm-control broadcast level bps 20m
storm-control unicast level bps 62m
spanning-tree bpduguard enable
ip verify source
!
interface GigabitEthernet1/1/1
description Disabled
switchport access vlan 100
switchport trunk native vlan 100
switchport mode access
shutdown
!
interface GigabitEthernet1/1/2
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface GigabitEthernet1/1/3
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface GigabitEthernet1/1/4
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface TenGigabitEthernet1/1/1
switchport trunk native vlan 11
switchport trunk allowed vlan 20-70
switchport mode trunk
switchport nonegotiate
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/2
switchport trunk native vlan 110
switchport trunk allowed vlan 20,30,60,70
switchport mode trunk
switchport nonegotiate
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/3
switchport trunk native vlan 110
switchport trunk allowed vlan 20-40
switchport mode trunk
switchport nonegotiate
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/4
description Disabled
switchport access vlan 100
switchport mode access
switchport nonegotiate
shutdown
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/5
description Disabled
switchport access vlan 100
switchport mode access
switchport nonegotiate
shutdown
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/6
description Disabled
switchport access vlan 100
switchport mode access
switchport nonegotiate
shutdown
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/7
description Disabled
switchport access vlan 100
switchport mode access
switchport nonegotiate
shutdown
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface TenGigabitEthernet1/1/8
description Disabled
switchport access vlan 100
switchport mode access
switchport nonegotiate
shutdown
udld port aggressive
service-policy output QOS_POLICY_SWITCHPORT
!
interface FortyGigabitEthernet1/1/1
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface FortyGigabitEthernet1/1/2
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface TwentyFiveGigE1/1/1
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface TwentyFiveGigE1/1/2
description Disabled
switchport access vlan 100
switchport mode access
shutdown
!
interface AppGigabitEthernet1/0/1
!
interface Vlan1
no ip address
shutdown
!
interface Vlan20
ip address 192.168.0.50 255.255.255.0
!
interface Vlan30
no ip address
!
interface Vlan40
no ip address
!
interface Vlan50
no ip address
!
interface Vlan60
no ip address
!
interface Vlan70
no ip address
!
interface Vlan100
no ip address
!
interface Vlan110
no ip address
!
ip forward-protocol nd
no ip http server
ip http authentication aaa login-authentication default
ip http secure-server
ip tftp source-interface Vlan2
ip ssh time-out 60
ip ssh version 2
ip ssh server algorithm mac hmac-sha1 hmac-sha1-96
ip ssh server algorithm encryption aes128-cbc aes192-cbc aes256-cbc
ip scp server enable
!
!
logging trap debugging
logging host 1.1.1.1
logging host 192.168.0.1
ip access-list standard 3
50 permit 192.168.0.1 log
10 permit 192.168.0.2 log
40 permit 192.168.0.100 log
20 permit 192.168.0.101 log
30 permit 192.168.0.102 log
60 deny any log
!
!
!
radius server SERVER01
address ipv4 192.168.0.1 auth-port 1645 acct-port 1646
key 7 ###############################
!
radius server SERVER01
address ipv4 192.168.0.2 auth-port 1645 acct-port 1646
key 7 ###############################
!
!
control-plane
service-policy input system-cpp-policy
!
!
line con 0
stopbits 1
line vty 0 4
access-class 3 in
password 7 #######################
length 0
transport input ssh
line vty 5 15
password 7 #######################
transport input ssh
!
ntp authentication-key 1 md5 ############################ 7
ntp authenticate
ntp server 192.168.0.10 prefer
!
!
!
!
!
!
end