0

It seems impossible to configure DHCP snooping in an environment with a centralized DHCP server.

[three switches, ALS1, ALS2 and MLS, in a tree topology1

Using the following global configuration on all switches, the DHCP server is attached to access switch ALS1, ALS2 is an access switch and MLS is the core switch with a relay agent configured:

ip dhcp snooping
ip dhcp snooping vlan 100
no ip dhcp snooping information option
ip dhcp snooping information option allow-untrusted

ALS2 G0/0 - ip dhcp snooping trust

ALS1 G0/1 - ip dhcp snooping trust

MLS G0/1 - ip dhcp snooping trust

<Cisco 9300 16.12.3a and 2960X 15.2(7)>

All other interfaces are untrusted interfaces. Are there any additional configurations required or is DHCP relay incompatible with DHCP Snooping? What if the DHCP server was connected to MLS1 via a routed port? Would it still be possible to configure DHCP snooping in an effective way?

2
  • 1
    Are there users on ALS1? MLS and ALS1 do not need snooping unless there are user devices connected to it.
    – Ron Trunk
    Jul 27, 2023 at 12:45
  • There are users on all three switches in the topology and the DHCP server is on a different subnet. We are trying to simulate a DHCP server somewhere central to all branches. Jul 28, 2023 at 8:47

1 Answer 1

2

"Trust" must be on the interface(s) facing the DHCP server. (any port that would see a DHCP reply). That's ALS1 G0/1, MLS G0/0, and ALS2 G0/0. So You have the wrong interface trusted on MLS.

(I'll assume "VLAN 10" to R2 is a typo.)

2
  • Its not a typo, the users and the DHCP server are in two different subnets and I am trying to simulate that by having two VLANs. Forgot to include that in my question - my bad. Jul 28, 2023 at 8:46
  • Then you left out some important routing and dhcp relay configuration. That has to work in addition to snooping. (doesn't really change where trust must be applied.) Cisco switches don't log anything w.r.t. drops from snooping. Also, Packet Tracer doesn't always do things right.
    – Ricky
    Jul 28, 2023 at 17:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.