DCHP Snooping

IanT · May 2014

Good Day,

I am working on DHCP Snooping.

For example I have 3 x switches.

Do you enable the following commands on all switches or only the switch connected to the DHCP Server:

SW1

Config t

Ip dhcp snooping

Ip dhcp snooping vlan 8-15

Ip dhcp snooping database flash:/snooping.txt

!

Int gig 0/1

Description *** PORT to DHCP SERVER ***

Ip dhcp snooping trust

!

Int gig 0/24

Description *** TRUNK to SW2 ***

Ip dhcp snooping trust

!

Int gig 0/23

Description *** TRUNK to SW3 ***

Ip dhcp snooping trust

SW2

Config t

Ip dhcp snooping

Ip dhcp snooping vlan 8-15

Ip dhcp snooping database flash:/snooping.txt

!

Int gig 0/24

Description *** TRUNK to SW1 ***

Ip dhcp snooping trust

SW3

Config t

Ip dhcp snooping

Ip dhcp snooping vlan 8-15

Ip dhcp snooping database flash:/snooping.txt

!

Int gig 0/24

Description *** TRUNK to SW1 ***

Ip dhcp snooping trust

I am looking for a best practise solution

On what trunk ports do you enable : ip dhcp snooping trust in your design?

Thanks

rriker · May 2014

You would enable dhcp snooping trust on trunk links that lead to a switch that connects to the DHCP server. On the switch that connects to the server you would do the same. For all switches attached, on those trunks you would need that command on those ports as well. Your leaf switch needs it because an incoming DHCP broadcast message received in on a port that isn't trusted would be dropped, since the switch thinks it's being spoofed. You would also enable this with DAI, dyncamic arp inspection, this ties the ARP resolution to the IP address.

HTH

Rob

On Wednesday, May 7, 2014 2:13 PM, IanT <[email protected]> wrote:

Good Day,

I am working on DHCP Snooping.

For example I have 3 x switches.

Do you enable the following commands on all switches or only the switch connected to the DHCP Server:

SW1

Config t

Ip dhcp snooping

Ip dhcp snooping vlan 8-15

Ip dhcp snooping database flash:/snooping.txt

!

Int gig 0/1

Description *** PORT to DHCP SERVER ***

Ip dhcp snooping trust

!

Int gig 0/24

Description *** TRUNK to SW2 ***

Ip dhcp snooping trust

!

Int gig 0/23

Description *** TRUNK to SW3 ***

Ip dhcp snooping trust

SW2

Config t

Ip dhcp snooping

Ip dhcp snooping vlan 8-15

Ip dhcp snooping database flash:/snooping.txt

!

Int gig 0/24

Description *** TRUNK to SW1 ***

Ip dhcp snooping trust

SW3

Config t

Ip dhcp snooping

Ip dhcp snooping vlan 8-15

Ip dhcp snooping database flash:/snooping.txt

!

Int gig 0/24

Description *** TRUNK to SW1 ***

Ip dhcp snooping trust

I am looking for a best practise solution

On what trunk ports do you enable : ip dhcp snooping trust in your design?

Thanks

Internetwork Expert - The Industry Leader in CCIE Preparation

http://www.internetworkexpert.com

IanT · May 2014

Thanks Rob.

On the other switches do I need to enable ip dhcp snooping or do you enable ip dhcp snooping only on the switch where the DHCP server is connected?

Thanks

rriker · May 2014

On the switch that is connected to the server and the trunk links of all switches that need to pass dhcp info from the server to the clients. Every trunk link needs it. If not configured, upstream switch will drop dhcp packets received in.

Sent from my Cricket smartphone

-------- Original message --------
From: IanT
Date:05/08/2014 12:12 AM (GMT-06:00)
To: [email protected]
Subject: Re: [ccnp] DCHP Snooping

Thanks Rob.

On the other switches do I need to enable ip dhcp snooping or do you enable ip dhcp snooping only on the switch where the DHCP server is connected?

Thanks

Internetwork Expert - The Industry Leader in CCIE Preparation

http://www.internetworkexpert.com

IanT · May 2014

I did the following dhcp snooping config:

SW1

ip dhcp snooping vlan 8-9

no ip dhcp snooping information option

ip dhcp snooping database flash:/dhcp_snooping_db.txt

ip dhcp snooping

!

interface GigabitEthernet0/1

Description *** DHCP SERVER - 10.224.8.10 ***

switchport access vlan 8

switchport mode access

spanning-tree portfast

ip dhcp snooping trust

SW2

ip dhcp snooping vlan 8-9

no ip dhcp snooping information option

ip dhcp snooping database flash:/dhcp_snooping_db.txt

ip dhcp snooping

!

interface FastEthernet0/24

Description *** Trunk to SW1 ***

switchport trunk encapsulation dot1q

switchport mode trunk

switchport nonegotiate

spanning-tree portfast trunk

ip dhcp snooping trust

When i connect a client on SW2 the client receives an IP and everything looks 100%.

When i do a debug on SW1 i received the following information almost every minute:

02:03:05: DHCP_SNOOPING: checking expired snoop binding entries

02:03:51: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/24 for pak. Was Vl9

02:03:51: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Vl9 for pak. Was Gi0/24

02:03:51: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/24 for pak. Was Vl9

02:03:51: DHCP_SNOOPING: received new DHCP packet from input interface (GigabitEthernet0/24)

02:03:51: DHCP_SNOOPING: process new DHCP packet, message type: DHCPINFORM, input interface: Gi0/24, MAC da: ffff.ffff.ffff, MAC sa: 782b.cbc6.7b8f, IP da: 255.255.255.255, IP sa: 10.224.9.10, DHCP ciaddr: 10.224.9.10, DHCP yiaddr: 0.0.0.0, DHCP siaddr: 0.0.0.0, DHCP giaddr: 0.0.0.0, DHCP chaddr: 782b.cbc6.7b8f

02:03:51: DHCP_SNOOPING_SW: bridge packet get invalid mat entry: FFFF.FFFF.FFFF, packet is flooded to ingress VLAN: (9)

02:03:51: DHCP_SNOOPING_SW: bridge packet send packet to cpu port: Vlan9.

02:03:51: DHCP_SNOOPING: received new DHCP packet from input interface (Vlan8)

02:03:51: DHCP_SNOOPING: process new DHCP packet, message type: DHCPINFORM, input interface: Vl8, MAC da: 984b.e17e.b4a9, MAC sa: 0027.0c6d.73c1, IP da: 10.224.8.10, IP sa: 10.224.9.1, DHCP ciaddr: 10.224.9.10, DHCP yiaddr: 0.0.0.0, DHCP siaddr: 0.0.0.0, DHCP giaddr: 10.224.9.1, DHCP chaddr: 782b.cbc6.7b8f

02:03:51: DHCP_SNOOPING_SW: exclude source cpu port Vlan8 from output portset.

02:03:51: DHCP_SNOOPING_SW: bridge packet send packet to port: GigabitEthernet0/1.

02:03:51: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/1 for pak. Was Vl8

02:03:51: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Vl8 for pak. Was Gi0/1

02:03:51: DHCPSNOOP(hlfm_set_if_input): Setting if_input to Gi0/1 for pak. Was Vl8

02:03:51: DHCP_SNOOPING: received new DHCP packet from input interface (GigabitEthernet0/1)

02:03:51: DHCP_SNOOPING: process new DHCP packet, message type: DHCPACK, input interface: Gi0/1, MAC da: 0027.0c6d.73c1, MAC sa: 984b.e17e.b4a9, IP da: 10.224.9.1, IP sa: 10.224.8.10, DHCP ciaddr: 10.224.9.10, DHCP yiaddr: 0.0.0.0, DHCP siaddr: 0.0.0.0, DHCP giaddr: 10.224.9.1, DHCP chaddr: 782b.cbc6.7b8f

02:03:51: DHCP_SNOOPING_SW: client address lookup failed to locate client interface, retry lookup using packet mac DA: 0027.0c6d.73c1

02:03:51: DHCP_SNOOPING_SW: lookup packet destination port failed to get mat entry for mac: 782b.cbc6.7b8f

02:03:51: DHCP_SNOOPING: can't find client's destination port, packet is assumed to be not from local switch, no binding update is needed.

02:03:51: DHCP_SNOOPING_SW: bridge packet get invalid mat entry: 0027.0C6D.73C1, packet is flooded to ingress VLAN: (8)

02:03:51: DHCP_SNOOPING_SW: bridge packet send packet to cpu port: Vlan8.

02:03:51: DHCP_SNOOPING: received new DHCP packet from input interface (Vlan9)

02:03:51: DHCP_SNOOPING: process new DHCP packet, message type: DHCPACK, input interface: Vl9, MAC da: ffff.ffff.ffff, MAC sa: 0027.0c6d.73c2, IP da: 255.255.255.255, IP sa: 10.224.9.1, DHCP ciaddr: 10.224.9.10, DHCP yiaddr: 0.0.0.0, DHCP siaddr: 0.0.0.0, DHCP giaddr: 10.224.9.1, DHCP chaddr: 782b.cbc6.7b8f

02:03:51: DHCP_SNOOPING: intercepted DHCPACK with no DHCPOPT_LEASE_TIME option field, packet is still forwarded but no snooping binding update is performed.

02:03:51: DHCP_SNOOPING: direct forward dhcp reply to output port: GigabitEthernet0/24.

Is this normal?

Why does this debug happen so frequently?

Thanks

rriker · May 2014

Did you apply ip dhcp snooping trust on sw1 on the trunk to sw 2? Is the DHCP server directly attached to sw1 and on a different vlan? If so, try the helper address under the svi and point the helper address to the interface of the dhcp server. If there is a router separating the DHCP server from destination vlan then use the helper address there. If the router is the DHCP server I'd be curious to see the output from that on what it's receiving. Is the client receiving an address and can the client surf without issue?

HTH

Rob

On Thursday, May 8, 2014 12:56 PM, IanT <[email protected]> wrote: