topic Re: Cisco IOS XE DHCP Client - disable options from being sent in disc in Routing and SD-WAN

Cisco IOS XE DHCP Client - disable options from being sent in discover

mcotherman — Mon, 11 Dec 2023 01:44:38 GMT

I am running 17.9.04a on a C1111-8PLTEEAWB and trying to set up the DHCP client so that I can connect it to my ISP's Fiber ONT instead of their provided eero router without losing my IP address. The eero will faithfully get the IP it wants back, even after a long outage... I can power-cycle the ONT and get a new address, but really want to get mac-cloning working.

interface GigabitEthernet0/0/0
description connected to Internet
mac-address 5027.a92d.ffff
ip dhcp client client-id ascii eero
ip dhcp client broadcast-flag clear
ip dhcp client class-id ascii
ip dhcp client hostname eero
ip dhcp client option 50 ip 47.***.***.***
ip address dhcp
negotiation auto

I am looking at the IP Addressing Configuration Guide, Cisco IOS XE 17.x and other Cisco docs that allowed me to get part of the way, using commands like "ip dhcp client broadcast-flag clear" to set the unicast bootp flag.

FYI - I am not able to use the command "ip dhcp client vendor-class disable" that is referenced.

packet capture of eero discover that gets a response and successfully negotiates the requested IP address:

No. Time Source Destination Protocol Length Info 3 20:52:50.827999 0.0.0.0 255.255.255.255 DHCP 342 DHCP Discover - Transaction ID 0x7deccd76 Frame 3: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) on interface \Device\NPF_{55FDD48B-D4C7-4C49-9A40-88F5C0C4155B}, id 0 Ethernet II, Src: 50:27:a9:2d:ff:ff (50:27:a9:2d:ff:ff), Dst: Broadcast (ff:ff:ff:ff:ff:ff) Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255 User Datagram Protocol, Src Port: 68, Dst Port: 67 Dynamic Host Configuration Protocol (Discover) Message type: Boot Request (1) Hardware type: Ethernet (0x01) Hardware address length: 6 Hops: 0 Transaction ID: 0x7deccd76 Seconds elapsed: 10 Bootp flags: 0x0000 (Unicast) Client IP address: 0.0.0.0 Your (client) IP address: 0.0.0.0 Next server IP address: 0.0.0.0 Relay agent IP address: 0.0.0.0 Client MAC address: 50:27:a9:2d:ff:ff (50:27:a9:2d:ff:ff) Client hardware address padding: 00000000000000000000 Server host name not given Boot file name not given Magic cookie: DHCP Option: (53) DHCP Message Type (Discover) Option: (50) Requested IP Address (47.***.***.***)) Option: (12) Host Name Option: (55) Parameter Request List Length: 13 Parameter Request List Item: (1) Subnet Mask Parameter Request List Item: (28) Broadcast Address Parameter Request List Item: (2) Time Offset Parameter Request List Item: (3) Router Parameter Request List Item: (15) Domain Name Parameter Request List Item: (6) Domain Name Server Parameter Request List Item: (119) Domain Search Parameter Request List Item: (12) Host Name Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server Parameter Request List Item: (47) NetBIOS over TCP/IP Scope Parameter Request List Item: (26) Interface MTU Parameter Request List Item: (121) Classless Static Route Parameter Request List Item: (43) Vendor-Specific Information Option: (255) End Padding: 0000000000000000000000000000000000000000000000000000000000

Packet capture of the latest iteration of the IOS-XE DHCP Client configuration (no response from ISP's DHCP server). You will see that the Cisci IOS-XE DHCP client is adding in options 60,61, and124

I do not know if these are causing the ISP DHCP Server to not respond or if it is something else, but I would like to remove them (I am successful at *changing* the host identifier, the client identifier, and the vendor class identifier, and , but I really need to 'eliminate' them from being sent at all in the DHCP Discover message.

No. Time Source Destination Protocol Length Info 1 23:18:13.503795 0.0.0.0 255.255.255.255 DHCP 349 DHCP Discover - Transaction ID 0x4954c014 Frame 1: 349 bytes on wire (2792 bits), 349 bytes captured (2792 bits) on interface \Device\NPF_{55FDD48B-D4C7-4C49-9A40-88F5C0C4155B}, id 0 Ethernet II, Src: 50:27:a9:2d:ff:ff (50:27:a9:2d:ff:ff), Dst: Broadcast (ff:ff:ff:ff:ff:ff) Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255 User Datagram Protocol, Src Port: 68, Dst Port: 67 Dynamic Host Configuration Protocol (Discover) Message type: Boot Request (1) Hardware type: Ethernet (0x01) Hardware address length: 6 Hops: 0 Transaction ID: 0x4954c014 Seconds elapsed: 3 Bootp flags: 0x0000 (Unicast) Client IP address: 0.0.0.0 Your (client) IP address: 0.0.0.0 Next server IP address: 0.0.0.0 Relay agent IP address: 0.0.0.0 Client MAC address: 50:27:a9:2d:ff:ff (50:27:a9:2d:ff:ff) Client hardware address padding: 00000000000000000000 Server host name not given Boot file name not given Magic cookie: DHCP Option: (53) DHCP Message Type (Discover) Length: 1 DHCP: Discover (1) Option: (57) Maximum DHCP Message Size Length: 2 Maximum DHCP Message Size: 1200 Option: (61) Client identifier Length: 5 Type: 0 Client Identifier: eero Option: (12) Host Name Length: 4 Host Name: eero Option: (55) Parameter Request List Length: 8 Parameter Request List Item: (1) Subnet Mask Parameter Request List Item: (6) Domain Name Server Parameter Request List Item: (15) Domain Name Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server Parameter Request List Item: (3) Router Parameter Request List Item: (33) Static Route Parameter Request List Item: (150) TFTP Server Address Parameter Request List Item: (43) Vendor-Specific Information Option: (60) Vendor class identifier Length: 5 Vendor class identifier: ascii Option: (124) V-I Vendor Class Length: 21 Enterprise: ciscoSystems (9) CableLab Address Mode: 16 NetInfo Parent Server Tag: \017C1111-8PLTEEAWB Option: (50) Requested IP Address (47.***.***.***) Length: 4 Requested IP Address: 47.***.***.***) Option: (255) End Option End: 255

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Mon, 11 Dec 2023 04:03:12 GMT

NO ip dhcp client request option-name

first check option name with it number' then use above to make your router not ask ISP server for it value.

Note:- I 50% suspect it not issue of option but let eliminate it from out troubleshooting.

Thanks

MHM

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Mon, 11 Dec 2023 14:05:10 GMT

MHM

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Mon, 11 Dec 2023 13:54:18 GMT

Unfortunately, that is not an option for 60,61,124:

C1111(config)#int gi0/0/0 C1111(config-if)#no ip dhcp client request 60 ^ % Invalid input detected at '^' marker. C1111(config-if)#no ip dhcp client request ? classless-static-route Classless static route (121) dns-nameserver DNS nameserver (6) domain-name Domain name (15) netbios-nameserver NETBIOS nameserver (44) option DHCP options router Default router option (3) sip-server-address SIP server address (120) static-route Static route option (33) tftp-server-address TFTP server address (150) vendor-identifying-specific Vendor identifying specific info (125) vendor-specific Vendor specific option (43) <cr> <cr> C1111(config-if)#no ip dhcp client request

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Mon, 11 Dec 2023 13:57:36 GMT

I think you are responding to the wrong Forum post... this post is about ISR1100 and IOS-XR DHCP, not N3K and NX-OS.

-mike

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Mon, 11 Dec 2023 14:06:56 GMT

sorry what op. your router client you dont request from server ?

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Wed, 13 Dec 2023 13:36:06 GMT

If you look at the packet capture from the eero router that is successful and the packet capture from the ISR1111 that is unsuccessful, the major differences seem to be options 60,61, and 124. There are also differences in option 55(parameters requested), but most of those are not allowed by the IOS-XE 17.9.4a command set.

With how the IOS-XE DHCP client sends the DHCP Discover message currently (or with default config, or any config I have tried) I get no response from the ISP DHCP Server.

My goal is to have the enterprise grade Cisco IOS-XE mimic the eero in what is commonly referred to as mac-cloning, but the ISP seems to be extra finicky..

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Mon, 11 Dec 2023 17:02:45 GMT

no ip dhcp client option 60

did you try use above command to remove the op60/61/124 ?
MHM

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Mon, 11 Dec 2023 17:57:48 GMT

PLEASE actually read the contents of my replies. I literally posted the output of the router not recognizing the command, and what the IOS says are valid options for the command. Here it is again, and yes, the result is the same with 61 and 124:

C1111#conf t Enter configuration commands, one per line. End with CNTL/Z. C1111(config)#int gi0/0/0 C1111(config-if)#no ip dhcp client request 60 ^ % Invalid input detected at '^' marker. C1111(config-if)#no ip dhcp client request ? classless-static-route Classless static route (121) dns-nameserver DNS nameserver (6) domain-name Domain name (15) netbios-nameserver NETBIOS nameserver (44) option DHCP options router Default router option (3) sip-server-address SIP server address (120) static-route Static route option (33) tftp-server-address TFTP server address (150) vendor-identifying-specific Vendor identifying specific info (125) vendor-specific Vendor specific option (43) <cr> <cr> C1111(config-if)#

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Tue, 12 Dec 2023 04:03:49 GMT

sorry I was out, now I back to home
the command you add missing "option" keyword
example below show what Ops the client will request from Server
so the correct command will be
ip dhcp client request option <then we list option of success router>
the option that we not include will not send.

MHM

IP Addressing: DHCP Configuration Guide, Cisco IOS XE Gibraltar 16.10.x - Configuring the Cisco IOS XE DHCP Client [Cisco IOS XE 16] - Cisco

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Tue, 12 Dec 2023 13:13:50 GMT

Unfortunately 'adding' the word 'option' is not a valid command for option 60 or 61:

Replacing the word request with the word option is not the same feature, that is a different feature of DHCP Client.

A command like "ip dhcp client request option 4 5 7 8 9 10 11 17 18 40 41 42 66 68 69 70 71 72 73 74 75 76 124 138 141 142 160" is sending a request via option 55 to request more information be sent back FROM the DHCP Server, I am looking to configure the IOS-XE DHCP Client to send less information TO the DHCP Server.

That being said, I did enter the following DHCP commands to the configuration (they make no visible change to the interface config). You will see that the Cisco IOS-XE 17.9.4a DHCP Client is STILL sending option 60.61, and 124.

C1111-8PWB#conf t Enter configuration commands, one per line. End with CNTL/Z. C1111-8PWB(config)#interface GigabitEthernet0/0/0 C1111-8PWB(config-if)#no ip dhcp client option 60 C1111-8PWB(config-if)#no ip dhcp client option 61 C1111-8PWB(config-if)#no ip dhcp client option 124 % Try using 'ip dhcp client request option' command C1111-8PWB(config-if)#no ip dhcp client request option 124 C1111-8PWB(config-if)#

No. Time Source Destination Protocol Length Info 924 12:53:47.796709 0.0.0.0 255.255.255.255 DHCP 347 DHCP Discover - Transaction ID 0xeb0be620 Frame 924: 347 bytes on wire (2776 bits), 347 bytes captured (2776 bits) on interface \Device\NPF_{55FDD48B-D4C7-4C49-9A40-88F5C0C4155B}, id 0 Ethernet II, Src: 50:27:a9:2d:ff:ff (50:27:a9:2d:ff:ff), Dst: Broadcast (ff:ff:ff:ff:ff:ff) Internet Protocol Version 4, Src: 0.0.0.0, Dst: 255.255.255.255 User Datagram Protocol, Src Port: 68, Dst Port: 67 Dynamic Host Configuration Protocol (Discover) Message type: Boot Request (1) Hardware type: Ethernet (0x01) Hardware address length: 6 Hops: 0 Transaction ID: 0xeb0be620 Seconds elapsed: 3 Bootp flags: 0x0000 (Unicast) Client IP address: 0.0.0.0 Your (client) IP address: 0.0.0.0 Next server IP address: 0.0.0.0 Relay agent IP address: 0.0.0.0 Client MAC address: 50:27:a9:2d:ff:ff (50:27:a9:2d:ff:ff) Client hardware address padding: 00000000000000000000 Server host name not given Boot file name not given Magic cookie: DHCP Option: (53) DHCP Message Type (Discover) Length: 1 DHCP: Discover (1) Option: (57) Maximum DHCP Message Size Length: 2 Maximum DHCP Message Size: 1200 Option: (61) Client identifier Length: 5 Type: 0 Client Identifier: eero Option: (12) Host Name Length: 4 Host Name: eero Option: (55) Parameter Request List Length: 8 Parameter Request List Item: (1) Subnet Mask Parameter Request List Item: (6) Domain Name Server Parameter Request List Item: (15) Domain Name Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server Parameter Request List Item: (3) Router Parameter Request List Item: (33) Static Route Parameter Request List Item: (150) TFTP Server Address Parameter Request List Item: (43) Vendor-Specific Information Option: (60) Vendor class identifier Length: 8 Vendor class identifier: ciscopnp Option: (124) V-I Vendor Class Length: 16 Enterprise: ciscoSystems (9) CableLab Address Mode: 11 NetInfo Parent Server Tag: \nC1111-8PWB Option: (50) Requested IP Address (47.xxx.xxx.xxx) Length: 4 Requested IP Address: 47.xxx.xxx.xxx Option: (255) End Option End: 255

Additionally, you link the 16.10.x Cisco page for IOS-XE DHCP Client when I linked the similarly, but more appropriate 17.x page for the same thing in the opening post. There are several changes introduced in Cisco IOS XE Amsterdam Release 17.2.

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Tue, 12 Dec 2023 13:34:20 GMT

I have added a screen capture and marked it up for clarity of what I am asking for.

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Tue, 12 Dec 2023 18:42:49 GMT

Last hope then

Ip dhcp client vendor-class disable

MHM

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Tue, 12 Dec 2023 18:57:49 GMT

So you also missed that from the original post too?

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

paul driver — Wed, 13 Dec 2023 06:13:36 GMT

Hello

@mcotherman wrote:
My goal is to have the enterprise grade Cisco IOS-XR mimic the eero in what is commonly referred to as mac-cloning, but the ISP seems to be extra finicky.

Packet capture of the latest iteration of the IOS-XE DHCP Client configuration (no response from ISP's DHCP server)

So to confirm ,your client is and IOS-XE and the dhcp server is IOS-XR.
TBH - mac cloning shouldn't be that hard to accomplish unless spoofing is being negated by the dhcp server?

Secure ARP

In standalone DHCP sessions, the DHCP server adds an ARP entry when it assigns an IP address to a client. However, in IP subscriber sessions, DHCP server does not add an ARP entry. Although ARP establishes correspondences between network addresses, an untrusted device can spoof IP an address not assigned to it posing a security threat for IP subscriber sessions. You can enable the secure ARP feature and allow DHCP to add an ARP cache entry when DHCP assigns an IP address to a client. Secure ARP is disabled by default.

Anyhow looking at your post, could you try (no other options):

interface GigabitEthernet0/0/0
shut
mac-address 5027.a92d.ffff
ip dhcp client client-id GigabitEthernet0/0/0
ip address dhcp
no shut

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Wed, 13 Dec 2023 13:34:11 GMT

Sorry Paul, the R in the statement is a typo... It should say IOS-XE I have no idea what the the ISP DHCP Server is.

Using the 'client-id' command was my very first attempt. After sniffing that exchange, I saw that the 'ip dhcp client client-id GigabitEthernet0/0/0' statement. just changed the option 61 section of the DHCP Discover packet from "cisco-50:27:a9:2d:ff:ff-Gi0/0/0" to "50:27:a9:2d:ff:ff".

The problem is most likely on the server side, and I have no control. If I use the most basic config with a default interface config and 'ip address dhcp', I get an address (and that is not automatic, If I power-cycle the ONT, I still have to then get on their chat bot and ask for tech support, like magic, they must bounce the interface, because their DHCP server then issues an address)

I am not able to complete the goal of getting the same address, so I will have to give up on 'swapability' between devices when the ISP says 'you are not using our router'.

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

MHM Cisco World — Wed, 13 Dec 2023 13:38:41 GMT

Hi again

This time I check your post and other comments before I make suggestions.

Now any command is not effect' option or vendor-class

So I think the order of command is effect here' I read in cisco guide one day that you need to enter

Ip dhcp client

Ip address dhcp

In specific order otherwise it will enter but not effective'

So try add

Ip dhcp client only

If not working

The ip dhcp add

The ip dhcp client

Good luck and sorry for my previous reply.

MHM

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

paul driver — Wed, 13 Dec 2023 21:25:52 GMT

Hello Mike
Nw -- Just for you information mate, I have since labbed this up and using the client-id <interface> on IOS-XE for both server/client and it does indeed work accordingly,

However with a client IOS-XE and server IOS-XR secure arp this does result in negating the cloning even with a host client utilizing the client-id <interface> feature.

Re: Cisco IOS XE DHCP Client - disable options from being sent in disc

mcotherman — Wed, 13 Dec 2023 22:11:40 GMT

Paul - Yes, the order matters if the interface happens to get an address before you add in the extra commands. If that happened, it would wait until the DHCP lease renews with the next request to implement the features. In my case, that is not an issue, as the commands are fully entered before I start the sniffer and insert the router into the environment. But I did add the 'ip address dhcp' at the end when I had multiple commands configured.

The 'vendor-class disable' is not accepted in 17.9.4a, even though the docs specifically mention it, so I may try 17.12.x, but that is only one of the three sections of the Discover packet that I believe are giving the problems, and the more I see, the more I believe is is just a service provider configuration issue that may or may not be by design.