topic Hi Matt in Network Access Control

How to Configure IP DHCP Snooping and Trusted Ports on a Cisco ISE NAD Configuration

Matthew Martin — Mon, 11 Mar 2019 07:30:50 GMT

Hello All,

So we have recently configured our main/core switch (*4510R+E) to begin authenticating devices using Cisco ISE, which is now configured and seems to be working as expected. Now, I'm trying to configure a 3560 switch that we have located in our IT work area. The 3560 is connected directly to the 4510 via a trunk port.

I have gotten the 3560 completely configured to authenticate endpoints through our ISE server, which it does. The problem I'm running into is when I enable DHCP Snooping on the 3560 (*snooping is NOT configured on the 4510 as of yet) no connected endpoints can get a DHCP address. If I disable dhcp snooping then DHCP begins working again.

The guide I used for configuring the Network Access Devices (*i.e. Routers and Switches) was the Cisco Identity Services Engine Administrator Guide, Release 2.0. Chapter 33 of this guide is where you'll find the commands required to enable ISE on the switches. Now, in this chapter they say you can optionally enable dhcp snooping. But, the only commands they give you are:

ip dhcp snooping             !--> enables dhcp snooping
ip dhcp snooping vlan x-y    !--> Enable Snooping on specific Vlans Only

Now, enabling just these 2 commands prevents devices on the 3560 from getting a DHCP address, because if I remove those commands they can immediately get a DHCP address without issue. So searching around a bit online I found the Cisco TrustSec HowTo: Global Switch Configuration Guide . In this guide they also describe how to enable dhcp snooping, except they include another command, which is "ip dhcp snooping trust" and according to this guide it states the following:

"Before configuring DHCP snooping, be sure to note the location of your trusted DHCP servers. When you configure DHCP snooping, the switch will deny DHCP server replies from any port not configured as “trusted.” Enter interface configuration mode for the uplink interface and configure it as a trusted port."

Since the DHCP server for the Vlan/Subnet being "snooped" is located on a Linux box connected to the 4510 Core Switch, wouldn't the Uplink interface be the Trunk port on the 3560 connecting it to the 4510..?

If I add the "ip dhcp snooping trust" command to the Trunk port on the 3560, no devices connected to this switch can get a DHCP Address. However, if I add the trust command to the Switchports where the PC/devices are connected to on the 3560, they can then get a DHCP address no problem.

So my question is why isn't this working with the trust command configured on the Trunk port only, and why does it only work if the trust command is added to each individual switchport where a PC/Device/Phone is connected. According to the guide, it doesn't sound like this is how it's supposed to work. See screenshot below:

If anyone has any thoughts or suggestions please feel free to reply.

Thanks in Advance,
Matt

Hi

andrewswanson — Fri, 03 Mar 2017 19:57:27 GMT

Add the following command to your 3560:

no ip dhcp snooping information option

See the following post for details:

http://blog.ine.com/2009/07/22/understanding-dhcp-option-82/

hth
Andy

Hey Andy, thanks for the

Matthew Martin — Fri, 03 Mar 2017 23:03:10 GMT

Hey Andy, thanks for the reply!

Perfect, that seemed to fix it, Thank you!

From your link, it sounds like when DHCP Snooping is enabled on a Cisco Catalyst device it automatically inserts a giaddr of 0.0.0.0, and by default Cisco IOS devices reject packets that have a ZERO address for giaddr...

So, does that mean whenever you enable DHCP Snooping on a Catalyst Router/Switch, you should also disable the adding of option 82 to the DHCP packets sent to the DHCP Server?

Does that sound correct?

EDIT: Also, am I supposed to keep the "ip dhcp snooping trust" command on the uplink trunk port that goes to the 4510..? This is the interface/port that connects the 3560 to the 4510 (*the 4510 is where the DHCP server is connected).

Thanks again for your reply, very much appreciated!

Thanks,
Matt

Hi Matt

andrewswanson — Sat, 04 Mar 2017 09:41:15 GMT

Hi Matt

Yes, disable the dhcp information option if you are not using it. When dhcp snooping is enabled, the default trust setting for interfaces is untrusted so you should apply ip dhcp snooping trust on interfaces leading to where your dhcp server is located. Following link explains it better:

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html#wp1114389

hth

Andy