topic Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch in Wireless

WLC DHCP Proxy mode and DHCP Snooping on upstream switch

Kanan Huseynli — Mon, 25 Sep 2023 12:20:47 GMT

Hello,

is there an issue when we have WLC DHCP proxy mode and upstream switch with DHCP snooping enabled?

Based on docs, WLC in proxy mode changes giaddr field (and can insert option-82 as well) and switch ignores DHCP messages over untrusted ports if it has non-zero giaddr field or option-82 (like relay info inserted).

Then, it should be problematic for DHCP snooping enabled environment, right? We need to make trust WLC connected ports (which disables snooping checks for those ports, in reality) or configure L2 ports as ip dhcp relay trusted. Did anyone had

Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch

Ambuj M — Mon, 25 Sep 2023 12:54:36 GMT

snooping dictates where offer comes from not where discover comes from, so dont think this should be an issue

Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch

Kanan Huseynli — Mon, 25 Sep 2023 13:50:42 GMT

No, snooping has some checks for client messages as well.

For example, when you have access and distro switch with both snooping enabled where access inserts option82, then distro switch ignores client messages. We normally either remove option82 on access OR allow it on untrusted port on distro switch.

I assume then same happens in WLC, but can not get confirmation since I dont have WLC Lab

Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch

Ambuj M — Mon, 25 Sep 2023 14:18:46 GMT

you are right you have to have ip dhcp snooping information option allow-untrusted.

by default its disabled.

Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch

Rich R — Sun, 01 Oct 2023 22:58:15 GMT

DHCP proxy only applies to the old AireOS based WLCs which are almost end of life. If you are designing for future then you should be looking at the 9800 series WLCs.

If you use 9800 series WLC as per the Best Practice guide (link below) then you should not configure SVI on the 9800 at all and leave the snooping/forwarding/relaying to the attached infrastructure. If you do configure SVI with helper address/dhcp relay then it will be doing standards based DHCP relay not DHCP proxy.

Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch

Kanan Huseynli — Mon, 02 Oct 2023 18:42:36 GMT

Thank you, but since it is DHCP relay then giaddr will be modified and infrastructure dhcp snooping enabled switch will ignore these messages over untrusted.

Seems, if it is not bridge mode then ip dhcp snooping trust is needed

Re: WLC DHCP Proxy mode and DHCP Snooping on upstream switch

MHM Cisco World — Mon, 02 Oct 2023 19:01:14 GMT

Ip dhcp snooping trust toward wlc is not needed since the wlc is represent client here.

The modify of dhcp and add op82 is need I think.

Now

Wlc add op82 send to SW (with dhcp snooping) what you need is

Ip dhcp snooping information option allow-untrusted

Why untrust ? Since the port is untrust and wlc add op82 then this need.