ACi and DHCP - problem with 3 phase

[Marcin Krajewski]

Hello,

I need advice how to solve the problem. I have two cases:
1. DHCP server in same vlan (encapsulation tag vlan-x) as client. I see DISCOVERY broadcast on DHCP server, I see unicast OFFER, and thats all. No more packets, client not recive OFFER.
2. DHCP server in diffrent vlan. I configured DHCP relay, I see unicat DISCOVERY from relay, with Opt82. Server response unicast OFFER to relay, also with Opt82. And packet dont came to client.

Pcap from dhcp server in attachment, filter by DHCP Server it is Infoblox

[Marcin Krajewski]

I found confirmation, that dhcp offer is missing somwhere in fabric. But i'm totaly stuck.

I see that offer packet is seen at leaf where dhcp is connected 18:04:13.714862 IP gmember1.***.int.bootps > 192.168.74.254.bootps: BOOTP/DHCP, Reply, length 300

But I dont see it on second leaf where client is connected 18:04:03.306213 IP 192.168.74.254.bootps > gmember1.***.int.bootps: BOOTP/DHCP, Request from 00:0c:29:67:98:b0 (oui Unknown), length 329 18:04:09.724436 IP 192.168.74.254.bootps > gmember1.***.int.bootps: BOOTP/DHCP, Request from 00:0c:29:67:98:b0 (oui Unknown), length 329 18:04:13.713563 IP 192.168.74.254.bootps > gmember1.***.int.bootps: BOOTP/DHCP, Request from 00:0c:29:67:98:b0 (oui Unknown), length 329 18:04:18.196836 IP 192.168.74.254.bootps > gmember1.***.int.bootps: BOOTP/DHCP, Request from 00:0c:29:67:98:b0 (oui Unknown), length 329

[Marcin Krajewski]

I found confirmation, that dhcp packet is dropped at first leaf by SIFS service???? (994 log). What is this? I didnt find it in docs. I found only bug CSCvz88866 in 4.2. But no more info related to ACI.

982) 2023 Sep 29 14:05:53.160119 _snoop_handle_istack_packet: 1502 : dhcp_snoop_handle_istack_packet:DHCP_SISF_DEBUG:filter_id is 3

983) 2023 Sep 29 14:05:53.160116 _snoop_handle_istack_packet: 1492 : destination ip address 192.168.74.254

984) 2023 Sep 29 14:05:53.160113 _snoop_handle_istack_packet: 1489 : source ip address 192.168.85.21

985) 2023 Sep 29 14:05:53.160107 _snoop_handle_istack_packet: 1486 : ip total length is 328

986) 2023 Sep 29 14:05:53.160104 _snoop_handle_istack_packet: 1484 : ip hdr len 20

987) 2023 Sep 29 14:05:53.160102 _snoop_handle_istack_packet: 1458 : 192 168 74 254 0 67 0 67 1 52 65 51 2

988) 2023 Sep 29 14:05:53.160097 _snoop_handle_istack_packet: 1454 : Pkt first few bytes 69 0 1 72 150 178 64 0 64 17 129 142 192 168 85 21

989) 2023 Sep 29 14:05:53.160092 _snoop_handle_istack_packet: 1450 : L2 hdr len is 14 rcvd msg 342

990) 2023 Sep 29 14:05:53.160089 _snoop_handle_istack_packet: 1448 : Received pkt on Vlan 6  intf Ethernet1/10

991) 2023 Sep 29 14:05:53.160081 _snoop_handle_istack_packet: 1414 : switch mac: 24 6c 84 55 7c 50

992) 2023 Sep 29 14:05:53.160073 _snoop_handle_istack_packet: 1405 : dhcp_snoop_handle_istack_packet:DHCP_SISF_DEBUG: pkt received on DHCP_PKT_SISF_REINJECT_Q_FD

993) 2023 Sep 29 14:05:37.410750 _snoop_handle_istack_packet: 1563 : dhcp_snoop_handle_istack_packet:DHCP_SISF_DEBUG:Dropping the packet

994) 2023 Sep 29 14:05:37.410738 _snoop_handle_istack_packet: 1552 : dhcp_snoop_handle_istack_packet:DHCP_SISF_DEBUG:dropping the packet..SISF security check failed

995) 2023 Sep 29 14:05:37.410734 _snoop_handle_istack_packet: 1517 : dhcp_snoop_handle_istack_packet:DHCP_SISF_DEBUG:return value 4