Hello everyone,
NOTE: I have already looked at various suggestions in the forum but nothing helped me
I’m facing an issue where the FastEthernet0/1 interface on my router (R4) is not able to obtain an IP address via DHCP. Here’s the setup:
Topology:
I have two routers connected via a GRE/IPsec tunnel.
R3 acts as the DHCP server.
R4 acts as the DHCP relay and has ip helper-address configured on FastEthernet0/1.
R4 Configuration Highlights:
FastEthernet0/1 is configured with ip address dhcp and ip helper-address pointing to the R3 Tunnel0 interface.
Tunnel0 on both routers is configured with static IPs: 10.10.10.1/30 (R3) and 10.10.10.2/30 (R4).
The DHCP server on R3 has a pool for the network 192.168.100.0/24, which is the intended network for FastEthernet0/1 on R4.
Observations:
The GRE tunnel is operational. I can ping between the tunnel interfaces (10.10.10.1 <-> 10.10.10.2) and other connected interfaces.
When I enable DHCP debug (debug dhcp detail) on R4, I see the router sending DHCP Discover packets, but it never receives a DHCP Offer.
On R3, with DHCP server debug enabled (debug ip dhcp server packets), I don’t see any packets arriving from R4.
What I’ve tried so far:
Verified that the ACLs allow UDP traffic on ports 67 and 68.
Ensured routing is configured correctly between the networks.
Tested connectivity across the tunnel with static IPs (it works).
Confirmed the DHCP pool configuration on R3.
Checked that service dhcp is enabled on R3.
Questions:
Is there any additional configuration required on R3 or R4 to make DHCP relay work over a GRE/IPsec tunnel?
Could IPsec be interfering with the forwarding of DHCP packets (e.g., ESP encapsulation)?
What additional steps can I take to troubleshoot or resolve this issue?
Any advice or guidance would be greatly appreciated. Below are relevant configuration snippet
R3#show running-config
ip dhcp excluded-address 192.168.100.1
ip dhcp pool DHCP_TEST
network 192.168.100.0 255.255.255.0
dns-server 8.8.8.8
default-router 192.168.100.1
lease 7
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key redhat address 192.168.1.2
!
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
mode transport
!
crypto ipsec profile naranomenuovo
set transform-set TSET
!
!
crypto map CMAP 10 ipsec-isakmp
set peer 192.168.1.2
set transform-set TSET
match address 101
!
interface Tunnel0
ip address 10.10.10.1 255.255.255.252
tunnel source Serial0/0
tunnel destination 192.168.1.2
tunnel protection ipsec profile naranomenuovo
!
interface Serial0/0
ip address 192.168.1.1 255.255.255.0
clock rate 2000000
!
ip forward-protocol nd
ip route 0.0.0.0 0.0.0.0 Tunnel0
ip route 0.0.0.0 0.0.0.0 192.168.1.2
ip route 10.10.10.0 255.255.255.252 Tunnel0
ip route 192.168.100.0 255.255.255.0 10.10.10.2
access-list 101 permit gre any any
access-list 101 permit icmp any any
access-list 101 permit udp any any eq bootps
access-list 101 permit udp any any eq bootpc
access-list 101 permit udp any any
and R4
R4#show running-config
Building configuration...
crypto isakmp policy 10
encr aes 256
authentication pre-share
group 2
crypto isakmp key redhat address 192.168.1.1
!
!
crypto ipsec transform-set TSET esp-aes esp-sha-hmac
mode transport
!
crypto ipsec profile naranomenuovo
set transform-set TSET
!
!
crypto map CMAP 10 ipsec-isakmp
set peer 192.168.1.1
set transform-set TSET
match address 101
!
!
!
!
interface Tunnel0
ip address 10.10.10.2 255.255.255.252
tunnel source Serial0/0
tunnel destination 192.168.1.1
tunnel protection ipsec profile naranomenuovo
!
interface FastEthernet0/0
ip address 200.10.10.2 255.255.255.0
duplex auto
speed auto
crypto map CMAP
!
interface Serial0/0
ip address 192.168.1.2 255.255.255.0
ip helper-address 10.10.10.1
clock rate 2000000
!
interface FastEthernet0/1
ip address dhcp
ip helper-address 10.10.10.1
ip route 0.0.0.0 0.0.0.0 Tunnel0
ip route 0.0.0.0 0.0.0.0 192.168.1.1
ip route 10.10.10.0 255.255.255.252 Tunnel0
ip route 192.168.1.0 255.255.255.0 10.10.10.1
ip route 192.168.10.0 255.255.255.0 Tunnel0
access-list 101 permit gre any any
access-list 101 permit icmp any any
access-list 101 permit udp any any eq bootpc
access-list 101 permit udp any any eq bootps
access-list 101 permit udp any any
@MHM Cisco World @Flavio Miranda
I set up another lab with the following configurations:
R1: DHCP server router
R2: Helper router
R5 & Linux OS: Clients
I tried to make some changes. Specifically, I assigned an IP address to the fa0/1 interface of R2 that belongs to the DHCP server’s subnet. Additionally, I configured the DHCP helper (10.10.10.1) only on the fa0/1 interface of R2. On the same interface (fa0/1 of R2), I connected another router or a Linux machine.
Here’s what happened:
The router, in this scenario, receives requests from R5 (the client), and after a few seconds, R1 assigns an IP to this machine. However, the client continues to send DHCP requests. Upon verification, I noticed that the client had not actually received any IP address, and as a result, the process enters a loop.
On router R1, I can see that the IP has been assigned to the client. The same thing happens with the Linux machine (another client). This is the result of the show ip dhcp binding command executed on R1:
Nevertheless, the requests keep arriving at the DHCP server even after the IP has been offered to the client.
[[Note: Before setting up the scenario explained here, the fa0/1 interface of R2 had an IP address different from the subnet of the DHCP server. This caused an error in the debug on R1, indicating that the fa0/1 interface of R2 needed to be in the same subnet as the DHCP server.]]
I’m showing you some images from R1, where it’s evident that the requests continue to arrive even though an IP has already been offered to the client.
- R1 DHCP debug.
- R2: Where I configured the helper, here is the output of the detailed DHCP debug.
- Debug of R5 (the client).
- Here is the Wireshark capture between R2 and R5.
here is the udp debug on R1 and R2
R1#
*Mar 1 01:48:15.743: UDP: rcvd src=192.168.100.11(67), dst=10.10.10.1(67), length=299
*Mar 1 01:48:15.747: UDP: sent src=192.168.100.1(67), dst=192.168.100.11(67), length=308
R1#
*Mar 1 01:48:18.863: UDP: rcvd src=192.168.100.11(67), dst=10.10.10.1(67), length=299
*Mar 1 01:48:18.867: UDP: sent src=192.168.100.1(67), dst=192.168.100.11(67), length=308
R1#
*Mar 1 01:48:22.307: UDP: rcvd src=192.168.100.11(67), dst=10.10.10.1(67), length=299
*Mar 1 01:48:22.311: UDP: sent src=192.168.100.1(67), dst=192.168.100.11(67), length=308
R2#
*Mar 1 01:50:45.735: UDP: rcvd src=0.0.0.0(68), dst=255.255.255.255(67), length=299
*Mar 1 01:50:45.739: UDP: sent src=192.168.100.11(67), dst=10.10.10.1(67), length=299
R2(config)#
*Mar 1 01:51:58.167: UDP: rcvd src=0.0.0.0(68), dst=255.255.255.255(67), length=299
*Mar 1 01:51:58.171: UDP: sent src=192.168.100.11(67), dst=10.10.10.1(67), length=299
R2(config)#
*Mar 1 01:52:01.191: UDP: rcvd src=0.0.0.0(68), dst=255.255.255.255(67), length=299
*Mar 1 01:52:01.195: UDP: sent src=192.168.100.11(67), dst=10.10.10.1(67), length=299
