DHCP server from CORP VRF can server dhcp clients on PUBLIC VRF ?

[bipinchandra]

Hi Guys,

I am trying to set up a lab a dhcp pool in a DHCP server where my dhcp server is located in CORP VRF and clients are in PUBLIC VRF. And there is no route leaking between the VRFs. Will it work ?? From Theory with Option 82 enabled it works but in my lab it does not work. I could see the dhcp server provides dhcp offer to the client but client never gets the IP.

Will be very appreciated if someone could help

[balaji.bandi]

 PUBLIC VRF  - you mean global VRF or VRF name it self PUBLIC

And there is no route leaking between the VRFs  - if there is no leaking there do not know the routing aware of each other, so they become disjoin entity. so that does not work.

Option 82 enabled  - only take place when the router able to reach remote end IP, if that is not known how that options works ?

[bipinchandra]

It seems working in Juniper network. What is the difference we have with Cisco and Juniper.. ?? I can share Juniper caps if anyone is interested in investigating it ....!!!

[MHM Cisco World]

without VRF leaking it not work 
but if client in VRF and DHCP in global it work we use it in MPLS 

hostname R2-PE2
!
interface Loopback0
ip address 2.2.2.2 255.255.255.255
!
interface FastEthernet0/0
ip vrf forwarding BLUE
ip address 11.0.0.1 255.255.255.0
ip helper-address global 200.0.0.5
duplex full
!
interface Serial3/3
ip address 200.0.0.2 255.255.255.0
mpls ip
serial restart-delay 0
!
router ospf 100
network 2.2.2.2 0.0.0.0 area 0
network 200.0.0.0 0.0.0.255 area 0


hostname R5-P-DHCP
!
ip dhcp pool VRF-RED
vrf RED
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
!
ip dhcp pool BLUE
vrf BLUE
network 11.0.0.0 255.255.255.0
default-router 11.0.0.1
!
interface Serial3/0
ip address 100.0.0.5 255.255.255.0
mpls ip
serial restart-delay 0
!
interface Serial3/3
ip address 200.0.0.5 255.255.255.0
mpls ip
serial restart-delay 0
!
router ospf 100
network 100.0.0.0 0.0.0.255 area 0
network 200.0.0.0 0.0.0.255 area 0

[bipinchandra]

Thank You for your response. But what makes MPLS works and not between normal vrfs?. Let me test your solution and update you.

My question is still why MPLS makes it work?. Will vxlan set up work then??

[MHM Cisco World]

Why MPLS? The dhcp with id vpn is not use only for mpls' but using in mpls is so common because mpls use PE with vrf and mpls core is global' so we use dhcp with id vpn to assing IP from pool in global rib.

MHM

[bipinchandra]

In my set up. it seems working. I have clients in Red VRF and BLUE VRF gets IP from the DHCP server from global .

Why is it working here ??

Below is the config of switch where DHCP pool is configured.

DHCP#sh run
Building configuration...

Current configuration : 2039 bytes
!
! Last configuration change at 17:26:01 UTC Tue Dec 19 2023
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname DHCP
!
boot-start-marker
boot-end-marker
!
!
logging discriminator EXCESS severity drops 6 msg-body drops EXCESSCOLL
logging buffered 50000
logging console discriminator EXCESS
!
no aaa new-model
!
!
!
!
!
no ip icmp rate-limit unreachable
!
ip vrf BLUE
rd 200:1
!
ip vrf RED
rd 100:1
!
!
ip dhcp pool VRF-RED
vrf RED
network 10.0.0.0 255.255.255.0
default-router 10.0.0.1
!
ip dhcp pool BLUE
vrf BLUE
network 11.0.0.0 255.255.255.0
default-router 11.0.0.1
!
!
no ip domain-lookup
ip cef
no ipv6 cef
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
ip address 20.20.20.20 255.255.255.255
!
interface Ethernet0/0
switchport access vlan 100
switchport mode access
!
interface Ethernet0/1
switchport access vlan 200
switchport mode access
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet1/0
!
interface Ethernet1/1
!
interface Ethernet1/2
!
interface Ethernet1/3
!
interface Ethernet2/0
!
interface Ethernet2/1
!
interface Ethernet2/2
!
interface Ethernet2/3
!
interface Ethernet3/0
!
interface Ethernet3/1
!
interface Ethernet3/2
!
interface Ethernet3/3
!
interface Vlan1
no ip address
!
interface Vlan100
ip vrf forwarding RED
ip address 10.0.0.1 255.255.255.0
ip helper-address global 20.20.20.20
!
interface Vlan200
ip vrf forwarding BLUE
ip address 11.0.0.1 255.255.255.0
ip helper-address global 20.20.20.20
!
ip forward-protocol nd
!
ip tcp synwait-time 5
ip http server
!
ip ssh server algorithm encryption aes128-ctr aes192-ctr aes256-ctr
ip ssh client algorithm encryption aes128-ctr aes192-ctr aes256-ctr
!
!
!
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
privilege level 15
logging synchronous
line aux 0
exec-timeout 0 0
privilege level 15
logging synchronous
line vty 0 4
login
!
!
!
end

DHCP#

[MHM Cisco World]

The ip helper dhcp is vrf aware 

So you can use 

Ip helper-address global 

Or 

Ip helper-address vrf x

So try same your lab and make dhcp pool in router reach via other vrf abd use (vrf x)

Ip helper-address vrf x 

And check.

MHM

[bipinchandra · Accepted solution]

I have got the solution. It is working fine without VRF leaking. key points are we need to use " ip DHCP relay information option vpn" on Core switch. DHCP server must be aware of VRF's.

Below is the Configuration of Core, WAN and DHCP server for the GNS3 lab snapshot I have attached.

CORE#sh run
Building configuration...


hostname CORE
!
boot-start-marker
boot-end-marker
!
!

ip vrf CORP_VRF
rd 100:1
!
ip vrf GUEST_VRF
rd 300:1
!
ip vrf IOT_VRF
rd 200:1
!
ip dhcp relay information option vpn
!
!
no ip domain-lookup
ip cef
no ipv6 cef
!
!

interface Loopback0
ip address 1.1.1.1 255.255.255.255
!
interface Loopback1
ip vrf forwarding CORP_VRF
ip address 2.2.2.2 255.255.255.255
!
interface Loopback2
ip vrf forwarding IOT_VRF
ip address 3.3.3.3 255.255.255.255
!
interface Loopback3
ip vrf forwarding GUEST_VRF
ip address 4.4.4.4 255.255.255.255
!
interface Ethernet0/0
no switchport
ip vrf forwarding IOT_VRF
ip address 11.11.11.2 255.255.255.254
!
interface Ethernet0/1
no switchport
ip vrf forwarding GUEST_VRF
ip address 11.11.11.4 255.255.255.254
!
interface Ethernet0/2
no switchport
ip vrf forwarding CORP_VRF
ip address 11.11.11.0 255.255.255.254
!
interface Ethernet0/3
no switchport
ip address 11.11.11.6 255.255.255.254
!
interface Ethernet1/0
switchport access vlan 100
switchport mode access
!
interface Ethernet1/1
switchport access vlan 200
switchport mode access
!
interface Ethernet1/2
switchport access vlan 300
switchport mode access
!
interface Ethernet1/3
switchport access vlan 400
switchport mode access
!

interface Vlan100
ip vrf forwarding CORP_VRF
ip address 10.10.10.1 255.255.255.0
ip helper-address 100.100.100.100
ip helper-address global 100.100.100.100
!
interface Vlan200
ip vrf forwarding IOT_VRF
ip address 10.10.10.1 255.255.255.0
ip helper-address global 100.100.100.100
!
interface Vlan300
ip vrf forwarding GUEST_VRF
ip address 10.10.10.1 255.255.255.0
ip helper-address global 100.100.100.100
!
interface Vlan400
ip address 10.10.20.1 255.255.255.0
ip helper-address 100.100.100.100
!
router bgp 6500
bgp router-id 1.1.1.1
bgp log-neighbor-changes
redistribute connected
neighbor 11.11.11.7 remote-as 6900
!
address-family ipv4 vrf CORP_VRF
bgp router-id 2.2.2.2
redistribute connected
neighbor 11.11.11.1 remote-as 6900
neighbor 11.11.11.1 activate
exit-address-family
!
address-family ipv4 vrf GUEST_VRF
bgp router-id 4.4.4.4
redistribute connected
neighbor 11.11.11.5 remote-as 6900
neighbor 11.11.11.5 activate
exit-address-family
!
address-family ipv4 vrf IOT_VRF
bgp router-id 3.3.3.3
redistribute connected
neighbor 11.11.11.3 remote-as 6900
neighbor 11.11.11.3 activate
exit-address-family

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;




DHCP#sh run
Building configuration...

Current configuration : 2508 bytes
!
! Last configuration change at 05:42:23 UTC Thu Jan 4 2024
!
version 15.2
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname DHCP
!
!
!
!
!
no ip icmp rate-limit unreachable
!
ip vrf CORP_VRF
rd 100:1
!
ip vrf GUEST_VRF
rd 300:1
!
ip vrf IOT_VRF
rd 200:1
!
ip dhcp excluded-address 10.10.20.1 10.10.20.10
ip dhcp excluded-address vrf CORP_VRF 10.10.10.1 10.10.10.10
ip dhcp excluded-address vrf GUEST_VRF 10.10.10.1 10.10.10.20
ip dhcp excluded-address vrf IOT_VRF 10.10.10.1 10.10.10.30
!
ip dhcp pool CORP
vrf CORP_VRF
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
lease 0 0 5
!
ip dhcp pool IOT
vrf IOT_VRF
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
lease 0 0 5
!
ip dhcp pool GUEST
vrf GUEST_VRF
network 10.10.10.0 255.255.255.0
default-router 10.10.10.1
lease 0 0 5
!
ip dhcp pool GLOBAL
network 10.10.20.0 255.255.255.0
default-router 10.10.20.1
lease 0 0 5
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
ip address 100.100.100.100 255.255.255.255

!
interface Ethernet1/0
no switchport
ip address 11.11.11.9 255.255.255.254
!
interface Ethernet1/1
no switchport
ip address 11.11.11.13 255.255.255.254

!
interface Vlan1
no ip address
shutdown
!
router bgp 6000
bgp router-id 100.100.100.100
bgp log-neighbor-changes
redistribute connected
neighbor 11.11.11.8 remote-as 6900
neighbor 11.11.11.12 remote-as 6900

!
!
end

DHCP#

;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

WAN#sh run
Building configuration...

Current configuration : 3058 bytes

service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
service compress-config
!
hostname WAN
!

!
!
!
!
!
no ip icmp rate-limit unreachable
!
ip vrf CORP_VRF
rd 100:1
!
ip vrf GUEST_VRF
rd 300:1
!
ip vrf IOT_VRF
rd 200:1
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
!
interface Loopback0
ip address 11.11.11.11 255.255.255.255
!
interface Loopback1
ip vrf forwarding CORP_VRF
ip address 22.22.22.22 255.255.255.255
!
interface Loopback2
ip vrf forwarding IOT_VRF
ip address 33.33.33.33 255.255.255.255
!
interface Loopback3
ip vrf forwarding GUEST_VRF
ip address 44.44.44.44 255.255.255.255
!
interface Ethernet0/0
no switchport
ip vrf forwarding IOT_VRF
ip address 11.11.11.3 255.255.255.254
!
interface Ethernet0/1
no switchport
ip vrf forwarding GUEST_VRF
ip address 11.11.11.5 255.255.255.254
!
interface Ethernet0/2
no switchport
ip vrf forwarding CORP_VRF
ip address 11.11.11.1 255.255.255.254
!
interface Ethernet0/3
no switchport
ip address 11.11.11.7 255.255.255.254
!
interface Ethernet1/0
no switchport
ip address 11.11.11.8 255.255.255.254
!
interface Ethernet1/1
no switchport
ip vrf forwarding CORP_VRF
ip address 11.11.11.12 255.255.255.254
shutdown
!
interface Vlan1
no ip address
shutdown
!
router bgp 6900
bgp router-id 11.11.11.11
bgp log-neighbor-changes
redistribute connected
neighbor 11.11.11.6 remote-as 6500
neighbor 11.11.11.9 remote-as 6000
!
address-family ipv4 vrf CORP_VRF
bgp router-id 22.22.22.22
redistribute connected
neighbor 11.11.11.0 remote-as 6500
neighbor 11.11.11.0 activate
neighbor 11.11.11.13 remote-as 6000
neighbor 11.11.11.13 activate
exit-address-family
!
address-family ipv4 vrf GUEST_VRF
bgp router-id 44.44.44.44
redistribute connected
neighbor 11.11.11.4 remote-as 6500
neighbor 11.11.11.4 activate
exit-address-family
!
address-family ipv4 vrf IOT_VRF
bgp router-id 33.33.33.33
redistribute connected
neighbor 11.11.11.2 remote-as 6500
neighbor 11.11.11.2 activate
exit-address-family

!
!
end

WAN#

[MHM Cisco World]

I already use it in my lab I share before, but I think I missing command when copy from gns3 to here 
you need 
ip dhcp relay information option vpn 
sure otherwise how local DHCP know which DHCP local pool it use 
it match the VRF send in relay with what you config under the DHCP pool 
anyway this my mistake I must sure I copy all commands I use in lab 
glad you get the idea in end 
happy new year and have a nice day

MHM