Border drops DHCP Discovery packets

[Aleksandr Serov]

Border router (3850 Fuji 16.9.3) drops DHCP coming from Edge. We built the lab for testing LISP campus infrastructure without DNA Center. All is working fine except DHCP. The scheme as in the documentation

<dhcp server>-<DC>-<fusion>-<border>-<edge>-<eid space>

We may even ping the dhcp server from the eid space, but DHCP do not work.

By "monitor capture" we diagnose that the DHCPDiscover packets are coming to border but it do not forward them to fusion nor in GRT nor in vrf of eid space.

How to troubleshoot the reason why the border drops dhcp?

[Mike.Cifelli]

We may even ping the dhcp server from the eid space, but dhcp do not work.

I assume this means you can reach your dhcp server from an end user in one of your VNs. If your anycast gw svi and your routing is properly configured you should be able to pull a dynamic address. I would check to ensure that you have a helper-address configured on your edge node svi (anycast gw). Then ensure you are redistributing a route into bgp for whatever VN you are running the test from your fusion so that your ebn has a route pointing up for that routing instance.

Are you able to share your edge node and ebn configuration?

[Aleksandr Serov]

Hello,

I've attached configurations and routing from border. 

I checked the routing, redistribution, leaking and the helper-address on anycast gw svi. It seems all looks good

Thank you in advance for any help

[Scott Hodgdon]

Aleksandr,

Cisco no longer supports what was once called "Campus Fabric", that is LISP-based fabric built without DNA Center. 

You can try this in the lab, but if it goes into production it will not be TAC supported.

Cheers,

Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking Group

[Aleksandr Serov]

Scott,

Thank you for information. I didn't know that it is unsupported variant. It is very sad(.

What technology would you suggest?

We are in process of choosing a new campus architecture. We have to upgrade the network equipment in one our our campus in nearest future. We are going to use C9300 (if it will be Cisco)

We've already tested DNA-center and found it very "green" and buggy. I not ready to use it in production in nearest year or two. It is why we are testing similar technology but without "SD" component.

We have to understanding how to manage and troubleshoot the infrastructure by the CLI, only in that case I may allow to use the technology in production.

We've also tested vxlan/bgp/evpn, but C3850 do not support it. We have a dozen of C3850 and they have to migrate in new infrastucture during upgrade.

Is there any plan to implement vxlan/bgp/evpn on C3850?

Thank you

[Scott Hodgdon]

Alexandr,

The only supported option utilizing 9300 and 3850 for a fabric architecture in the campus is SD-Access using DNA Center.

What version did you last use ? It has matured quite a bit recently, and we have production deployments across all verticals including healthcare and finance.

My recommendation for customers wanting to deploy a fabric-ready solution in a traditional network is to at least convert to Routed Access to enable a smoother transition to fabric in the future.

There is no plan to support vxlan/bgp/evpn on 3850.

Cheers,
Scott Hodgdon

Senior Technical Marketing Engineer

Enterprise Networking Group

[Aleksandr Serov]

Scott,

Thank you for information. We will try to adapt to the DNA center.

But I not understand the reason why cisco deny to support cases where lisp is configured manually?  It is natural for many networkers to rely on cli configuration instead of on some centralized software network manager, especially when it do almost the same thru the cli but in background.

During our tests we used DNA center version 1.2.8

[Aleksandr Serov · Accepted solution]

I found the solution in CSCvj49480

I turned off the DHCP snooping on border and now DHCP is working

And one more important think. The border should have an interface with Anycast GW IP address in UP state. Otherwise DHCP Offers will be dropped also.