Can't remove IP helper on VLAN interface previously added to VRF

[Pawel.Lipko]

Hi!

Recently I hit strange behavior on our C9500 switch running Cisco IOS XE Software, Version 17.03.04

We've had issues with DHCP relay in our network.
During TShoot session we decided to remove 3 ip helpers assigned to vlan interface.

After issuing "no ip helper [ip address]" commands, 2 helpers stood in config stubbornly..
We solved this by removing whole vlan interface and adding it back with the same config.
The DHCP relay started to work as expected.

A colleague of mine has explained me that if that vlan interface was working initially in Global VRF with those 2 ip helpers.
If next things done with it were: add this interface to some VRF and add +3 ip helpers, then first 2 are still running in global VRF causing whole DHCP relay we needed not working.
Even if config looked good...

Below are steps to reproduce the problem

• Interface initially configured with ip helpers and no VRF:

interface Vlan10
ip address 172.17.250.127 255.255.255.0
ip helper-address 10.128.52.194
ip helper-address 10.127.210.127
end

• Added 2 new dhcp relays and put interface into VRF

interface Vlan10
vrf forwarding SomeVRF
ip address 172.17.250.127 255.255.255.0
ip helper-address 10.128.52.194
ip helper-address 10.127.210.127
ip helper-address 10.129.130.21
ip helper-address 10.131.123.123
end

• attempt to remove all dhcp relays

no ip helper-address 10.128.52.194
no ip helper-address 10.127.210.127
no ip helper-address 10.129.130.21
no ip helper-address 10.131.123.123

• Old IP helpers are still there

interface Vlan10
vrf forwarding SomeVRF
ip address 172.17.250.127 255.255.255.0
ip helper-address 10.128.52.194
ip helper-address 10.127.210.127
end

This is really confusing, when interface config is the same when you have a problem and after "no interface vlan10" and then copy paste the same config solves the problem...

[M02@rt37]

Hello @Pawel.Lipko,

I had this case too a time ago!

When you initially configured the VLAN interface, it was not associated with any VRF and had two DHCP relay helpers configured. Later, you moved the VLAN interface to a specific VRF and added three more DHCP relay helpers. When you tried to remove all DHCP relay helpers, the two initial helpers that were configured before moving the interface to the VRF were still present in the global VRF and were causing the issue. Removing the VLAN interface and adding it back with the same configuration caused the interface to be associated with the global VRF again, and the two initial DHCP relay helpers were removed as well, allowing the DHCP relay to work as expected.

To avoid this issue in the future, you may want to explicitly remove the VLAN interface from the global VRF before adding it to a specific VRF, and also remove any DHCP relay helpers associated with the interface in the global VRF to ensure a clean configuration.