DHCP issue

[NInja Black]

We have 4 vlans on the  Cisco 4500 switch for workstations, phones, wifi, servers.

The DHCP server is windows 2008 R2 server.

Since the past 2 weeks its been acting up.Last week the PCs weren't getting IPs and then 3 days back it was the phones and today its the WiFi devices.

Everytime this was happening we changed ip on a separate NIC on the server and connected it to directly to the particular vlan and made it work for the time being. The next day the isue seem to resolve itself as we switched back to previous setup to check and there was no issue.

so right now we have 3 NICs on the server for the 3 vlans. (just in case)

Unable to figure out what the issue could be. Another device with same DHCP IP?

I am going to unplug the DHCP server from the network later today, clear cache on switch and try and ping the DHCP server IP just to make sure thats not the issue.

Any other ideas or suggestions? It would be a great help. Thanks

[petenixon · Accepted solution]

Is there anything in the log files to see if there are any duplicate addresses on the network, and can you confirm that the DHCP server configuration is correct (this is normally the source of my woes!)?

Normally, you should only need 1 ip helper-address (same address) on each of your VLAN interfaces, no matter how many subnets you have. Would it be possible to attach the config of the switch?

[NInja Black]

I have a syslog server setup for ASAs but no log files for the switch. (Hope thats what you meant to ask. Please elaborate)
 

There is only 1 ip helper-address on the switch for all VLAN int.

interface Vlan4
 ip address 10.10.xx.xx 255.255.x.x
 ip helper-address 10.10.y.y
!
interface Vlan5
 ip address 10.10.xx.xx 255.255.xx.xx
 ip helper-address 10.10.y.y
!
interface Vlan6
 ip address10.10.xx.xx 255.255.xx.xx
 ip helper-address 10.10.y.y
!
interface Vlan7
 ip address10.10.xx.xx 255.255.xx.xx
 ip helper-address 10.10.y.y
!

 I did a ipcongfig/release ipconfig /renew on my pc and filtered the DHCP replies on wireshark (bootp.type==2) and the got the one ip address only. 10.10.y.y

[petenixon]

On the Cat 4500, use the command show log and then please post the output. If there is no output, use the logging buffered command.

And my apologies, I read your post (3 interfaces on the DHCP server) as having three separate IP address for your DHCP server/helper addresses.

[NInja Black]

Not sure how this log will help as it doesn't show any messages relating to DHCP.

Please find attaced sh log output.

[petenixon]

The log buffer is normally one of my first ports of call when troubleshooting an issue, and it doesn't necessarily have to be a DHCP log entry to be related to a DHCP issue.

Without knowing your topology, I can't comment on the output, but there is one log entry that sticks out

Have you been able to verify the DHCP server config?
Are the DHCP server interfaces in a port channel and does that match the interface configuration?
 

[NInja Black]

The DHCP server config looks good.

No the interfaces aren't in Port channel.

Which log entry are you talking about?

"13:09:35.504: %C4K_L2MAN-6-INVALIDSOURCEADDRESSPACKET: (Suppressed 1 times)Packet received with invalid source MAC address (93:E0:16:0D:EE:A1) on port Gi2/3/xx in vlan 6"

Will look into it too . Later. Btw its an FTP server at the interface's end.

[petenixon]

Can you post the port configs from/to the core switch from the DHCP server, and a show interfaces trunk from those switches please?

[NInja Black]

Actually I went through the DHCP server event log and found the following messages

Warning: The DHCP service has detected that it is running on a DC and has no credentials configured for use with Dynamic DNS registrations initiated by the DHCP service.   This is not a recommended security configuration.  Credentials for Dynamic DNS registrations may be configured using the command line "netsh dhcp server set dnscredentials" or via the DHCP Administrative tool."

Warning: This computer has at least one dynamically assigned IPv6 address.For reliable DHCPv6 server operation, you should use only static IPv6 addresses.

Information: The DHCP/BINL service on the local machine, belonging to the Windows Administrative domain cama.local, has determined that it is authorized to start. It is servicing clients now.

Croschecked with the DC at one of our branch offices and seems the IPV6 needs to be unchecked. Did so and will test and verify.

Will let you know how it goes.

Thanks soo much for your time and suggestions petenxion. I highly appreciate it.