DHCP snooping configuration on tier 3 architecture.

[R Manjunatha]

Hello,

I need to configure DHCP snooping as shown in the network topology three-tier architecture. the core switch CSW-2 connected DHCP server interface e2/3. which switch do I need to configure DHCP snooping? and which interface I need to configure IP DHCP snooping trust. I configured DSW switches SVI and VLAN,10,20,30,40,50,60 and similarly configured VLANs on ASW switches.

[M02@rt37]

Hello @R Manjunatha,

DHCP snooping can be configured on the access layer switches (ASW switches) and optionally on the distribution layer switches (DSW switches) if you want to provide an extra layer of security

ASW:

So, configure DHCP snooping on each ASW switches for the specific VLANs where DHCP clients are connected. This means you'll need to configure DHCP snooping for VLANs 10, 20, 30, 40, 50, and 60 on each ASW switch.

interface <uplink_interface>
ip dhcp snooping trust

Configure ip dhcp snooping trust in the uplink interfaces that connect to the distribution layer switches (DSW switches). These interfaces are usually facing the DSW switches and connect to VLANs 10, 20, 30, 40, 50, and 60.

interface <uplink_interface>
ip dhcp snooping trust

DSW:

Configuring DHCP snooping on the DSW switches would provide an additional layer of security if needed. If you decide to enable it, follow the same steps as for the ASW switches.

Configure ip dhcp snoooing trust on the uplink interfaces that connect to the core switches (your case CSW-1 and CSW-2) since they are where the DHCP server is connected.

interface <uplink_interface>
ip dhcp snooping trust

Core Switches:

Since these switches are directly connected to the DHCP server, you don't typically configure DHCP snooping on them. Instead, you would configure trust relationships on the DSW switches (if configured) and the ASW switches.

[paul driver]

Hello
Only apply it on the access-layer switches, no need to apply it anywhere else, but just make sure you trust the port(s) where the dhcp server resides and the access-layer switch interconnects

This will mean trust access-layer switch's uplinks (trunks) to the distribution, and if you dhcp server reside on the access-layer then obviously you need trust that port also.

[David Ruess]

In addition to what others provided you also need to "turn it on" If you just issue the ip dhcp snooping vlan <#> then it wont work. You will also need to enable the snooping globally by issuing the ip dhcp snooping command separately from the other commands.

You would trunk trunk links to other switches (only on devices you enabled DHCP snooping on) and activate it on ACCESS switches is usually the best policy

M02@rt37 I believe you have the incorrect commands under your ASW description. I believe this should be ip dhcp snooping vlan <#> which activates it on the VLAN as I assume you were trying to point out. The ip dhcp snooping trust command you point out under the ASW section does not activate DHCP snooping on VLANs.

One more thing to mention. I believe if you enable DHCP snooping on your access switches then you may need to disable option 82 for the switch to forward DHCP messages without acting as a relay agent. The command should be 

no ip dhcp snooping information option

-David

[R Manjunatha]

Thank you and let's simulate the same as provided different opinions. 

[R Manjunatha]

I configured the DHCP snooping Access switches and I am not getting DHCP requests from the server.

ASW-1#sh run | se dhcp
ip dhcp snooping vlan 10,20,30,40,50,60
ip dhcp snooping
ip dhcp snooping trust
ip dhcp snooping trust

ASW-1#sh run int e0/1
Building configuration...

Current configuration : 114 bytes
!
interface Ethernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
ASW-1#sh run int e0/0
Building configuration...

Current configuration : 114 bytes
!
interface Ethernet0/0
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust

ASW-2#sh run int e0/0
Building configuration...

Current configuration : 114 bytes
!
interface Ethernet0/0
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
end

ASW-2#sh run int e0/1
Building configuration...

Current configuration : 114 bytes
!
interface Ethernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
end

ASW-2#sh run | se dhcp
ip dhcp snooping vlan 10,20,30,40,50,60
ip dhcp snooping
ip dhcp snooping trust
ip dhcp snooping trust

ASW-3#sh run | se dhcp
ip dhcp snooping vlan 10,20,30,40,50,60
ip dhcp snooping
ip dhcp snooping trust
ip dhcp snooping trust
ASW-3#sh run int e0/1
Building configuration...

Current configuration : 114 bytes
!
interface Ethernet0/1
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
end

ASW-3#sh run int e0/0
Building configuration...

Current configuration : 114 bytes
!
interface Ethernet0/0
switchport trunk encapsulation dot1q
switchport mode trunk
ip dhcp snooping trust
end

ASW-3#

[David Ruess · Accepted solution]

Thank you for the output. 2 things:

1. Did you disable option 82 on the switch you configure for DHCP snooping as I mentioned in my post?

no ip dhcp snooping information option

2. Did DHCP work before you added the DHCP snooping configurations? Make sure DHCP works with no extra configuration or else it could be more difficult to troubleshoot.

-David 

[R Manjunatha]

Fantastic after disabling option 83 as said command in all Access switches. now DORA process is successful.

Thank you very much, David.