Hello Team
We have 2 tier architecture network setup wherein cat 6509 VSS (Running IOS 15.1(2)SY) is configured as the core and stacks of Cat 3750 Switches (running ios 15.0(2)SE) are configured at the access layer. DHCP servers are directly connected on VSS and providing ip addresses to DHCP clients connected on Cat 3750 Stack.Recently we had implemented DHCP snooping in the setup with following configuration done at the core and access layer.
********************************
Configuration for Core Switches
********************************
conf t
ip dhcp snooping
ip dhcp snooping vlan 2, 9, 11, 12, 13, 14, 15-19, 23, 24, 28-31, 33-36, 41, 42, 44,46,48, 49, 51, 55, 57, 58, 59 61-64, 67, 76-78, 80, 86-90, 91, 92, 251
ip dhcp snooping limit rate 100
interface Gi1/7/x ------------>> interface connected with DHCP server.
ip dhcp snooping trust
interface Gi2/7/x ------------>> interface connected with DHCP server.
ip dhcp snooping trust
int po10
ip dhcp snooping information option allow-untrusted—Connected to access stack
int po11
ip dhcp snooping information option allow-untrusted--- Connected to access stack
ip dhcp snooping database tftp://10.135.x.y/BindingDatabase/abc.dhcp====external tftp server for storing the binding database
ip dhcp snooping database timeout 30 seconds
ip dhcp snooping database write-delay 40 seconds
********************************
Configuration for floor access Switches
********************************
ip dhcp snooping
ip dhcp snooping limit rate 25
int po157===============connected to VSS
ip dhcp snooping trust
exit
After this implementation, new users were getting ip’s from the dhcp server without any issue.we observed the setup for 3-4 hours and the external TFTP server was getting the bindings also. Next day the users stopped getting ip’s from the dhcp server and during this event the tftp server file was not getting binding and looks like the binding was stopped after 4-5 hours of implementation as the file size not increased much.( Currently we have reverted back the setup by disabling dhcp snooping in the core. )
We were getting the following error during the issue on the core switch
%DHCP_SNOOPING-5-DHCP_SNOOPING_NONZERO_GIADDR: DHCP_SNOOPING drop message with non-zero giaddr or option82 value on untrusted port, message type: DHCPINFORM, MAC sa: 000b.8642.74e0
o 1478720: *Oct 21 2013 11:27:13.675: %DHCP_SNOOPING-5-DHCP_SNOOPING_UNTRUSTED_PORT:
I have following queries on the same
- Is something wrong from configuration perspective
- Are the delay , timeout values are playing any role here for the TFTP
- Is the external tftp server has any role out here
- Whats the wayout to make it working.
Regards
Sameer
