dhcp snooping not working (solved)

[bavo]

Hi,

I have an question.

I`m testing the DHCP snooping in my test environment. Before i implement it in the production network.

My setup:

2 c3560 linked with a trunk TS01<->TS02  (TS=TestSwitch:-)

A DHCP server router (Cisco RV180) is connected on port 10 on TS01

Both switches has been configured as follow:

ip dhcp snooping

ip dhcp snooping vlan 1-2048

port 10 on TS01 is configured with the "ip dhcp snooping trust".

all ports are configured in VLAN 110

If i connect a laptop on port 40, i receive a ip address from the dhcp server (as expected).

If i configure a router for DHCP, and connect it to port 15 (in the same vlan as the other DHCP) The port is not switching in the err-disable state as i should expected.

When i disable port 10 (the good DHCP) and renew the IP of the laptop i receive an IP of the "Rogue" DHCP server. witch is not configured with the "trust" rule..

A`m i missing something?

I`m using the c3560-ipservicesk9 version

[bavo]

Ok, after 6 hour testing so far.

After a cashing thing i discover that when i disable port 10 (the good DHCP) i did not receive a ip address from the rogue router (port 15). But the port is not in err-disable state.

When i configure "ip dhcp snooping trust" on port 15 (The rogue DHCP) i`m able to receive a IP address.

Conclusion So far
i could say the the DHCP snooping holds the DORA packets. but it is not transition the port into error-disable state nor logs the action..
So i`m looking into the violation actions.

[bavo]

In the last few days i`m looking for the reason wy the port is not set to err-disable state when a rogue DHCP server is connected to the switch when the  switch is configured for "ip dhcp snooping".

I found out that the port is holding the DORA packets of the rogue DHCP server. But the port will never put in the err-disable state. Never was. not even a log message. It was never build for that protocol.

This is a flaw in the documentation of the DHCP snooping. I think the should be in the docss. May be it will be in the future.

Case closed