Re: DHCP Snooping on access points interfaces

itbn · ‎05-12-2023

Hello! I have multiple wireless access points on different interfaces on my cisco 2960x switch. When using DHCP Snooping and client moving from one AP to another, the client device mac-address is essentially changing ports.

Will it be problem? Will the switch be dropping dhcp packets from device if its mac and ip addresses is already in "dhcp binding table" binding to another port?

Thank you!

Flavio Miranda · ‎05-12-2023

Hello,

Do you have WLC or it is standalone Access Points?

But, either way the clients mac address will not be dropped as the communication will be with the Access Point and not with the switch directly. The AP is not a bridge on this case do, the mac address which will communicated with the switch is the Access Point mac address.

itbn · ‎05-12-2023

@Flavio Miranda wrote:
Hello,
Do you have WLC or it is standalone Access Points?

It is Ubiquiti Unifi APs

But, either way the clients mac address will not be dropped as the communication will be with the Access Point and not with the switch directly. The AP is not a bridge on this case do, the mac address which will communicated with the switch is the Access Point mac address.

But i see clients mac addresess on APs' ports:

SW-BCM-SRV-01#show mac address-table | include 1/0/2
13 6022.321e.0e49 DYNAMIC Gi1/0/2
19 4cdd.3119.5368 DYNAMIC Gi1/0/2
19 f039.65ee.1b35 DYNAMIC Gi1/0/2
446 924e.8e99.0ab9 DYNAMIC Gi1/0/2
446 baca.928c.af2c DYNAMIC Gi1/0/2

APs' ports are configured as trunk with several vlans

Flavio Miranda · ‎05-12-2023

well, on this case it totaly different from what I thought. The AP is actually a bridge on this case and now I would say DHCP snooping could be a problem.

itbn · ‎05-12-2023

Can i do something with it? I don't want to set these ap interfaces trusted, because some wifi client can start dhcp service or something like that.
Maybe there is another solution to this problem?

Flavio Miranda · ‎05-12-2023

You need to run some tests but what I would try is put the DHCP lease time higher then the IGMP aging time.

Actually it is a good practice put DHCP lease time to like 4 hours. This way you prevent clients to ask for IP all the time and when it does, the mac address will be already release on the IGMP mac table.

But I am assuming you do have roaming between AP because if the client disconnect from one AP and do the process again on the next AP chances are it will request IP again.