need advice on DHCP snooping on 3750 and 2960 switches

[Difan Zhao]

Hi experts,

After two days straight lab I think I have figured out how DHCP snooping works. I'm about to implement it at the customer networks but before that I need advice from you guys:

1. How much impact it will have on the switch CPU and RAM? How many binding entries can 2960 or 3750 store in the RAM? I only use it to prevent rogue DHCP servers. I'm not using source verify/check.

2. It looks like if the DHCP request is from a trusted port then there won't be binding entry. Is that normal?

3. If you have two or more layers of switches, do you make only the uplink port the trusted port or you also make the downlink port the trusted port? The uplink is the port on the access switch going to the core. The downlink port is the port on the Core going down to the access switch. I can make all the trunk ports (uplink and downlink) trusted port and it will still prevent the rogue DHCP server. However, as in the question#2, I won't see all the bindings on the core because the requests are coming in on trusted ports... So if you have a way to enable binding even when the request is from a trusted port, then it will be perfect.

BTW we have DHCP server on every VLAN so we don't do relay.

Thanks,

[Jayakrishna Mada]

Hi,

1. How much impact it will have on the switch CPU and RAM? How many binding entries can 2960 or 3750 store in the RAM? I only use it to prevent rogue DHCP servers. I'm not using source verify/check.

[JK] CPU and RAM should not be overloaded that much with snooping. The only time the CPU will go high is that if you have lots of users requesting for DHCP address at the same time.

Upto 64k entires are allowed and each entry take about 74 bytes So approximately 15MB memory will be used for 64k entires.

2. It looks like if the DHCP request is from a trusted port then there won't be binding entry. Is that normal?

[JK] The switch should be creating an dhcp binding entry when it sees a DHCPACK packet coming from the trusted port. If you are seeing a client getting an IP from the dhcp server which is on a trusted port you should see a binding entry.

3.If you have two or more layers of switches, do you make only the uplink port the trusted port or you also make the downlink port the trusted port? The uplink is the port on the access switch going to the core. The downlink port is the port on the Core going down to the access switch. I can make all the trunk ports (uplink and downlink) trusted port and it will still prevent the rogue DHCP server. However, as in the question#2, I won't see all the bindings on the core because the requests are coming in on trusted ports... So if you have a way to enable binding even when the request is from a trusted port, then it will be perfect.

[JK] Trust is configured only on the uplink ports and not on the downlink ports. Are you enabling DHCP snooping on all the switches in the network or only on the access-layer switches ?

Hope that helps.

JayaKrishna

[Difan Zhao]

Mada,

Thanks for the reply! Kind of suprised that how you manage to dig this post out lol

1. Got it!

2. Are you sure?? I tried again and I still don't see bindings on the trusted ports... I'm running newest 12.2(55) firmware on my 3750 switch.

3. Yes you are abolutely right however at some customer sites, due to lack of cabling, we have to daisy chain some access switches and also create a loop for redundancy so both the first and the last switch each has an uplink to Core. With SPT we make some VLAN traffic go through one path and the rest through another path. That's being said the Uplinks are Downlinks as well lol I too don't see that you can configure "trusted ports" per VLAN basis...

Anyway so my only concern is about question#2... Can you double check it for me?? My config is really simple:

ip dhcp snooping vlan 100,601,652-653
no ip dhcp snooping information option
ip dhcp snooping
interface

ip dhcp snooping trust
interface

ip dhcp snooping trust

Thank you!

Difan

[Jayakrishna Mada]

Hi Difan,

When you say dhcp request I am assuming a dhcp client requesting a dhcp address which is coming in on trusted port. In this case the switch may or may not form the binding depending up on whether its seeing the rest of dhcp packets especially (DHCP ACK). Since the server and the client are located towards the trusted port of the switch that you are on, this switch might not see the complete dhcp transactions.

Hope that helps.

JayaKrishna