
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-15-2011 06:28 PM - edited 03-07-2019 01:43 AM
We have an occasional user's PC that is getting an IP from our DHCP server in the wrong subnet. The PC is in VLAN 2 with IP subnet range 172.16.2.0/24, and the DHCP server (172.16.2.10) is in the same VLAN. We also have a requirement for an application to forward broadcasts from 172.16.2.0/24 to 172.16.1.255 (some UDP ports above 11000 and configured with the "ip forward-protocol udp 11005" and "ip forward-protocol udp 11006"). For VLAN 2, we have "ip helper-address 172.16.1.255" configured. We have 8 other VLAN interfaces configured to forward DHCP requests to 172.16.2.10 via "ip helper-address 172.16.2.10".
The interesting part is that the occasional user's PC (in VLAN 2) will get an IP address for VLAN 1. It appears that the "ip helper-address 172.16.1.255" is causing DHCP requests in VLAN 2 to appear to be coming from VLAN 1 when the hosts get the incorrect IP. If I disable the "ip helper-address 172.16.255), the other application breaks. I do see the expected DHCP server in the "ip config /all" and the host appears to be in an island and cannot communicate with any other host. There is no loop in the topology. I need the DHCP for the ip helper commands in the configuration for the other VLANs.
The DHCP server is Win2008 R2, and the switch is a Catalyst is as follows:
Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I5K91S-M), Version 12.2(25)EWA5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 17-Nov-05 15:53 by alnguyen
Image text-base: 0x10000000, data-base: 0x115F1BE0
ROM: 12.1(12r)EW
Dagobah Revision 55, Swamp Revision 16
Core_Switch uptime is 1 year, 47 weeks, 6 days, 6 hours, 30 minutes
System returned to ROM by power-on
System restarted at 16:12:08 UTC Mon Sep 14 2009
System image file is "bootflash:cat4000-i5k91s-mz.122-25.EWA5.bin"
Does anyone have a suggestion as to what I might try? Thanks - Allyn
Solved! Go to Solution.
- Labels:
-
Other Switching
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 03:35 PM
I don't know if this solve your problem or not , but i will for sure limit the following command using an access-list :-
ip directed-broadcast on VLAN 2.
interface Vlan2
description 2nd Floor
ip address 200.0.2.254 255.255.255.0 secondary
ip address 172.16.2.254 255.255.255.0
ip helper-address 172.16.1.255
no ip redirects
ip directed-broadcast access-list 100
no ip proxy-arp
access-list 100 ext permit ip any 172.16.1.0 0.0.0.255
I hope I have the right subnets in the access-list , this would stop dhcp requests meant vlan 2 being forwarded to other vlans.
Manish
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 05:49 AM
Hi Please send the extracts from the config including helper , port conf for the involved devices
Graham
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 06:17 AM
DHCP requests (bootp) are forwarded by default.
It should be possible to exempt certain protocols from being forwarded.
The command for this is (no) ip forward-protocol udp
http://www.cisco.com/en/US/docs/ios/12_3/ipaddr/command/reference/ip1_i1g.html#wp1108053
To stop dhcp requests, you must exempt bootp protocols udp 67 and 68
no ip forward-protocol udp 67
no ip forward-protocol udp 68
When using a /24 mask, your current helper is an ip broadcast address for vlan 1.
regards,
Leo

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 12:49 PM
Sorry for the delay in replying. I understand /24 is a broadcast address for Vlan 1. For the system to work, it has to be this way.
interface Vlan1
description Management Vlan
ip address 172.16.1.254 255.255.255.0
ip helper-address 172.16.2.10
no ip directed-broadcast
!
interface Vlan2
description 2nd Floor
ip address 200.0.2.254 255.255.255.0 secondary
ip address 172.16.2.254 255.255.255.0
ip helper-address 172.16.1.255
no ip redirects
ip directed-broadcast
no ip proxy-arp
!
...
!
interface Vlan30
description Wireless Network
ip address 172.16.30.254 255.255.255.0
ip helper-address 172.16.2.10
no ip redirects
no ip directed-broadcast
no ip proxy-arp
ip forward-protocol udp bootpc
ip forward-protocol udp bootps
ip forward-protocol udp 1116
ip forward-protocol udp 11005
ip forward-protocol udp 11006
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 06:13 AM
Are you sure there is no DHCP server in vlan 1 that could be responding to the client request ?
Jon

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 12:50 PM
I am absolutely certain about this. When I do an "ipconfig /all", the DHCP server in VLAN 2 shows up.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 06:32 AM
Hi,
Can you renew your DHCP lease and while doing this do a debug ip dhcp server packets on your relay-agent.
Regards.
Alain.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
08-16-2011 03:35 PM
I don't know if this solve your problem or not , but i will for sure limit the following command using an access-list :-
ip directed-broadcast on VLAN 2.
interface Vlan2
description 2nd Floor
ip address 200.0.2.254 255.255.255.0 secondary
ip address 172.16.2.254 255.255.255.0
ip helper-address 172.16.1.255
no ip redirects
ip directed-broadcast access-list 100
no ip proxy-arp
access-list 100 ext permit ip any 172.16.1.0 0.0.0.255
I hope I have the right subnets in the access-list , this would stop dhcp requests meant vlan 2 being forwarded to other vlans.
Manish
