cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Bookmark
|
Subscribe
|
13153
Views
0
Helpful
7
Replies

Problem with "ip helper-address" configuration

baskervi
Level 1
Level 1

We have an occasional user's PC that is getting an IP from our DHCP server in the wrong subnet. The PC is in VLAN 2 with IP subnet range 172.16.2.0/24, and the DHCP server (172.16.2.10) is in the same VLAN. We also have a requirement for an application to forward broadcasts from 172.16.2.0/24 to 172.16.1.255 (some UDP ports above 11000 and configured with the "ip forward-protocol udp 11005" and "ip forward-protocol udp 11006"). For VLAN 2, we have "ip helper-address 172.16.1.255" configured. We have 8 other VLAN interfaces configured to forward DHCP requests to 172.16.2.10 via "ip helper-address 172.16.2.10".

The interesting part is that the occasional user's PC (in VLAN 2) will get an IP address for VLAN 1. It appears that the "ip helper-address 172.16.1.255" is causing DHCP requests in VLAN 2 to appear to be coming from VLAN 1 when the hosts get the incorrect IP. If I disable the "ip helper-address 172.16.255), the other application breaks. I do see the expected DHCP server in the "ip config /all" and the host appears to be in an island and cannot communicate with any other host. There is no loop in the topology. I need the DHCP for the ip helper commands in the configuration for the other VLANs.

The DHCP server is Win2008 R2, and the switch is a Catalyst is as follows:
Cisco IOS Software, Catalyst 4000 L3 Switch Software (cat4000-I5K91S-M), Version 12.2(25)EWA5, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2005 by Cisco Systems, Inc.
Compiled Thu 17-Nov-05 15:53 by alnguyen
Image text-base: 0x10000000, data-base: 0x115F1BE0

ROM: 12.1(12r)EW
Dagobah Revision 55, Swamp Revision 16

Core_Switch uptime is 1 year, 47 weeks, 6 days, 6 hours, 30 minutes
System returned to ROM by power-on
System restarted at 16:12:08 UTC Mon Sep 14 2009
System image file is "bootflash:cat4000-i5k91s-mz.122-25.EWA5.bin"

Does anyone have a suggestion as to what I might try? Thanks - Allyn

1 Accepted Solution

Accepted Solutions

I don't know if this solve your problem or not , but i will for sure limit the following command using an access-list :-

ip directed-broadcast  on VLAN 2.

interface Vlan2

description 2nd Floor

ip address 200.0.2.254 255.255.255.0 secondary

ip address 172.16.2.254 255.255.255.0

ip helper-address 172.16.1.255

no ip redirects

ip directed-broadcast access-list 100

no ip proxy-arp

access-list 100 ext permit ip any 172.16.1.0 0.0.0.255

I hope I have the right subnets in the access-list , this would stop dhcp requests meant vlan 2 being forwarded to other vlans.

Manish

View solution in original post

7 Replies 7

grahamhyland
Level 1
Level 1

Hi Please send the extracts from the config including helper , port conf for the involved devices

Graham

DHCP requests (bootp) are forwarded by default.

It should be possible to exempt certain protocols from being forwarded.

The command for this is (no) ip forward-protocol udp .

http://www.cisco.com/en/US/docs/ios/12_3/ipaddr/command/reference/ip1_i1g.html#wp1108053

To stop dhcp requests, you must exempt bootp protocols udp 67 and 68

no ip forward-protocol udp 67

no ip forward-protocol udp 68

When using a /24 mask, your current helper is an ip broadcast address for vlan 1.

regards,

Leo

Sorry for the delay in replying. I understand /24 is a broadcast address for Vlan 1. For the system to work, it has to be this way.

interface Vlan1
description Management Vlan
ip address 172.16.1.254 255.255.255.0
ip helper-address 172.16.2.10
no ip directed-broadcast
!
interface Vlan2
description 2nd Floor
ip address 200.0.2.254 255.255.255.0 secondary
ip address 172.16.2.254 255.255.255.0
ip helper-address 172.16.1.255
no ip redirects
ip directed-broadcast
no ip proxy-arp
!
...
!
interface Vlan30
description Wireless Network
ip address 172.16.30.254 255.255.255.0
ip helper-address 172.16.2.10
no ip redirects
no ip directed-broadcast
no ip proxy-arp

ip forward-protocol udp bootpc
ip forward-protocol udp bootps
ip forward-protocol udp 1116
ip forward-protocol udp 11005
ip forward-protocol udp 11006

Jon Marshall
Hall of Fame
Hall of Fame

Are you sure there is no DHCP server in vlan 1 that could be responding to the client request ?

Jon

I am absolutely certain about this. When I do an "ipconfig /all", the DHCP server in VLAN 2 shows up.

cadet alain
VIP Alumni
VIP Alumni

Hi,

Can you renew your DHCP lease and while doing this  do a debug ip dhcp server packets on your relay-agent.

Regards.

Alain.

Don't forget to rate helpful posts.

I don't know if this solve your problem or not , but i will for sure limit the following command using an access-list :-

ip directed-broadcast  on VLAN 2.

interface Vlan2

description 2nd Floor

ip address 200.0.2.254 255.255.255.0 secondary

ip address 172.16.2.254 255.255.255.0

ip helper-address 172.16.1.255

no ip redirects

ip directed-broadcast access-list 100

no ip proxy-arp

access-list 100 ext permit ip any 172.16.1.0 0.0.0.255

I hope I have the right subnets in the access-list , this would stop dhcp requests meant vlan 2 being forwarded to other vlans.

Manish