Rogue dhcp

[Petty Talamayan]

we have a 9407 and several small business edge switches, we recently had an issue where we lost internet connection in the whole facility, we started troubleshooting using elimination; we were able to identify the switches that created the issue. How do we drill down to find either a rogue dhcp or dhcp looping?

[Kasun Bandara]

@Petty Talamayan hi, when you facing the issue, easiest way is check the DHCP server IP in any client PC which have wrong IP. then trace the MAC address of that rough DHCP server within network. 

[Petty Talamayan]

The problem is when we reconnect the feed to that switch where the rogue server is located, we lose internet/lan connection to the whole facility, unable to issue an iprenew/release.

[Kasun Bandara]

hi @Petty Talamayan when issue occurs, are you getting any IP in the PC?

[Petty Talamayan]

We haven’t tried that yet but we believe our core’s ip was taken by the rogue server as we lose internet when we reconnect that switch to the network, the core is our internet gateway.

[Giuseppe Larosa]

Hello @Petty Talamayan ,

you should deploy two hosts with static IP address ( manually configured) so that those two are not impacted by the rogue DHCP server.

The long term solution may be DHCP snooping , but you need to verify on the small business switches if they support it.

Hope to help

Giuseppe

[Petty Talamayan]

When you say two host, two dhcp servers?

We are using catalysts 1300/1200 as edge switches and they do support ip dhcp snooping, they are also enabled, do we need to do ip dhcp snooping trust on the feed ports?

[Petty Talamayan]

If we change the DHCP server’s IP address, will that help and does it only impacts the statically assigned devices?
Same with the Core/gateway?

[Giuseppe Larosa]

Hello @Petty Talamayan ,

DHCP snooping trust only on ports towards DHCP servers all other ports to be left untrusted.

my suggestion was to have at least two host devices with manually set IP addresses to be able to reach them in any case.

The ufficial DHCP servers can be on site or not.

Hope to help

Giuseppe