DHCP Snooping not working

Answered Question
Aug 4th, 2009

Hi,

Im trying to get DHCP snooping working on a WS-C2960-48TC-S with IOS version 122-50.SE3 (LAN Lite). But for some reason it isnt working at all.

I've globally enabled dhcp snooping using the "ip dhcp snooping" command. I've enabled dhcp snooping on vlan 10. I've made all my access layer ports untrusted, and configured my uplinks as trusted. I've configured the database on flash:/snooping.db. Don't know if this last thing is needed.

Now when I connect a router working as a rogue dhcp server to an untrusted port and I refresh my dhcp on a client PC, the client PC just gets the IP address of the rogue DHCP server....

Config:

ip dhcp snooping vlan 10

ip dhcp snooping database flash:/snooping.db

ip dhcp snooping

interface FastEthernet0/1

description CLIENTPC

switchport access vlan 10

switchport mode access

storm-control broadcast level bps 10m

storm-control multicast level bps 10m

storm-control action trap

spanning-tree portfast

spanning-tree guard root

ip dhcp snooping limit rate 50

!

interface FastEthernet0/2

description ROGUE DHCP SERVER

switchport access vlan 10

switchport mode access

storm-control broadcast level bps 10m

storm-control multicast level bps 10m

storm-control action trap

spanning-tree portfast

spanning-tree guard root

ip dhcp snooping limit rate 50

!

interface GigabitEthernet0/1

description UPLINK TO REAL DHCPSERVER

switchport mode trunk

udld port aggressive

spanning-tree link-type point-to-point

ip dhcp snooping trust

HOSTNAME# show ip dhcp snooping

Switch DHCP snooping is enabled

DHCP snooping is configured on following VLANs:

10

DHCP snooping is operational on following VLANs:

10

DHCP snooping is configured on the following L3 Interfaces:

Insertion of option 82 is enabled

circuit-id default format: vlan-mod-port

remote-id: 0026.517d.d900 (MAC)

Option 82 on untrusted port is not allowed

Verification of hwaddr field is enabled

Verification of giaddr field is enabled

DHCP snooping trust/rate is configured on the following Interfaces:

Interface Trusted Allow option Rate limit (pps)

----------------------- ------- ------------ ----------------

FastEthernet0/1 no no 50

Custom circuit-ids:

FastEthernet0/2 no no 50

Custom circuit-ids:

GigabitEthernet0/1 yes yes unlimited

Custom circuit-ids:

Any help would be appreciated. Thanks! Is it because of my LAN Lite image?

I have this problem too.
0 votes
Correct Answer by Peter Paluch about 7 years 4 months ago

Hello,

I am not completely sure but the documentation suggests that the DHCP features are supported on LAN Base image only. Check this page for further details:

http://www.cisco.com/en/US/partner/docs/switches/lan/catalyst2960/software/release/12.2_50_se/configuration/guide/swdhcp82.html

Best regards,

Peter

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.

Actions

This Discussion