Hi,
Im trying to get DHCP snooping working on a WS-C2960-48TC-S with IOS version 122-50.SE3 (LAN Lite). But for some reason it isnt working at all.
I've globally enabled dhcp snooping using the "ip dhcp snooping" command. I've enabled dhcp snooping on vlan 10. I've made all my access layer ports untrusted, and configured my uplinks as trusted. I've configured the database on flash:/snooping.db. Don't know if this last thing is needed.
Now when I connect a router working as a rogue dhcp server to an untrusted port and I refresh my dhcp on a client PC, the client PC just gets the IP address of the rogue DHCP server....
Config:
ip dhcp snooping vlan 10
ip dhcp snooping database flash:/snooping.db
ip dhcp snooping
interface FastEthernet0/1
description CLIENTPC
switchport access vlan 10
switchport mode access
storm-control broadcast level bps 10m
storm-control multicast level bps 10m
storm-control action trap
spanning-tree portfast
spanning-tree guard root
ip dhcp snooping limit rate 50
!
interface FastEthernet0/2
description ROGUE DHCP SERVER
switchport access vlan 10
switchport mode access
storm-control broadcast level bps 10m
storm-control multicast level bps 10m
storm-control action trap
spanning-tree portfast
spanning-tree guard root
ip dhcp snooping limit rate 50
!
interface GigabitEthernet0/1
description UPLINK TO REAL DHCPSERVER
switchport mode trunk
udld port aggressive
spanning-tree link-type point-to-point
ip dhcp snooping trust
HOSTNAME# show ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10
DHCP snooping is operational on following VLANs:
10
DHCP snooping is configured on the following L3 Interfaces:
Insertion of option 82 is enabled
circuit-id default format: vlan-mod-port
remote-id: 0026.517d.d900 (MAC)
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:
Interface Trusted Allow option Rate limit (pps)
----------------------- ------- ------------ ----------------
FastEthernet0/1 no no 50
Custom circuit-ids:
FastEthernet0/2 no no 50
Custom circuit-ids:
GigabitEthernet0/1 yes yes unlimited
Custom circuit-ids:
Any help would be appreciated. Thanks! Is it because of my LAN Lite image?
