DHCP Snooping Binding

yusuf.ujjainwala · ‎01-07-2010

We have implemented DHCP snooping Binding on our Csico 3750 Switch for one of our User VLAN. I have noticed that I get the entries for most of the machines in the DHCP Snooping Binding Table , but some machines the entry does not appear.

I have checked these PC and they are not assigned static IP to the machne , as well as the config of the PC is same

Machine OS is Windows XP.

We are running 12.2.46 Adv IPservices image.

Any idea on why this issue.

ssieger · ‎01-07-2010

Hi,

try the global configuration command "no ip dhcp snooping information option" to disable the dhcp option -82.

By the way, can you tell me use of the binding table, so it's not necessary for me to open a new thread.

Hth,

Stephan

yusuf.ujjainwala · ‎01-07-2010

The option 82 is already disabled.

We have implemented DHCP Snooping because we also have Dynamic Arp Inspection enabled for which DHCP snooping is reqd.

Regards

Peter Paluch · ‎01-07-2010

Hi Stephan,

I am sorry but I do not see how disabling the insertion of the DHCP Option 82 may resolve the original issue. Moreover, the DHCP Snooping benefits greatly from the insertion of the option-82 and I personally strongly discourage from deactivating it.

I recommend verifying the following:

In which VLAN are the ports whose clients do not get recorded in the DHCP Snooping database? Is the DHCP Snooping activated for this particular VLAN using the command ip dhcp snooping vlan X?
Are these ports treated as DHCP Snooping untrusted ports? They must not be configured with the command ip dhcp snooping trust
Are the stations connected to these ports guaranteedly getting their IP address via DHCP? Can it be confirmed using a packet sniffer on those stations, say, Wireshark?

If none of these suggestions helps then debugging the DHCP Snooping may be helpful. These commands can be used for DHCP Snooping debugging:

debug ip dhcp snooping event
debug ip dhcp snooping packet

Note that the debugging shall be preferably done in periods of low traffic, as it is CPU-intensive and may disrupt the proper operation of your networking device under higher loads.

Best regards,

Peter

yusuf.ujjainwala · ‎01-08-2010

Hi Peter ,

Thanks for the reply

The DHCP snooping commands that we have cofigured are

ip dhcp snooping vlan 15
no ip dhcp snooping information option
ip dhcp snooping

VLAN 15 is our data vlan.

All the ports are configured to take the IP From the DHCP .

I will check for the debug you mentioned .

One thing I want to mention is that we are running Port Security also.

Regards

CSCO11455305 · ‎06-24-2010

We have the same problem, but with IP phones only. Workstations get IP and are added to DHCP Snooping Binding. But IP phones and workstations connected to network through switch of phone sometimes haven't been added to DHCP Snooping Binding. I can't understand why. I have restarted port and phones was added to the table, I restarted switch and phones which were in the DHCP Snooping Binding Table - disappeared, and vice versa. We would like to implement Dynamic ARP Inspection, but we can't... May be somebody have solved such problem and can give a hint.