How do you get DHCP to work through a controller?

[tdennehy]

I thought I asked this question in the past...

If you add a controller to an external network in a soho environment, how do you get the controller to pass DHCP requests through it.  In order to get it to work, I have to set up a DHCP scope in the controller, which is not what I want to do.  I want to use the existing DHCP service.  The controller doesn't seem to want to send the requests through.           

[Stephen Rodriguez · Accepted solution]

Under the interface you have the WLAN linked to you set the DHCP server address there. The WLC will proxy the request to the DHCP server. This is the default behavior of the WLC and works in most cases.

Alternately, if you want the WLC to just bridge the packet and let your ip helper address take care of it you would disable DHCP proxy.

Config dhcp proxy disable.

If the WLC is the dhcp for any interface, you can't disable proxy.

HTH,

Steve

Sent from Cisco Technical Support iPhone App

[Amjad Abdullah]

Steve just described it.

Under the dynamic interface to which your WLAN is mapped you need to specify the IP address of the DHCP server. If you want to use internal DHCP you provide the management interface IP address as the DHCP server ip address.

If you want to use external DHCP, you provide the DHCP server IP address.

This link talks thoroughly about DHCP on WLC. It shows exactly how WLC behaves with either DHCP proxy feature enabled or disabled:

http://www.cisco.com/en/US/products/ps6366/products_tech_note09186a0080af5d13.shtml

HTH

Amjad

[Saravanan Lakshmanan]

WLC as dhcp relay or not with dhcp proxy disabled on wlc?

Steve, With dhcp proxy disabled on WLC, what's the behavior with primary & secondary dhcp server when it is L2 & L3 ip configured on the wlan mapped interface along with different dhcp relay ip configured on the external device attached to WLC. which address is used by WLC.

[George Stefanick]

When you use proxy, no ip helpers are needed. The wlc will actually uni cast the dhcp request from the wlc dynamic interface it was received on, on behalf of the client.

Disable it, it's back to old school, add helpers.

A few notes .. If you use a fw for a dhcp server and since it's statefull you need to disable proxy.

Also of you use ISE with the dhcp probe for finger printing, you need to disable it ..

Cheers !

Sent from Cisco Technical Support iPhone App

[Saravanan Lakshmanan]

say, if i don't have ip-helper configured on my external device connected to WLC but on WLC interface configured primary dhcp ip same as the interface ip range and secondary dhcp ip as L3, does WLC uses these ip to forward dhcp or not. Meaning can wlc act as dhcp relay/ip-helper with proxy disabled on wlc and without external ip helpers for that vlan.

it is understood that L2 broadcast hit the primary dhcp irrespective of the config. does wlc uses its vlan interface gateway to forward the dhcp or not.

[George Stefanick]

If you disable proxy, the DHCP address you enter in the dynamic interface is not used. Normally broadcast rules apply. The client is on the VLAN and the interface / router will forward. As I udnerstand it and have come to review in the field.

When proxy is enabled, the WLC will unicast the DHCP request from the dynamic interface it was receved on..

[Saravanan Lakshmanan]

Thanks George.

[Stephen Means]

"Also of you use ISE with the dhcp probe for finger printing, you need to disable it .."

I'm dealing with this exact issue now. You can't simply put ISE in as a secondary DHCP server for the WLAN because it doesn't unicast to BOTH primary and secondary server addresses.

So you're left disabling dhcp proxy and using helper addresses on VLAN SVI's, which is fine if you want *ALL* of your WLANs to use an external DHCP server. In this case we'd like the Guest users to get DHCP addresses from the WLC (they get tunneled to a mobility anchor in a DMZ where there is no DHCP server) and the regular users to use the SVI helper addresses so that the DHCP packets can also be sent to ISE for proper profiling.

I guess we're kind of stuck with it and may have to get the customer to stand up a DHCP server in their DMZ, I see no other way around it at this point.