DHCP server and ip helper-address issue

Question,
By accident I had configured an IP HELPER-ADDRESS on a VLAN interface pointing to a DHCP server with an IP addrees in the same VLAN ( ip subnet ).
Some users had complaints and there were BAD ADDRESS entries in our DHCP server registered.
Can anyone explain to me why this is an issue please ?
My guess is that the the DHCP server receives the DHCPREQUEST from the client via the braodcast request and via the unicast request from the ip helper-address configuration. But does this really interfere with the DHCPACK and DHCPOFFER packets afterwards ?

Alex,
I've not been able to capture the network packets but I can understand if the server would send DHCPNACK requests ( wxhich would be a normal process ).
I just don't understand why so many users suddenly have issues and my DHCP scope is filling up with BAD ADDRESSES.
My assumption is that the client receives 2 valid DHCP responses ( one form the actual DHCP server and another one from the router, acting as DHCP relay agent ) and acknowledges them, but the DHCP process is somewhere corrupted ( either on the DHCP server or the DHCP client ).
I want a technical explanation for this issue :-)

Similar Messages

Windows DHCP Server and Linux DHCP Relay Agent

We are trying to organize a VLAN (say VLAN 1) for guests who must be assigned IP addresses from a DHCP server in a different VLAN (VLAN 2). This DHCP server is configured with two scopes - 172.16.0.0/24 (for VLAN 2) and 172.16.4.0/24 (for the Guests
VLAN 1). The DHCP server successfully distributes addresses to clients in its VLAN (it has the IP address 172.16.0.2). For the clients in the other VLAN a DHCP Relay Agent has been setup on the router. It is DHCRELAY running on Linux (CentOS) which has
been configured to accept the DHCPDISCOVER broadcasts coming on the VLAN1 interface of the router and forward these to the DHCP server. The IP address of the VLAN1 interface of the router is 172.16.4.254 and on the VLAN2 interface - 172.16.0.254
The problem is that the DHCP server won't respond with a DHCPOFFER message to the relay agent. I have traced the frames on the router and on the DHCP server. They arrive on the DHCP server with the correct GIADDR of the relay agent. According to all documentation,
if a scope has been configured on the DHCP server and it receives a unicast message with the GIADDR set by a relay agent that matches one of the configured scopes, the DHCP server must send a unicast DHCPOFFER to the relay agent. But it doesn't.
Here is what Wireshark reports (ignore the Destination port unreachable messages, the DHCP service was stopped at the time Wireshark was running)
When the service is running, there are just DHCPDISCOVERs - no OFFER. You can see that the server has the two scopes configured:
The relay agent seems to work normally - it forwards the DHCPDISCOVERs to the server continuously (tried many times with ipconfig /renew on the client).
I read many posts about this problem. Some users had other services running on the DHCP server that used the DHCP port, but I don't have such an issue (you see that when the service is stopped, an ICMP port unreachable is sent which is correct). Others however
did not find a solution. Am I missing something? Is there something specific when using the DHCRELAY agent from DHCPD? Can I turn on some verbose logging to track this down? Thanks in advance.

WIth DHCP, there is really nothing to configure. If the Relay Agent/IP Helper is pointing to it, and the VLAN subnet exactly matches the scope subnet, then it should just work.
What I've seen in the VLAN config is either a static route back to the subnet the DHCP server itself is sitting on is not configured or incorrectly configured, or there are ports blocked (need UDP, too, since that's what DHCP uses to pass the OFFER), and
other necessary ports are opened, then it should just work.
Sometimes NIC teaming on the DHCP server will cause it. Not sure. Microsoft doesn't support teaming prior to Windwos 2012, but it doesn't mean that it doesn't work. Don't get me wrong, teaming works nicely, but they just don't support it because they never
certified the drivers, that's all.
The issues I've seen with DHCP relays and VLANs in the forums are usually based on misconfigs in the VLAN or ports blocked. Sometimes we'll refer to call Microsoft Support for specific, hands-on assistance. And searching the threads, from what
I've found that if they did call support, they've never posted back what the problem was based on or the resolution. I can post a couple of them for you to read through, but there were never any response with the actual resolution.
If you like, you also have the option to contact Microsoft Support. Here's a list of phone numbers if you choose this option:
http://support.microsoft.com/contactus/
Ace Fekay
MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
Microsoft Certified Trainer
Microsoft MVP - Directory Services
Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
This post is provided AS-IS with no warranties or guarantees and confers no rights.

HELP !!!!!!! i new to OS X Server and need help setting up WINS (in DHCP)

i Need help on how to setup the WINS part of DHCP
can any one help ?
what should my settings be for ?
WINS/NBNS PRIMARY SERVER:
WINS/NBNS SECONDARY SERVER:
NBDD SERVER:
NBT NODE TYPE:
netBIOS SCOPE ID:
i have DNS, SMB, AFP, Open Directory all setup
just dont get WINS
kinda old school isnt it ?
so if some one could help i would be thankful \
Jono.

thanks sorry for the "noob" question,
i am having one problem with windows computers not showing up in finder & on the windows computer the OS X Server wont show up when you go to map a driver. or in vista the "networking" place. but you can type in the IP address of the server and it will find it.
all the computers are getting DNS and DHCP from the server but i cant figure out what happening.
there only one server and its OS X leopard 10.5.6
is this because WINS ? or some thing else
and sorry for asking i don't really like asking.
but thanks for the help. ir im being to much of a "noob" just dont reply haha
Jono.

WRT160NL built in DHCP server and WEB server stop to work

Hello all!
My home network based on the WRT160NL with one wireline PC, two wireless PCs and wireless printer works with no problems - connections are at full speed, no drop outs, wireless and wireline QOS is perfect. But then quite regularly every two or three days suddenly the router internal DHCP servers stops to work - I see with the wireshark that my wireline PC sends the DHCP requests to the router but router does not reply to them. If at the same moment the other PC's are allready in use and got theirs IP before they can surf the internet uninterrupted. Only router reboot helps to solve this situation. After the reboot DHCP server immediately acknowledges DHCP request from the PC and assigns him his IP number.
Sometime this situation occurs when IP address is already assigned, I can surf the internet, routing works, I can ping the router but I can not access the router's built in web server. Neither via IE, neither via FF.
I do not use P2P programs, IP traffic over the router is very light - no internal traffic between PCs, no file transfers to the USB flash key and WAN internet connection is 1Mbs. I have upgraded to the latest firmware Ver.1.00.01.17. Nevertheless problem occurs quite regularly about every three days.
I try to reproduce the problem more frequently and there is the way how to do that - I start to watch IP TV on my wireline PC (usually I watch my IP TV via the STB connected directly to the DSL modem) so IP TV multicast now goes through the router. It is about 5 - 6 Mbs and about 500 pps of IP traffic. This IP TV stream very often causes internal web server and DHCP server to stop. So although I can watch IP TV and surf the web on my PC with no problems, if other PC's are powered up during this situation they will not get theirs IP addresses.
I see in other posts on this forum that similar behavior can be triggered also with the heavy read/write traffic to the attached USB flash key.
So my conclusion would be:
- are the problems above known to Linksys/Cisco, do they acknowledge them, do they work on them
- when we can expect new firmware release - can we expect new release for this model at all
Best regards
Message Edited by srus on 02-12-2010 04:05 AM
Message Edited by srus on 02-12-2010 04:14 AM

Ridcully thank you for your post, I did not execute the procedure you suggested. Prior to execute it I want to get more background on it? Why do you think that reconfiguring from the factory defaults would solve my problem? Are you 100% sure that this is the solution or are you just guessing?
Router offers backup and restore functionality where you can store current configuration into file on PC and latter restore it. Can I use this functionality in your procedure or should I reconfigure all router settings manually?

SG300 Vlan IP-Helper Address issues

hi,
I am trying to set a ip-helper address on my sg300 though getting the following.
DNSWITCH01#configure
DNSWITCH01(config)#interface vlan2
DNSWITCH01(config-if)#ip helper-address 192.168.1.1
% missing mandatory parameter
DNSWITCH01(config-if)#DNSWITCH01#
DHCP server is server 2008 R2 and the range is active for that vlan and can route to vlan and devices set statically fine

Hi Konrad, DHCP cannot be used for IP helper since the switch has a DHCP-RELAY service.
-Tom
Please mark answered for helpful posts

I own an Aspire netbook and am trying to upgrade to Windows 10, and need to address issues.

I own an Aspire Netbook and I am having issues resrving an upgrade to Windows 10. Can anyone tell me when this will be fixed?
I own one of your Netbooks and I am trying to reserve the update for Windows 10 and I am getting this message
AO722
AO722-C62kk
Serial number
LUSFT02175*****
Purchase date
2012/01/03
When I use the Windows 10 reserve app I get a message that says
"Windows 10 will work on this PC.
This PC can be upgraded but there may be issues.
Devices
These devices might not work correctly after the upgrade.
Terminal Server Keyboard Driver
(Standard System Devices)
Terminal Server Mouse Driver
(Standard System Services)
Can you please tell me what the story is and when will it be fixed.
Thank you,
TomS
[edited for privacy-please do not post personal or unique information such as but not limited to full names, email addresses, phone numbers, serial numbers, etc.]

spetho2001,
You are describing what sounds like the Microsoft compatibility check tool. It runs to make sure whatever issues may occur are known before an upgrade to Windows 10. If you need a more solid solution I would suggest contacting Microsoft directly as it is their tool.

Is it possible to turn of DHCP server and still route?

I would like to use my airport extreme as a router but have another computer be the DHCP server. It looks like if I turn on routing DHCP turns on and there is no way to turn it off.
Thanks for any help.

That's pretty unfortunate. It seems like a pretty normal thing to do. So I am going to have to have a separate router just because airport extreme doesn't support this. Seems like most of the routers out there do allow this.
Thanks.

NAC guest server and guest proxy filtering issue.

Hi all
Continuing our issues log for the NAC guest server install, our toplogy and issue is as follows:
We have a guest NAC server and a 4404 anchor controller successfully deployed in the DMZ, the anchor WLC has a mobilty anchor which is a WISM on the corporate network, DHCP services for guest clients are issued with no problems from the WLC in the DMZ. The first port of the DMZ controller is located on the DMZ and the second port directly connects to the firewall interface.
All works correctly, DNS, DHCP, NTP, SNMP etc all work fine through the firewall.
What options do I have to filter Internet access in this scenario, we have Websense and Nokia firewalls, don't think I can use WCCP as I have nowhere to place it, the second connection on the WLC is directly connected to the firewal so nowhere to intercept the traffic, our security team has tried some tricks on the Nokia to try to redirect the traffic on the firewall using a type of redirect, WPAD, I can't see as an option. Any ideas. If I place the second interface into the DMZ, could I use WCCP that way maybe, but won't traffic still have to go to the firewall??
options please ??

Well you will need to use a 3rd party certificate.. Here is a link to generate and install a 3rd party certificate on the WLC for the use with Web-Auth:
http://www.cisco.com/en/US/tech/tk722/tk809/technologies_configuration_example09186a00806e367a.shtml
Here is a link for the NGS:
http://tools.cisco.com/search/display?url=http%3A%2F%2Fwww.cisco.com%2Fen%2FUS%2Fdocs%2Fsecurity%2Fnac%2Fappliance%2Fconfiguration_guide%2F410%2Fcas%2Fcas41ug.pdf&pos=1&strqueryid=2&websessionid=RK88fQNWy8TCDUakpNGLOqZ
The applicances are using a self generated Cisco certificate which of course is not a trusted certificate store in most of all operating systems. So using a 3rd party certificate like RapidSSL, Verisign, etc will eliminate the certificate issue.

TMS server and WinSXS - HD space issues

I was wondering if anyone else is having a problem with disk space on their TMS servers? I'm running TMS 14.4.2 on a virtual server, and my hard drive is filling up with various files. I have gone in an deleted some old software versions from the TMS folder, but the big culprit is my Windows directory! It is currently at 25GB and growing - inetpub and winsxs are the problem folders.
Various windows forums say that there isn't anything you can do about the files in winsxs, and Cisco TAC advised me to carefully remove some files from the inetpub folder (subfolder Logs). Am I the only one having these issues?
The TMS installation guide states that only 4GB of disk space is required for the application footprint, but doesn't say what the recommended harddrive size is. Let me clarify this, however - I'm using an external SQL database - NOT local.
My TMS server has been acting odd lately, and I have had to restart some services from time to time, or do a full reboot. I'm quite certain that my VM server is running as per Cisco's recommendations:
Cisco TMS can be installed in a virtualized server environment as long as the virtual machine is allocated
sufficient dedicated resources to meet the server and hardware requirements for installation. The resources
allocated to the Cisco TMS server instance must be dedicated, and not shared with other server instances.
My OS is Windows Server 2008 R2 Standard, Service Pack 1., 7GB RAM, Intel Xeon CPU E5-2670 0 @ 2.60 GHz 2.60 GHz, 64 bit.
If you have any feedback or suggestions, I'd appreciate it.

Would be interesting to know which HD size you provisioned and how much free space you have left now. I always recommend around or more than 100GB for the C: drive then you most like have no stress.
Storage is cheap, trouble you have now is stressful.
Many strange symptoms of TMS can be fixed by deinstalling and reinstalling TMS (and TMSPE if used) connecting the same DBs afterwards
As you use an external database, what you could do is to stop the old TMS, install a new windows server and TMS and then reconnect to the same database. If you do not trust you windows nor the TMS install.
(also possibe, deinstall tms on the old one, resize the partition, reinstall TMS).
This guide is a bit older but might help you here as well:
https://supportforums.cisco.com/document/108271/migrating-telepresence-management-suite-tms-new-serverpdf
Sure, strangeness of TMS could also be an issue with the DB, OS, something in your network, ...

RV016: PPTP Server and "Block MAC address"

So if the PPTP server is enabled, and "Block MAC address not on the list" is enabled under the DHCP settings, will the PPTP client get an IP address?
Similarly, if the PPTP server is enabled and the range of IP addresses configured on the PPTP server screen is outside the IP range of the router due to a subnet mask (like 255.255.225.248 for example), will the IP still be assigned to the PPTP client? If assigned, will that IP have any connectivity to the LAN?
Thank you in advance for any answers!
Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

So here's how PPTP works with these two features:
1. The PPTP IP range is a different range than the DHCP range. You get an error message if your PPTP IP range overlaps with the DHCP one.
I didn't test the 'Block MAC' function because since the IP isn't coming from the DHCP pool, I highly doubt any MAC blocking will work.
2. Since your PPTP IP address range is outside of the DHCP range, this point is completely taken off the table. However, if you choose an IP range that's outside of the subnet, you'll get an error message when saving. I also learned that if you set the PPTP IP to just a single number and connect, the router will automatically reject any additional connections since no IPs are available.
Huntsville's Premiere Car and Bike e-magazine: www.huntsvillecarscene.com

Problem with an unavailable server and the "Offline address book" rol

I have a site with two Exchange 2007 servers and tried to install a new Exchange 2013 but the process did not end well.
Now the 2013 server has the role of "Offline address book" and is no longer available which creates multiple problems. How I can do to remove the references to the 2013 server and move the role referred to one of the existing Exchange 2007 servers?

My recommendation would be to fix whatever went wrong and complete the setup.
The server is probably the generation server for a new offline address list. Check that by entering the following command.
Get-OfflineAddressBook
If there's a new list created by Exchange 2013 setup, you can simply remove it using Remove-OfflineAddressBook, and that should take care of what you're seeing.
Ed Crowley MVP "There are seldom good technological solutions to behavioral problems."

OS X server, DHCP Server and random blocked IPs

Hello !
I use a Mac Mini as a DHCP server for my wireless network. It is connected to internet through a wired modem and gives an IP (through Airport) to the computers that ask for it.
Everything works quite fine... Unless, sometimes, clients obtain an adress but cannot browse the web nor connect to local network. The ip is just "blocked".
If i try to use it on an other computer (manually), it just doens't work.
So, I must change the ip, by changing the DHCP Name of the computer (otherwise, the server always give the same adress), to fix the problem.
What is strange, is that a few time after, the incriminated ip works new ! Until it is down again...
My bootpd config file is the fallowing;
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>NetBoot</key>
<dict/>
<key>Subnets</key>
<array>
<dict>
<key>allocate</key>
<true/>
<key>dhcpdomainname</key>
<string>antoine.maille.priv</string>
<key>dhcpdomain_nameserver</key>
<array>
<string>81.253.149.1</string>
<string>80.10.246.3</string>
<string>10.0.0.1</string>
</array>
<key>dhcpldapurl</key>
<array>
<string>ldaps://Mac Mini/</string>
</array>
<key>dhcp_router</key>
<string>10.0.0.1</string>
<key>lease_max</key>
<integer>604800</integer>
<key>leasetimesecs</key>
<string>86400</string>
<key>name</key>
<string>DHCP WiFi</string>
<key>net_address</key>
<string>10.0.0.0</string>
<key>net_mask</key>
<string>255.255.255.0</string>
<key>net_range</key>
<array>
<string>10.0.0.10</string>
<string>10.0.0.100</string>
</array>
<key>selectedportname</key>
<string>en1</string>
<key>uuid</key>
<string>FEB30FD5-3749-480E-9FEB-BD2C20206431</string>
</dict>
</array>
<key>allow</key>
<array/>
<key>bootp_enabled</key>
<true/>
<key>deny</key>
<array/>
<key>detectother_dhcpserver</key>
<true/>
<key>dhcp_enabled</key>
<true/>
<key>oldnetbootenabled</key>
<false/>
<key>relay_enabled</key>
<true/>
<key>relayiplist</key>
<array/>
<key>timeServiceStarted</key>
<string>2008-11-26 22:59:19 +0100</string>
</dict>
</plist>
Do you have any idea of what I should do to fix that problem ?
Thanks !
alex

Brandon Macinnis wrote:
Dnar,
Thanks for the follow up bit about using the smbutil statshares command. I used that and could confirm that I am also able to force it to connect with smb2. Oddly though, in the stat share info it still says "AUTO_NEGOTIATE"
SMB_NEGOTIATE AUTO_NEGOTIATE
SMB_VERSION SMB_2.1
But maybe that just means something else and not the fact that it did not auto negotiate to SMB. I guess for now this will be what I have to do to use smb2.
I think in this case the AUTO_NEGOTIATE merely means it will auto negotiate a connection between SMB1, SMB2, and (from your data) also SMB2.1 this would have nothing to do with auto negotiating between SMB2 and AFP, which from this thread appears broken.
I also would like to thank Brandon for the tip about smbutil statshares, I had been looking for a simple way to tell what version of SMB was being used to test my NAS.
For everyone's benefit, it would appear from the above that whilst Apple advertise Mavericks as using SMB2 they have gone as far as implementing SMB2.1 and merely list it only as SMB2 for simplicity and due to the fact there is not a huge different between SMB2 and SMB2.1
See http://en.wikipedia.org/wiki/Server_Message_Block#SMB_2_and_3

Moved to new server and needing help with feed

My website www.gothamknightsonline.com has been moved to a new server and I am needing to keep the feed updated with new and old podcasts. I have reposted some of the old episodes as well as a new one I just posted. I have not been able to get the feed to show up. When I view our podcasts itunes page all of the info on each individual podcast is now gone with just the episodes listed and no more information.
Here is the feed URL: http://gothamknightsonline.com/category/podcast/feed/ (I have verified the feed) but I am not certain if this is the same feed URL that was listed before. Either way the plugin i used for my podcasts in wordpress has this in the feed as well as our iTunes id and URL ( http://itunes.apple.com/us/podcast/batman-gotham-knights-online/id315370686)
I am doing all of this on a Wordpress blog using the podpress plugin.
Any help would be appreciated. Thank you
-Garrey

iTunes is looking for a feed at http://www.gothamknightsonline.com/feed/?cat=10 and not finding it - checking this I don't get 'file not found' but if there is a file there it contains no data whatever.
I assume this is your original feed URL. The method for redirecting iTunes to another feed URL involves placing a special tag in the original feed, and is described in detail here:
http://www.wilmut.webspace.virginmedia.com/notes/podcast.html#move
Your new feed contains this tag (effectively redirecting to itself); you need to place a copy of the feed, with the redirect tag, at the original URL and leave it there for a couple of weeks. If you are unable to do this the two alternatives are described in my article.

Address Book Server and iOS Default Account Issue

I have a really strange issue with a Lion Server. 10.7.5
There are several user accounts on the machine some are local, some are OD accounts. For the most part they work just fine.
Mail and Calendar accounts seem to be ok and indeed when you set up the Address book account this also work and syncs in both directions.
Here is the odd issue: For certain accounts, iOS devices do not seem to register them to be available to set as default. The device can use them properly, they do sync fine, if you hit 'import SIM contacts' they will show up as options to choose as the destination account, but if you have iCloud and another contact account set up, they do not show up as options to be chosen as the default contacts account. If they are the only contact accounts, then the 'Set Default Account' option does not even appear in the Mail, Contacts, Calendars settings under Contacts. It appears fine under Calendars and Mail.
When I installed more than one of the 'faulty' accounts on a single iOS device, then deactivated all but one, the Default Account option reappeared (there was also an iCloud account present), but it soon disappears on its own.
Has anyone seen this before?
I'm at a bit of a loss.

You should see a "CardDAV" option in the AccountType popup in AddressBook.app. That is what you need to select to use AddressBook Server on OS X 10.6.

Spanning Tree and Admin mac address issues srw2048

Ok, I have a somewhat complex problem and hopefully someone may shed some light or have an idea as to whats wrong.
First the scenario:
I have two Cisco Cat 6509's etherchanneled to each other via two fiber cables. One of these is the STP/RSTP root. I have two SRW2048's.. one trunked to each of these 6509 switches. There is also a trunk between the SRW2048's. All this is to create a redundant topology so that if one of the switches fail's the others can still forward packets to each other. Of course the scenario described is in fact a loop that should be handled by STP/RSTP. I have RSTP enabled on all the switches in the scenario (PV RSTP on the cisco switches as they only do Cisco's brand of per vlan spanning tree). There are 3 vlan's configured on each of the srw2048's (2,55,96). There are corresponding vlan's also on the 6509's. I have put the srw2048's management interface into vlan 2.
The problem:
I need to forward packets between the srw2048's primarily and only use the 6509 that is not the root when a failure happens. I have configured the non-root 6509's spanning tree cost on the etherchannel to be higher then the alternate path through the srw's to the root. I can hook everything up and view the spanning tree and see that the srw2048's interface that goes to the non-root 6509 is blocked, and all other interfaces on the other switches are forwarding. I can in fact ping and get to the admin interface on all the switches. Then for some strange reason the admin interface of the srw2048 plugged into the non-root 6509 stops responding. If I disable either the interface its plugged into on the 6509 or the other srw2048 everything starts working again. Sometimes it responds after many failures for no apparent reason. I looked into the mac-address table on the 6509's and they are conflicting, pointing to each other for the mac-address of the broken srw2048. When I clear the mac-table the admin port comes back for about 5 seconds then again goes dark. When reviewing mac-table on the 6509's they are back to pointing to each other. The odd thing (although I haven't confirmed this completely) is that hosts placed into vlan 2 on that same srw2048 seem to work fine. If there was an STP loop or something misconfigured, I would expect it to effect any host in vlan 2 or the other vlan's for that matter on the srw2048 that stops responding. Alas, I am stuck because I need to manage this switch remotely. My only thought is that for some reason even when the STP status is blocked the broken srw2048 is still sending out arp's of its admin interface and bypassing the STP protocol. I have no way to confirm this, but maybe someone has an idea as to what I'm doing wrong, or otherwise offer a solution. For now, I simply removed vlan 2 from the 6509 that the broken srw2048 is plugged into and everything seems fine.
My apologies for such a long post, but this is somewhat complicated. Thanks in advance for any info.
-Geoff
Message Edited by gmyers on 08-19-2008 10:35 PM

To follow up, I had a ticket open with Linksys about this for about 3 months with no resolution. I submitted packet captures, stp outputs, etc and no luck. I gave up and basically had to revert to a manual failover for redundancy. It's no perfect or fast, but it works every time.
Unless linksys issues a firmware upgrade with this as a fix, I doubt we will be able to ever resolve this on our own.

DHCP server and ip helper-address issue

Similar Messages

Maybe you are looking for