Nexus DHCP Snooping save database?
Is there a way save the DHCP snooping database on Nexus7K or 5K, either to flash or server? Without this, wouldn't DAI and IP Source Guard be triggered by normal traffic after a reboot?
Hi Sunil, that was the last idea I had got.
The one before the last was write on this support forum.
So I tried everythink but reboot. Which is little bit strange solution.
Thank you.
Similar Messages
-
Hi,
Can anyone help me with these setup issues.
The Cat OS config guide chapter "configuring DHCP-snooping and IP source guard" for v8.4 doesnt mention how to:
1) Disable dhcp-snooping
2) configure a destination for the snooping database.
I would like to setup the local flash PCMCIA card as a destination for the DB.
I have found documentation for other releases of CatOS that state how to specify a DB location:
set dhcp-snooping bindings-database <device>:[filename]
However this syntax is not supported in 8.4. With command line auto-complete (the tab key) and/or help there is no option for "bindings-database" available.
Do I need to activate the DB somewhere else in the config?
thanks,The command to disable DHCP snooping is:disabled the ip dhcp snooping
-
How to synchronize between DHCP binding table and DHCP snooping table ?
I clear DHCP snooping table with command "clear ip dhcp snooping binding " , and PC can't communicate with other any more. So how to synchronize between DHCP binding table and DHCP snooping table ?
dhcp-test#sh ip dhcp bind
IP address Client-ID/ Lease expiration Type
Hardware address
99.1.65.32 0100.1125.353c.25 Mar 02 1993 01:05 AM Automatic
99.1.65.33 0100.1438.059f.85 Mar 02 1993 12:01 AM Automatic
dhcp-test#sh ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type VLAN Interface
Total number of bindings: 0
thanks!ip dhcp snooping binding mac-address vlan vlan-id ip-address interface interface-id expiry seconds
Add binding entries to the DHCP snooping binding database. The vlan-id range is from 1 to 4904. The seconds range is from 1 to 4294967295.
Enter the above command for each entry that you add
To delete the database agent or binding file, use the no ip dhcp snooping database interface configuration command. To reset the timeout or delay values, use the ip dhcp snooping database timeout seconds or the ip dhcp snooping database write-delay seconds global configuration command.To renew the database, use the renew ip dhcp snooping database privileged EXEC command. -
Hello,
We have a 2960 48 port switch in a remote office with a couple of VLANs (VOIP & Data). The L3 routing is provided via the WAN router and acts as a 'router on a stick' and provides DHCP for both VLANs.
I need to enable DHCP snooping and I have issued the 'ip dhcp snooping trust' on the router port but not for the access ports. I have then added 'ip dhcp snooping' to the switch but not 'ip dhcp snooping vlan x , x' as I was hoping the ip dhcp snooping bindings database would start to fill up after a few days but it hasn't.
If I add 'ip dhcp snooping vlan x , x' I think the users will get issues as there is no database, what should I do as the router is doing the DHCP.
ThanksYou need to identify the vlans where snooping should be implemented using:
ip dhcp snooping vlan #
The default allows dhcp requests on untrusted ports. -
N7K - Any way to save the DHCP Snooping DB?
Catalyst has 'ip dhcp snooping database' command to save as a file. Cannot find similar command on the Nexus. Without it, wouldn't a reboot cause the DB to come up empty, triggering arp inspection and source guard for legitimate traffic?
Hello Bob,
In the recently releases by default DHCP bindings are not saved persistently across switch reboots. To maintain persistent bindings across switch reboots, use the copy run start command.
When the copy run start command is issued, all bindings that exist at that time are made persistent across switch reboots. -
DHCP Snooping database - The current agent is active
Hello, I need to change an database URL. But switch can't end active agent.
After release of command I get an message, and nothing happend. After release "no" the result is the same.
I had tried no ip dhcp snooping and also use a timers to expire, but I think switch have got a software error.
Version 12.2(33)SXH6, RELEASE SOFTWARE (fc1)
switch#ip dhcp snooping database scp://user:[email protected]/tftpboot/snooping/switch
%Cannot change URL. The current agent is active.Hi Sunil, that was the last idea I had got.
The one before the last was write on this support forum.
So I tried everythink but reboot. Which is little bit strange solution.
Thank you. -
ME3400 dhcp snooping database restore
Hi guys,
NTP synchronization on ME3400 takes around 10 minutes and I couldn not find way to reduce it.
The problem is with restoring dhcp snooping database from flash/tftp after switch boots up.
Database is restored after clock synchronization, but 10 minutes is to long as users with snooping/DAI are blocked until snooping database is restored.
As ME3400 does not have hw clock, option with restoring clock after it boots up is not available.
Does anyone had similar problem?
Please share any idea/proposal how to overcome this issue.
Many thanks,
GrgoHi Sunil, that was the last idea I had got.
The one before the last was write on this support forum.
So I tried everythink but reboot. Which is little bit strange solution.
Thank you. -
[solved] DHCP snooping in environment with core and access switches
Hello,
I'd like to know what steps are needed to configure DHCP snooping in my environment:
1) two core switches Catalyst 6500 (VSS): VLAN defined here, DHCP server connected here
2) access switches Catalyst 3750: clients connected here
Access switches are connected to core ones via trunk ports (fiber optics).
How many snooping databases are required? One for core and next for each stack?Hi Marian,
If your network is properly designed and connected so that clients, including DHCP clients, are attached to the access layer switches, then the DHCP Snooping should be run only on access switches. Running DHCP Snooping on core switches is not going to increase the security because the DHCP communication has already been sanitized on the access layer.
If you intend to save the DHCP Snooping database then each switch performing the DHCP Snooping needs to have its own database if you intend to use a persistent storage for it. However, you can always have the switch to save the database to its own FLASH, alleviating the need for a centralized networked storage.
I am not sure if this answers your question so please feel welcome to ask further.
Best regards,
Peter -
IP DHCP snooping, IP source Guard, and DIA
Hi All,
I have Configured DHCP snooping and IP source guard and Dynamic arp inspection on my 3560 and 3750 Network Switches,
on both of them I'm facing that issue. (the printers and access points are configured to get ip addresses via DHCP), but when the lease time expires, they don't get ip addresses, and become unreacheable.
while all other clients get thier ip addresses normally
below you can find the Configuration configuration
ip dhcp snooping vlan 98,105,111
no ip dhcp snooping information option
ip dhcp snooping database flash:dhcpsnooping
ip dhcp snooping database write-delay 15
ip dhcp snooping
ip arp inspection vlan 98,105,111
ip verify trust on all access ports including printers and access point ports
all access ports are DHCP snooping untrusted
also when I create a static dhcp snooping binding record for these devices on the switch it resolves the Issue, but when I reload the switch it's removed automatically.
any resolution will be much appreciated.
regards,
Mahercheck the following link for configuration of DHCP snooping
http://packetlife.net/blog/2010/aug/18/dhcp-snooping-and-dynamic-arp-inspection/
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html -
Hi,
I would like to DHCP snooping on the WLC.
Or a method to block DHCP pirate and authorized my DHCP.
Best Regards,
Julien Hernandez.Here the client 192.168.0.0 :
(Cisco Controller) >show client detail 1c:99:4c:6f:c6:96
Client MAC Address............................... 1c:99:4c:6f:c6:96
Client Username ................................. N/A
AP MAC Address................................... 44:ad:d9:57:fd:20
AP Name.......................................... AP-INDE-106
AP radio slot Id................................. 0
Client State..................................... Associated
Client NAC OOB State............................. Access
Wireless LAN Id.................................. 1
Hotspot (802.11u)................................ Not Supported
BSSID............................................ 44:ad:d9:57:fd:20
Connected For ................................... 8127 secs
Channel.......................................... 11
IP Address....................................... 192.168.0.155
Gateway Address.................................. Unknown
Netmask.......................................... Unknown
Association Id................................... 8
Authentication Algorithm......................... Open System
Reason Code...................................... 1
Status Code...................................... 0
Session Timeout.................................. 15000
Client CCX version............................... No CCX support
QoS Level........................................ Silver
Avg data Rate.................................... 0
Burst data Rate.................................. 0
Avg Real time data Rate.......................... 0
Burst Real Time data Rate........................ 0
802.1P Priority Tag.............................. disabled
CTS Security Group Tag........................... Not Applicable
KTS CAC Capability............................... No
WMM Support...................................... Enabled
APSD ACs....................................... BK BE VI VO
Power Save....................................... ON
Current Rate..................................... m7
Supported Rates.................................. 5.5,11.0,6.0,9.0,12.0,18.0,
............................................. 24.0,36.0,48.0,54.0
Mobility State................................... Local
Mobility Move Count.............................. 0
Security Policy Completed........................ Yes
Policy Manager State............................. RUN
Policy Manager Rule Created...................... Yes
Audit Session ID................................. none
AAA Role Type.................................... none
Local Policy Applied............................. none
IPv4 ACL Name.................................... none
FlexConnect ACL Applied Status................... Unavailable
IPv4 ACL Applied Status.......................... Unavailable
IPv6 ACL Name.................................... none
IPv6 ACL Applied Status.......................... Unavailable
Layer2 ACL Name.................................. none
Layer2 ACL Applied Status........................ Unavailable
mDNS Status...................................... Disabled
mDNS Profile Name................................ none
No. of mDNS Services Advertised.................. 0
Policy Type...................................... N/A
Encryption Cipher................................ None
Protected Management Frame ...................... No
Management Frame Protection...................... No
EAP Type......................................... Unknown
FlexConnect Data Switching....................... Local
FlexConnect Dhcp Status.......................... Local
FlexConnect Vlan Based Central Switching......... No
FlexConnect Authentication....................... Central
Quarantine VLAN.................................. 0
Access VLAN...................................... 321
Client Capabilities:
CF Pollable................................ Not implemented
CF Poll Request............................ Not implemented
Short Preamble............................. Implemented
PBCC....................................... Not implemented
Channel Agility............................ Not implemented
Listen Interval............................ 10
Fast BSS Transition........................ Not implemented
Client Wifi Direct Capabilities:
WFD capable................................ No
Manged WFD capable......................... No
Cross Connection Capable................... No
Support Concurrent Operation............... No
Fast BSS Transition Details:
Client Statistics:
Number of Bytes Received................... 2526655
Number of Bytes Sent....................... 2425132
Total Number of Bytes Sent................. 2425132
Total Number of Bytes Recv................. 2526655
Number of Bytes Sent (last 90s)............ 64
Number of Bytes Recv (last 90s)............ 6764
Number of Packets Received................. 25105
Number of Packets Sent..................... 5996
Number of Interim-Update Sent.............. 0
Number of EAP Id Request Msg Timeouts...... 0
Number of EAP Id Request Msg Failures...... 0
Number of EAP Request Msg Timeouts......... 0
Number of EAP Request Msg Failures......... 0
Number of EAP Key Msg Timeouts............. 0
Number of EAP Key Msg Failures............. 0
Number of Data Retries..................... 1018
Number of RTS Retries...................... 0
Number of Duplicate Received Packets....... 56
Number of Decrypt Failed Packets........... 0
Number of Mic Failured Packets............. 0
Number of Mic Missing Packets.............. 0
Number of RA Packets Dropped............... 0
Number of Policy Errors.................... 0
Radio Signal Strength Indicator............ -60 dBm
Signal to Noise Ratio...................... 24 dB
Client Rate Limiting Statistics:
Number of Data Packets Recieved............ 0
Number of Data Rx Packets Dropped.......... 0
Number of Data Bytes Recieved.............. 0
Number of Data Rx Bytes Dropped............ 0
Number of Realtime Packets Recieved........ 0
Number of Realtime Rx Packets Dropped...... 0
Number of Realtime Bytes Recieved.......... 0
Number of Realtime Rx Bytes Dropped........ 0
Number of Data Packets Sent................ 0
Number of Data Tx Packets Dropped.......... 0
Number of Data Bytes Sent.................. 0
Number of Data Tx Bytes Dropped............ 0
Number of Realtime Packets Sent............ 0
Number of Realtime Tx Packets Dropped...... 0
Number of Realtime Bytes Sent.............. 0
Number of Realtime Tx Bytes Dropped........ 0
Nearby AP Statistics:
AP-INDE-108(slot 0)
antenna0: 5364 secs ago.................. -74 dBm
antenna1: 5364 secs ago.................. -87 dBm
AP-INDE-106(slot 0)
antenna0: 5364 secs ago.................. -67 dBm
antenna1: 5364 secs ago.................. -57 dBm
AP-INDE-106(slot 1)
antenna0: 5363 secs ago.................. -82 dBm
antenna1: 5363 secs ago.................. -87 dBm
AP-INDE-111(slot 0)
antenna0: 5364 secs ago.................. -94 dBm
antenna1: 5364 secs ago.................. -97 dBm
AP-INDE-119(slot 0)
antenna0: 5364 secs ago.................. -87 dBm
antenna1: 5364 secs ago.................. -91 dBm
AP-INDE-105(slot 0)
antenna0: 5364 secs ago.................. -68 dBm
antenna1: 5364 secs ago.................. -79 dBm
AP-INDE-105(slot 1)
antenna0: 5363 secs ago.................. -90 dBm
antenna1: 5363 secs ago.................. -87 dBm
AP-INDE-109(slot 0)
antenna0: 5364 secs ago.................. -75 dBm
antenna1: 5364 secs ago.................. -85 dBm
AP-INDE-109(slot 1)
antenna0: 5364 secs ago.................. -83 dBm
antenna1: 5364 secs ago.................. -78 dBm
AP-INDE-121(slot 0)
antenna0: 14490 secs ago................. -91 dBm
antenna1: 14490 secs ago................. -92 dBm
AP-INDE-126(slot 0)
antenna0: 8132 secs ago.................. -89 dBm
antenna1: 8132 secs ago.................. -92 dBm
AP-INDE-126(slot 1)
antenna0: 38197 secs ago................. -93 dBm
antenna1: 38197 secs ago................. -83 dBm
AP-INDE-116(slot 0)
antenna0: 5364 secs ago.................. -61 dBm
antenna1: 5364 secs ago.................. -50 dBm
AP-INDE-116(slot 1)
antenna0: 5364 secs ago.................. -82 dBm
antenna1: 5364 secs ago.................. -86 dBm
AP-INDE-112(slot 0)
antenna0: 5364 secs ago.................. -71 dBm
antenna1: 5364 secs ago.................. -71 dBm
AP-INDE-112(slot 1)
antenna0: 5364 secs ago.................. -88 dBm
antenna1: 5364 secs ago.................. -90 dBm
AP-INDE-107(slot 0)
antenna0: 8129 secs ago.................. -91 dBm
antenna1: 8129 secs ago.................. -85 dBm
AP-INDE-118(slot 0)
antenna0: 5364 secs ago.................. -94 dBm
antenna1: 5364 secs ago.................. -91 dBm
AP-INDE-114(slot 0)
antenna0: 5364 secs ago.................. -93 dBm
antenna1: 5364 secs ago.................. -85 dBm
AP-INDE-114(slot 1)
antenna0: 38197 secs ago................. -93 dBm
antenna1: 38197 secs ago................. -91 dBm
AP-INDE-123(slot 0)
antenna0: 5364 secs ago.................. -72 dBm
antenna1: 5364 secs ago.................. -83 dBm
AP-INDE-103(slot 0)
antenna0: 5364 secs ago.................. -91 dBm
antenna1: 5364 secs ago.................. -83 dBm
AP-INDE-104(slot 0)
antenna0: 5364 secs ago.................. -87 dBm
antenna1: 5364 secs ago.................. -90 dBm
AP-INDE-102(slot 0)
antenna0: 5364 secs ago.................. -90 dBm
antenna1: 5364 secs ago.................. -87 dBm
DNS Server details:
DNS server IP ............................. 0.0.0.0
DNS server IP ............................. 0.0.0.0
Assisted Roaming Prediction List details:
Client Dhcp Required: True
Allowed (URL)IP Addresses
(Cisco Controller) >show client detail ec:59:e7:e9:e5:68
Client MAC Address............................... ec:59:e7:e9:e5:68
Client Username ................................. N/A
AP MAC Address................................... 44:ad:d9:57:fd:20
AP Name.......................................... AP-INDE-106
AP radio slot Id................................. 0
Client State..................................... Associated
Client NAC OOB State............................. Access
Wireless LAN Id.................................. 1
Hotspot (802.11u)................................ Not Supported
BSSID............................................ 44:ad:d9:57:fd:20
Connected For ................................... 3043 secs
Channel.......................................... 11
IP Address....................................... 192.168.0.162
Gateway Address.................................. Unknown
Netmask.......................................... Unknown
Association Id................................... 4
Authentication Algorithm......................... Open System
Reason Code...................................... 1
Status Code...................................... 0
Session Timeout.................................. 15000
Client CCX version............................... No CCX support
QoS Level........................................ Silver
Avg data Rate.................................... 0
Burst data Rate.................................. 0
Avg Real time data Rate.......................... 0
Burst Real Time data Rate........................ 0
802.1P Priority Tag.............................. disabled
CTS Security Group Tag........................... Not Applicable
KTS CAC Capability............................... No
WMM Support...................................... Enabled
APSD ACs....................................... BK BE VI VO
Power Save....................................... ON
Current Rate..................................... m7
Supported Rates.................................. 5.5,11.0,6.0,9.0,12.0,18.0,
............................................. 24.0,36.0,48.0,54.0
Mobility State................................... Local
Mobility Move Count.............................. 0
Security Policy Completed........................ Yes
Policy Manager State............................. RUN
Policy Manager Rule Created...................... Yes
Audit Session ID................................. none
AAA Role Type.................................... none
Local Policy Applied............................. none
IPv4 ACL Name.................................... none
FlexConnect ACL Applied Status................... Unavailable
IPv4 ACL Applied Status.......................... Unavailable
IPv6 ACL Name.................................... none
IPv6 ACL Applied Status.......................... Unavailable
Layer2 ACL Name.................................. none
Layer2 ACL Applied Status........................ Unavailable
mDNS Status...................................... Disabled
mDNS Profile Name................................ none
No. of mDNS Services Advertised.................. 0
Policy Type...................................... N/A
Encryption Cipher................................ None
Protected Management Frame ...................... No
Management Frame Protection...................... No
EAP Type......................................... Unknown
FlexConnect Data Switching....................... Local
FlexConnect Dhcp Status.......................... Local
FlexConnect Vlan Based Central Switching......... No
FlexConnect Authentication....................... Central
Quarantine VLAN.................................. 0
Access VLAN...................................... 321
Client Capabilities:
CF Pollable................................ Not implemented
CF Poll Request............................ Not implemented
Short Preamble............................. Implemented
PBCC....................................... Not implemented
Channel Agility............................ Not implemented
Listen Interval............................ 1
Fast BSS Transition........................ Not implemented
Client Wifi Direct Capabilities:
WFD capable................................ No
Manged WFD capable......................... No
Cross Connection Capable................... No
Support Concurrent Operation............... No
Fast BSS Transition Details:
Client Statistics:
Number of Bytes Received................... 13499
Number of Bytes Sent....................... 7662
Total Number of Bytes Sent................. 7662
Total Number of Bytes Recv................. 13499
Number of Bytes Sent (last 90s)............ 0
Number of Bytes Recv (last 90s)............ 0
Number of Packets Received................. 184
Number of Packets Sent..................... 69
Number of Interim-Update Sent.............. 0
Number of EAP Id Request Msg Timeouts...... 0
Number of EAP Id Request Msg Failures...... 0
Number of EAP Request Msg Timeouts......... 0
Number of EAP Request Msg Failures......... 0
Number of EAP Key Msg Timeouts............. 0
Number of EAP Key Msg Failures............. 0
Number of Data Retries..................... 61
Number of RTS Retries...................... 0
Number of Duplicate Received Packets....... 2
Number of Decrypt Failed Packets........... 0
Number of Mic Failured Packets............. 0
Number of Mic Missing Packets.............. 0
Number of RA Packets Dropped............... 0
Number of Policy Errors.................... 0
Radio Signal Strength Indicator............ -70 dBm
Signal to Noise Ratio...................... 18 dB
Client Rate Limiting Statistics:
Number of Data Packets Recieved............ 0
Number of Data Rx Packets Dropped.......... 0
Number of Data Bytes Recieved.............. 0
Number of Data Rx Bytes Dropped............ 0
Number of Realtime Packets Recieved........ 0
Number of Realtime Rx Packets Dropped...... 0
Number of Realtime Bytes Recieved.......... 0
Number of Realtime Rx Bytes Dropped........ 0
Number of Data Packets Sent................ 0
Number of Data Tx Packets Dropped.......... 0
Number of Data Bytes Sent.................. 0
Number of Data Tx Bytes Dropped............ 0
Number of Realtime Packets Sent............ 0
Number of Realtime Tx Packets Dropped...... 0
Number of Realtime Bytes Sent.............. 0
Number of Realtime Tx Bytes Dropped........ 0
Nearby AP Statistics:
AP-INDE-120(slot 0)
antenna0: 36159 secs ago................. -98 dBm
antenna1: 36159 secs ago................. -97 dBm
AP-INDE-115(slot 0)
antenna0: 11075 secs ago................. -96 dBm
antenna1: 11075 secs ago................. -96 dBm
AP-INDE-108(slot 0)
antenna0: 188 secs ago................... -96 dBm
antenna1: 188 secs ago................... -95 dBm
AP-INDE-106(slot 0)
antenna0: 188 secs ago................... -78 dBm
antenna1: 188 secs ago................... -67 dBm
AP-INDE-111(slot 0)
antenna0: 1451 secs ago.................. -98 dBm
antenna1: 1451 secs ago.................. -95 dBm
AP-INDE-119(slot 0)
antenna0: 188 secs ago................... -87 dBm
antenna1: 188 secs ago................... -95 dBm
AP-INDE-122(slot 0)
antenna0: 73165 secs ago................. -95 dBm
antenna1: 73165 secs ago................. -95 dBm
AP-INDE-105(slot 0)
antenna0: 188 secs ago................... -85 dBm
antenna1: 188 secs ago................... -86 dBm
AP-INDE-109(slot 0)
antenna0: 332 secs ago................... -91 dBm
antenna1: 332 secs ago................... -89 dBm
AP-INDE-121(slot 0)
antenna0: 2708 secs ago.................. -98 dBm
antenna1: 2708 secs ago.................. -96 dBm
AP-INDE-126(slot 0)
antenna0: 215 secs ago................... -84 dBm
antenna1: 215 secs ago................... -86 dBm
AP-INDE-116(slot 0)
antenna0: 188 secs ago................... -61 dBm
antenna1: 188 secs ago................... -61 dBm
AP-INDE-112(slot 0)
antenna0: 187 secs ago................... -83 dBm
antenna1: 187 secs ago................... -85 dBm
AP-INDE-107(slot 0)
antenna0: 188 secs ago................... -89 dBm
antenna1: 188 secs ago................... -90 dBm
AP-INDE-118(slot 0)
antenna0: 188 secs ago................... -95 dBm
antenna1: 188 secs ago................... -98 dBm
AP-INDE-114(slot 0)
antenna0: 187 secs ago................... -83 dBm
antenna1: 187 secs ago................... -85 dBm
AP-INDE-113(slot 0)
antenna0: 38981 secs ago................. -94 dBm
antenna1: 38981 secs ago................. -95 dBm
AP-INDE-123(slot 0)
antenna0: 187 secs ago................... -73 dBm
antenna1: 187 secs ago................... -65 dBm
AP-INDE-117(slot 0)
antenna0: 11013 secs ago................. -94 dBm
antenna1: 11013 secs ago................. -97 dBm
AP-INDE-103(slot 0)
antenna0: 187 secs ago................... -70 dBm
antenna1: 187 secs ago................... -80 dBm
AP-INDE-104(slot 0)
antenna0: 214 secs ago................... -95 dBm
antenna1: 214 secs ago................... -91 dBm
AP-INDE-102(slot 0)
antenna0: 215 secs ago................... -87 dBm
antenna1: 215 secs ago................... -88 dBm
AP-INDE-100(slot 0)
antenna0: 11014 secs ago................. -96 dBm
antenna1: 11014 secs ago................. -96 dBm
AP-INDE-101(slot 0)
antenna0: 11013 secs ago................. -96 dBm
antenna1: 11013 secs ago................. -95 dBm
DNS Server details:
DNS server IP ............................. 0.0.0.0
DNS server IP ............................. 0.0.0.0
Assisted Roaming Prediction List details:
Client Dhcp Required: True
Allowed (URL)IP Addresses -
Catalyst 3750E's and DHCP Snooping
I am using on our perimeter Catalyst 3750E's and 4500 series switches and I have DHCP Snooping enabled. Each switch has redundant Layer 3 10Gb uplinks back to our Core/Distribution switches. We have a central DHCP server and each switch writes its snooping database back to a central TFTP server.
This was working fine until we upgraded our Active Directory domain to a 2008 domain, with our DHCP server now residing on a Windows 2008R2 server.
Since the upgrade all 12 stacks of 3750E's will no longer write of the dhcp snooping database.
show ip dhcp snooping database
Agent URL : tftp://<path>
Write delay Timer : 3600 seconds
Abort Timer : 300 seconds
Agent Running : No
Delay Timer Expiry : 17 (00:00:17)
Abort Timer Expiry : Not Running
Last Succeded Time : None
Last Failed Time : None
Last Failed Reason : No failure recorded.
Total Attempts : 0 Startup Failures : 0
Successful Transfers : 0 Failed Transfers : 0
Successful Reads : 0 Failed Reads : 0
Successful Writes : 0 Failed Writes : 0
Media Failures : 0
All of the 4500's (5 of them) however still work as they did prior to the upgrade.
show ip dhcp snooping database
Agent URL : tftp://<path>
Write delay Timer : 3600 seconds
Abort Timer : 60 seconds
Agent Running : No
Delay Timer Expiry : 2737 (00:45:37)
Abort Timer Expiry : Not Running
Last Succeded Time : 07:18:07 EDT Wed Jun 15 2011
Last Failed Time : None
Last Failed Reason : No failure recorded.
Total Attempts : 13 Startup Failures : 0
Successful Transfers : 13 Failed Transfers : 0
Successful Reads : 0 Failed Reads : 0
Successful Writes : 13 Failed Writes : 0
Media Failures : 0
Is this a software bug and has anybody else seen this after upgrading to a Windows 2008 AD domain?well i found this
When DHCP snooping is disabled and DAI is enabled, the switch shuts down all the hosts because all
ARP entries in the ARP table will be checked against a nonexistent DHCP database. When DHCP
snooping is disabled or in non-DHCP environments, use ARP ACLs to permit or to deny ARP packets
We dont do arp acl
Here is a little infor on the setup on 6500
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs: Q,W,E,RT,TY,Y
Insertion of option 82 is enabled
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
Interface Trusted Rate limit (pps)
GigabitEthernetX/X yes unlimited
Port-channel yes unlimited
port config port-channel
ip arp inspection trust
ip dhcp snooping trust
2960 config
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:Q
Insertion of option 82 is disabled
circuit-id default format: vlan-mod-port
remote-id: 1111:1111:1111 (MAC)
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:
Interface Trusted Allow option Rate limit (pps)
Port-channel yes yes unlimited
port config
interface Port-channel
ip arp inspection trust
ip dhcp snooping trust -
I am settting up DHCP snooping for the first time on an 3750. My DHCP server resides on another switch. The 3750 is connected through a Gig SFP fiber to a 3550 with DHCP relay.
Is the following config correct? The client will not get a dhcp with the option 82 enabled.
(config)#ip dhcp snooping
(config)#ip dhcp snooping vlan 2-200
(config)#no ip dhcp snooping info option
!The client will not get an ip with
!this option enabled.
! trusted interface connected to the 3550
(config)#int gi1/0/4
(config-if)#ip dhcp trust
! untrusted interface
(config-if)#ip dhcp limit rate 100
(config)#ip dhcp snooping database flash:/database1
(config)#ip dhcp snooping database timeout 30
(config)#ip dhcp snooping database write-delay 30Have you enabled option 82 on your DHCP server? Also, on your DHCP relay switch, configure the following under the VLAN interface in question and see if it makes any difference.
Example:
c3550-A(config)#int vlan 1
c3550-A(config-if)#ip dhcp relay information trusted ? -
FS300-24s, Enable IP DHCP Snooping
Hi everyone,
I have 5 sites with FS300-24 and i have a big problem with DHCP.
On the catalist switches is easy to enable DHCP snooping and Configure “trusted” DHCP ports.
Is there a way to configure this on fs300-24?
Any help would be appreciated.
AlbertHello
1) requires to active ip dhcp snooping the ip dhscp snooping vlan xx - Completed
2) if applied to one switch with uplinks switches, then the uplink switch will require snooping enabled also and its trunk links trusted ONLY if the dhcp server is originating from the uplink switch.- Completed
3) if dhcp server is attached to the same switch as the snooping database then just trust
the interface where the server is situated - Completed
FYI - As long as interfaces are trusted the snooping database does nothing else.
It listens on the the untrsuted ports and snoops the ip & macs.
Snooping database WILL NOT be populated with exisitng clients,
it will populate next time dhcp renews
res
Paul -
Can I use DHCP snooping and IOS DHCP server on the same switch stack
Hello,
I am shortly going to be deploying a Cisco CallManager solution for a customer whose network comprises stacks of Catalyst 3850 switches.
There is no separate core/server farm switch so the CallManager servers, voice gateways and IP phones will all plug into the same stack and be in the same VLAN (not my choice!).
For security we want to enable DHCP snooping and were planning on using the IOS DHCP server on the Catalyst switch stack.
Will this work? - when I enable DHCP snooping in networks with separate access layer switches I set the uplinks to the core as trusted links.
I am not sure whether DHCP snooping will work in this case. Do I need to set the VLAN interface on the switch as trusted, is this even possible?
Unfortunately I do not have access to a layer 3 switch to test this at the moment.
ThanksNope. That's the issue.
They'll sync on a third device acting as a hotspot, but the device sending a signal is not "on" the network it creates so the airport is all by itself on that network. At least that is what it looks like to me. Anyone have another take on it? Seems pretty silly that an iPad can put out a wifi signal, an Airport Express can receive a wifi signal, and yet there is no simple way to get them to communicate under this particular condition. -
Hi all,
The ISE configuration validator says we should have DHCP snooping enabled on our network access devices (switches) so we do it. However I have never understood what this accomplishes. (In terms of ISE/NAC. I understand what DHCP snooping is).
Can anyone explain? Thanks.Thanks for the reply, Vattulu.
Interesting article/section, but I don't see where it says anything about the relationship between dhcp snooping and profiling. It seems to be talking about the use of dhcp snooping option 82 to convey the 802.1x user info to the dhcp server. The dhcp server can then act on this information to assign specific IPs to specific users. I can see how ISE would get this information via ip-helper or maybe by snmp bulk query, but don't understand how that would assist with profiling. I mean, ISE already has the 802.1x user identity from the radius request, right? Maybe you can enlighten me.
Googling around I found this article/section:
http://www.cisco.com/c/en/us/td/docs/security/ise/1-1-1/user_guide/ise_user_guide/ise_sw_cnfg.html#wp1059679
which seems to imply that dhcp snooping info can be used when applying DACLs. Interesting, because I thought that was based on the ip device tracking table only. But, it says that dhcp snooping is optional, and doesn't go into any detail.
Still digging, I would like to understand this. Thanks for your help.
Maybe you are looking for
-
Image down to a Surface Pro with Windows 8.1 Enterprise use PXE fails at Driver Pack Install
I am using SCCM 2012 SP1 running on windows server 2008 R2 deploying to windows Surface Pro, I am deploying Windows 8.1 Enterprise using PXE. It gets the pxe response, formats the HD, deploys the image, downloads the driver package, but when it insta
-
Hello, I use Photoshop CS6 on a 2009 MacBook Pro and it runs great. I have 8GB of RAM I am going to be purchasing a 27" iMac soon, but i have heard there are a lot of problems with Photoshop and Mavericks working together. I am a computer novice so i
-
Hi experts, I have the next situation I hope you can help me. I have an interface SOAP->PI->RFC. I'm working in PI 7.1 When I create the WSLD in the ID I have 2 options. First, I can create the WSLD with the wisard Tools->Display WSDL. In this case I
-
Hi All, I am trying to upload 2LIS_02_SCL data, I am trying to refresh the entire data using Init, it is taking lot of time in Prodcution. This is creating the problem for me for next Back ground Job which runs in the night for delta's. Please can an
-
KeyBoard Layout on Macbook Pro
Hi I have one of those silly questions regarding keyboard layout. I have picked up a 2010 Macbook pro (first mac I have had) that had been purchased overseas. It is absolutely in immaculate condition but the layout of the keyboard is a bit of a pain.