SGE2010P - DHCP Relay - offer packet not reaching host

I have an SGE2010P in L3 mode. I set up 2 vlans, 1 & 5. Vlan 1 has an interface of 10.0.3.252; Vlan 5 is at 10.0.10.9. I have defined the DHCP at 10.0.3.4 (on vlan 1) and enabled DHCP Interface for vlan 5. Put switch port g28 in access mode on vlan 5 and connected client machine. Set up wireshark on both DHCP a server and client. DHCP server is receiving the DHCP discovery packet with the correct relay agent address (10.0.10.9), and it sends back an offer packet to that address, but it is never received by the host machine. What am I missing?

Hello,
DHCP server typically is on subnet of one of the switch IP interface. Thus there si no need to indicate where the server is however you have to indicate from which VLAN DHCP requests are relayed. For example:
VLAN 1 - switch IP 192.168.1.25/24
DHCP server is on VLAN 1 with IP 192.168.1.1/24
Other VLANs:
VLAN 5 IP address 192.168.5.254/24
VLAN 10 IP address 192.168.10.254/24
enabling DHP relay from VLAN 5 and VLAN 10 is required.
Please check IF you have IP addresses on the switch of other VLANs 5 and 10
Regards,
Aleksandra

Similar Messages

  • Erreur:sapgui640 partner not reached(host 127.0.0.1 service sapdp00)

    I am a beginner on SAP R/3 .
    my laptop configuration is: windows xp média center
    1.86Ghz 1G de Ram 80G de HDD.
    I have installed all those thing -Full download includes SAPGUI (2 files 1.5GB, 1.25GB)
    -Download SAPGUI only! (342 MB)
    - Installation Guide (PDF 1.32 MB)
    my laptop is not connected to a Lan;when I try to launch my first connexion on
    sap with a user account  I have the following message:
    erreur:sapgui640
    partner not reached(host 127.0.0.1 service sapdp00)
    wsaeconnrefused:connection refused
    thanks in advance for your help

    Hi,
    Have you installed MS Loopback Adapter? If not do so. You need it, if you are not connected to a LAN. For instructions how to install and cofigure it have a look at install help which is included in the dowload.
    Regards
    Daniel

  • TCP / UDP packets not reaching destination

    Hi all,
    I have an ASR at the hub of 3 different routing domains.
    I have two OSPF processes and one BGP process all on the same ASR.
    BGP routes are redistributed in to both OSPF processes and vice versa. Plus, between the two OSPF processes, routes are also redistributed. Summary addresses are configured at the ASBR before the routes are injected in to Area 0 on each OSPF process.
    ICMP from a source host in one OSPF process to a destination in the BGP process works fine, but any TCP traffic hangs awaiting a SYN/ACK.
    I need to prove that the router is routing the packet toward the egress interface and that the packet is leaving the router. I was wondering if there were any debug commands that I can restrict to a particular host IP so that it does not bring the router down.
    I know about Embedded Packet Capture, but unfortunately the IOS-XE version that I am running is not new enough so we do not have EPC on our ASR.
    I appreciate that I have given only limited information.
    Any advice appreciated.
    Thanks
    Mario

    Mario
    If you don't want to risk debug then i always used a basic but pretty reliable method ie. acls.
    If you create an extended acl with the first line allowing the source IP of the host to any and then a second line with a "permit ip any any" and then apply it outbound to the egress interface it should show if the packets are being routed correctly and sent on towards the destination. 
    Obviously the "permit ip any any" line is very important
    Edit - i haven't used the ASRs so it is possible they process all their acls in hardware in which case the hits may not show as they don't always on L3 switches that process acls in hardware.
    So bear that in mind.
    Jon

  • DHCP Relay Cisco SG500X

    Hi, 
    I've create 2 vlan in a cisco SG500X-24 and a DHCP server on vlan 2. I just want to dhcp server assign ip to devices on vlan 3. I've configured the vlan and dhcp server relay commands.
    ip dhcp relay address 192.168.1.11
    ip dhcp relay enable
    ip dhcp information option
    interface vlan 2                                      
     ip address 192.168.1.250 255.255.255.0
    interface vlan 3
     ip address 192.168.51.254 255.255.255.0
     ip dhcp relay enable
    The dhcp server gets the request from pc, and sends a new address, but the offer packet not comes to device. With Wireshark a see like offer dhcp packet can't jump to vlan 3.
    It's the first time a work with SMB series, and this never happens with catalyst. I'm turning crazy.
    Anyone can help me? Thank you in advances.
    Victor.

    Hi,
    Yes, also I configured ip dhcp relay on intefaces.
    Yesterday I found the trouble. I was using the tftpd32 dhcp server, and I tested with a Windows DHCP server and everything works like a champ. I didn't know what have do, and i turned crazy, so I began to change every element on solution, finally the DHCP server that it was the key.
    Thank you so much for your answer.
    KR!

  • ABAP Objects -  Sapgui 46D - Partner not reached

    I’m a starter, completely new to SAP ABAP Objects.
    Just installed the 2 CD’s delivered with the book “ABAP Objects” from Horst Keller and Sascha Krüger.
    Installed on a stand alone portable Windows XP Pro service pack 2.
    No other links to SAP or internet.
    First I start “Start SAP MBS”, is OK
    Then start “SAP Logon 46D”
    After the selection of a “Description” I get the following error message.
    Partner not reached (host localhost, service sapdp00)
    Time
    Release     46D
    Component     NI(network interface)
    Version     34
    Return Code     -10
    Module     ninti.c
    Line          1008
    Detail          NiPConnect2
    System Call     SO_ERROR
    Error NO     10061
    Error Text     WSAECONNREFUSED. Connection refused
    Counter     1
    Can some one explain me what is need in solving this problem. (I’m completely new in SAP)
    For the moment I could not find a simple explanation on how to solve this.

    if you look at the installation documentation in the CD there is a prerequisites which will require to you to configure the MS loop back adapter by entering a specific IP address. check out the documentation in the CD.
    Regards
    Raja
    When you have the latest ABAP NW2004s available for download in SDN why do you want to go for the old one. Unless otherwise there is any specific reason i would strongly suggest you to download the latest minisap (SAP netweaver sneakpreview ABAP NW2004s )

  • SAP Netweaver 2004s Sneak Preview - Partner not reached

    Hi all,
    I've tried to search the forum for similar message but couln't find it so I post a new one, hopefully someone able to give some help.
    I've installed the SAPNW sneak preview ABAP on XP, right after installation I'm able to logon to NSP system. But once I shutdown the computer and turn it on again, I won't be able to access the NSP.
    The error message:
    "partner not reached (host 127.0.0.1, service sapdp00)
    WSAECONNREFUSED: connection refused
    I'm not sure what happened, btw:
    1. I have installed the MS loopback adapter
    2. I've check the C:\windows\system32\drivers\etc\hosts & services file. Looks ok, I put them below for your reference
    3. I've check the services,SAPNSP_00 & SAPDB: NSP are running
    Is there anything need to be setup? Thanks a lot
    C:\WINDOWS\system32\drivers\etc\services
    sapdp00          3200/tcp
    sapdp01          3201/tcp
    sapdp02          3202/tcp
    sapdp03          3203/tcp
    sapdp04          3204/tcp
    sapdp05          3205/tcp
    sapdp06          3206/tcp
    sapdp07          3207/tcp
    sapdp08          3208/tcp
    sapdp09          3209/tcp
    sapdp10          3210/tcp
    sapdp11          3211/tcp
    sapdp12          3212/tcp
    sapdp13          3213/tcp
    sapdp14          3214/tcp
    sapdp15          3215/tcp
    C:\WINDOWS\system32\drivers\etc\hosts
    127.0.0.1       localhost

    Hi
    Try
    #127.0.0.1 localhost
    127.0.0.1 <computer name>
    If the computer name is ABC but a reverse lookup returned “localhost”. This will lead to problem later on when starting the web application server.You can correct this problem by inserting a line ‘127.0.0.1  ABC’ into the host file.
    Thanks
    Prince

  • Sapgui640 partner not reached (host127.0.0.1service sapdp00)

    hi everybody,I really need a help.I am a beginner on SAP world;
    my laptop settings:
    -microsoft Win XP Média center Edition ver2002-service Pack2
    -packardbell centrino-intel 1.86ghz 1Go de Ram
    SAP LOGON640
    designation:NSP
    application server:localhost
    ID system:NSP
    system number:00
    sAP system:R3
    my laptop is standalone one therefore I don't have a network at home.when I try
    to logon saplogon640 I get this error message:
    sapgui 640
    partner not reached
    (host 127.0.0.1,service sapdp00
    wsaeconnrefused:connection refused
    (further informations)
    component NI(network interface)
    release 640
    version37
    module:nixxi_r.ccp
    line8688
    method:nipconnect2
    return code-10
    system call:sipeck pendconn
    error no:10061
    error text:wsaeconnrefused:cxion refused
    please if anyone has already got this matter thanks in advance about your help

    I think its a problem with some firewall or the AV, because when i have running avast in my pc appears the same error message and when i shut down the avast i have no problems, also there are too much post like this one with no solution, admins put an eye right there, because many of this is not listed in documentation file, or i think so, are not listed problems like this one.
    If someone knows something, ill be glad to read it, and see if its causing the problem the av or what it is, i tell u one more think, my win firewall its also down, im using xp home sp3 and it works properly when the av is not running, thanks

  • Cisco 300 - VLAN DHCP packets not passing

    I am seeing a problem with our Cisco 300 switches. We use these switches as access switches, with a stacked 3750-G at the core, two 2960-S at the distribution layer, and about 10 300 Series switches at the access layer (10 port and 28 ports, all PoE).
    We use Voice VLAN (VLAN 14) for our Mitel phones – there is a DHCP server on the Mitel system. Phones come up, get tagged VLAN 14 (LLDP), Traffic flows (including Broadcast for DHCP etc…). The system works, and has worked for months.
    One day, suddenly, I find that all the Mitel phones on a particular access switch are not working. I look on the Mitel system and the lease on DHCP has expired, and the phone is stuck on renewing its DHCP IP address. I run port mirroring on the switch for VLAN 14 to see what is happening. The phones are stuck on DHCP discover, and I see the DHCP Discover broadcast packets on the switch but nothing else, no DHCP offer packets – hence the phone stuck at boot cycle.
    I then do a port mirror from another access switch (that is currently working) – I can see the broadcast packets from the Mitel phones on the broken switch, but on this switch I can also see the DHCP offer packets from the Mitel system. I run two port mirrors simultaneous from the two switches (one working, one not) and I can see that the DHCP offer packets are not coming through to the broken switch. Panic ensues – I look at the distribution layer and there is no problem what so ever.
    For some strange reason, the Cisco 300 28 port has stopped passing DHCP broadcast packets on a particular VLAN, even though they are being sent. I power cycle the switch – and hey presto, DHCP offer packets are coming through, and the phones get an IP address and boot properly.
    I wipe the sweat off my brow, note the issue down and carry on my daily duties.
    Forward a couple of weeks later, and to today. I have another phone that is showing the same symptoms, luckily it is the only phone on this particular Cisco 300 28 port. The same issue is occurring as described above. I gather as much diagnostic information I can then reboot the switch – but still no joy. I then remember that this switch is not directly attached to the distribution layer and instead gets trunked to another Cisco 300 28 port. I give that a reboot and 5 minutes later, DHCP broadcast offers are passing and the phone boots.
    I am listing this problem as not just a ‘one off’ now, and is recurring. It has happened to two of my 300 28 port switches.
    All Switches running 1.1.2.0.
    No link to up time – first instance of the problem, switch was up for 14 days – second instance (another switch) uptime of 39 days
    LLDP is working fine on the switches, as is Voice-VLAN (Port is tagged and broadcasts out DHCP Discover which is seen by other devices throughout network)
    Nothing in the log file on the access switch
    Nothing on the Dist/Core regarding STP – Spanning tree set up is fine throughout
    Has anyone else experienced same? I’m hoping this is a bug that is getting fixed.
    Many Thanks
    Tim

    Hello Tim
    Brayton Hackworth had a similar post as yours, found here;
    https://supportforums.cisco.com/message/3684179#3684179
    Brayton is using the Mitel 5330 phones where the LLDP no longer fed VLAN information to the phone network. But, he reverted to use a DHCP server to provide the VLAN information.
    Unfortunately, I (personally) cannot test any Mitel resources (since I don't have them) so my labs usually only consist of either 7900 series or SPA500/900 series phones.
    The best thing I can really recommend to you is to make a package of data consisting of;
    Topology which consists of;
    Modem type
    Router including IP
    All devices including IP of switches
    Servers / relevant workstations
    # of attached devices and # of users on the LAN
    Switch config file + show tech on a notepad
    Syslog output from the switch
    Working PCAP
    PCAP showing failure
    PCAP legend showing what IP address are who (unless topology contains all IP)
    Where the PCAP is taken from and method
    We then can create a service request for you and pass it for review.
    -Tom

  • Some dhcp clients not reaching internet

    This afternoon, I noticed that my iPhone was no longer reaching the internet. Later, we noticed my husband's (new!) iPad and my son's MacBook were not reaching the internet either. At least my MacBook was still reaching the internet. In all cases, the connectivity with the airport was fine; 4-5 bars, most of the time. All were connected yesterday, I believe. We made no real changes. I had my iPhone right next to my MacBook and both had good connections to the wifi, but only the MacBook was reaching the Internet.
    I went into Airport Utility and looked at the Time Capsule and found a long list under DHCP clients (maybe 9), but only 4 on the wireless clients list. I researched the issue, finding very little except generic suggestions (update software and reset the Time Capsule). The software was up to date; resetting it did fix the problem, at least for now. I am concerned it will happen again.
    Our airport devices:
    - Time Capsule running 7.5.2
    - 2 Airport Expresses, also running 7.5.2.
    Most, if not all, our wifi devices are up to date, including my MacBook running 10.6.5 and my iPhone running 4.2.1.

    I'm not sure this is quite the same since simply restarting our Time Capsule fixed things for us. It is annoying since I don't want to have to restart the Time Capsule every week or so when it fails this way, but restarted did fix this, at least temporarily.
    Another possibility I came across is that an ISP might limit the number of devices you can connect to the Time Capsule, but that wasn't the case for us. I'm thinking the Apple person you talked to probably checked on this, though.
    Hope you can figure it out!
    - Liz, aka liz4cps

  • Sonicwall DHCP relay not working

    I recently set up a new vlan and am trying to get the dhcp server on the existing vlan to issue IPs.  I have no trouble getting dhcp working with the sonicwall as the server, but I can't get it to pass it along to the actual server.  I've set up the IP of the server as a trusted DHCP relay host but I don't see anything in the logs for the relay for the test host on the vlan. I tagged the port the server is connected to for the new vlan so I'm lost as to why it isn't working. DNS also isn't working using that server for the lookup.  I am able to ping it by IP though. I'm sure it's something simple I'm missing but vlans are new to me so I'm still learning.
    This topic first appeared in the Spiceworks Community

    I recently set up a new vlan and am trying to get the dhcp server on the existing vlan to issue IPs.  I have no trouble getting dhcp working with the sonicwall as the server, but I can't get it to pass it along to the actual server.  I've set up the IP of the server as a trusted DHCP relay host but I don't see anything in the logs for the relay for the test host on the vlan. I tagged the port the server is connected to for the new vlan so I'm lost as to why it isn't working. DNS also isn't working using that server for the lookup.  I am able to ping it by IP though. I'm sure it's something simple I'm missing but vlans are new to me so I'm still learning.
    This topic first appeared in the Spiceworks Community

  • DHCP Relay forwarded to Secondary when Scope is not available in Primaray

    Two ip helper-addresses (let suppose DHCPServer1 and DHCPServer2) are defined on each of the branch router, and customer want to divide the load of DHCP request on two different DHCP Servers. The propose solution by customer is to disable some scope from one DHCP Server (DHCPServer1) and define the similar scope in second DHCP Server (DHCPServer2). Does the DHCP Relay request would be forwarded to secondary server (DHCPServer2), if the scope is disabled on first DHCP Server (DHCPServer1)?

    The DHCP request is forwarded to all the addresses defined with the ip helper-address command.
    So if you have 2 ip helper-addresses then the DHCP request is sent to both at the same time by the router. First one to respond is usually the one accepted by the client.
    Jon

  • Dnsmasq, dhclient and not working host block file

    I have this setup according to that thread:
    https://bbs.archlinux.org/viewtopic.php?id=139784&p=1
    I followed wiki on dnsmasq, I set up dhclient.conf accordingly, and still the host file does not get read and all websites are riddled with ad banners.
    Here are my config files:
    /etc/dnsmasq.conf
    # Configuration file for dnsmasq.
    # Format is one option per line, legal options are the same
    # as the long options legal on the command line. See
    # "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.
    # Listen on this specific port instead of the standard DNS port
    # (53). Setting this to zero completely disables DNS function,
    # leaving only DHCP and/or TFTP.
    #port=5353
    # The following two options make you a better netizen, since they
    # tell dnsmasq to filter out queries which the public DNS cannot
    # answer, and which load the servers (especially the root servers)
    # unnecessarily. If you have a dial-on-demand link they also stop
    # these requests from bringing up the link unnecessarily.
    # Never forward plain names (without a dot or domain part)
    #domain-needed
    # Never forward addresses in the non-routed address spaces.
    #bogus-priv
    # Uncomment this to filter useless windows-originated DNS requests
    # which can trigger dial-on-demand links needlessly.
    # Note that (amongst other things) this blocks all SRV requests,
    # so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk.
    # This option only affects forwarding, SRV records originating for
    # dnsmasq (via srv-host= lines) are not suppressed by it.
    #filterwin2k
    # Change this line if you want dns to get its upstream servers from
    # somewhere other that /etc/resolv.conf
    #resolv-file=
    # By default, dnsmasq will send queries to any of the upstream
    # servers it knows about and tries to favour servers to are known
    # to be up. Uncommenting this forces dnsmasq to try each query
    # with each server strictly in the order they appear in
    # /etc/resolv.conf
    #strict-order
    # If you don't want dnsmasq to read /etc/resolv.conf or any other
    # file, getting its servers from this file instead (see below), then
    # uncomment this.
    #no-resolv
    # If you don't want dnsmasq to poll /etc/resolv.conf or other resolv
    # files for changes and re-read them then uncomment this.
    #no-poll
    # Add other name servers here, with domain specs if they are for
    # non-public domains.
    #server=/localnet/192.168.0.1
    # Example of routing PTR queries to nameservers: this will send all
    # address->name queries for 192.168.3/24 to nameserver 10.1.2.3
    #server=/3.168.192.in-addr.arpa/10.1.2.3
    # Add local-only domains here, queries in these domains are answered
    # from /etc/hosts or DHCP only.
    #local=/localnet/
    # Add domains which you want to force to an IP address here.
    # The example below send any host in double-click.net to a local
    # web-server.
    #address=/double-click.net/127.0.0.1
    # --address (and --server) work with IPv6 addresses too.
    #address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83
    # You can control how dnsmasq talks to a server: this forces
    # queries to 10.1.2.3 to be routed via eth1
    # server=10.1.2.3@eth1
    # and this sets the source (ie local) address used to talk to
    # 10.1.2.3 to 192.168.1.1 port 55 (there must be a interface with that
    # IP on the machine, obviously).
    # [email protected]#55
    # If you want dnsmasq to change uid and gid to something other
    # than the default, edit the following lines.
    #user=
    #group=
    # If you want dnsmasq to listen for DHCP and DNS requests only on
    # specified interfaces (and the loopback) give the name of the
    # interface (eg eth0) here.
    # Repeat the line for more than one interface.
    #interface=
    # Or you can specify which interface _not_ to listen on
    #except-interface=
    # Or which to listen on by address (remember to include 127.0.0.1 if
    # you use this.)
    listen-address=127.0.0.1
    # If you want dnsmasq to provide only DNS service on an interface,
    # configure it as shown above, and then use the following line to
    # disable DHCP and TFTP on it.
    #no-dhcp-interface=
    # On systems which support it, dnsmasq binds the wildcard address,
    # even when it is listening on only some interfaces. It then discards
    # requests that it shouldn't reply to. This has the advantage of
    # working even when interfaces come and go and change address. If you
    # want dnsmasq to really bind only the interfaces it is listening on,
    # uncomment this option. About the only time you may need this is when
    # running another nameserver on the same machine.
    #bind-interfaces
    # If you don't want dnsmasq to read /etc/hosts, uncomment the
    # following line.
    #no-hosts
    # or if you want it to read another file, as well as /etc/hosts, use
    # this.
    addn-hosts=/etc/hosts.block
    # Set this (and domain: see below) if you want to have a domain
    # automatically added to simple names in a hosts-file.
    #expand-hosts
    # Set the domain for dnsmasq. this is optional, but if it is set, it
    # does the following things.
    # 1) Allows DHCP hosts to have fully qualified domain names, as long
    # as the domain part matches this setting.
    # 2) Sets the "domain" DHCP option thereby potentially setting the
    # domain of all systems configured by DHCP
    # 3) Provides the domain part for "expand-hosts"
    #domain=thekelleys.org.uk
    # Set a different domain for a particular subnet
    #domain=wireless.thekelleys.org.uk,192.168.2.0/24
    # Same idea, but range rather then subnet
    #domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200
    # Uncomment this to enable the integrated DHCP server, you need
    # to supply the range of addresses available for lease and optionally
    # a lease time. If you have more than one network, you will need to
    # repeat this for each network on which you want to supply DHCP
    # service.
    #dhcp-range=192.168.0.50,192.168.0.150,12h
    # This is an example of a DHCP range where the netmask is given. This
    # is needed for networks we reach the dnsmasq DHCP server via a relay
    # agent. If you don't know what a DHCP relay agent is, you probably
    # don't need to worry about this.
    #dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h
    # This is an example of a DHCP range which sets a tag, so that
    # some DHCP options may be set only for this network.
    #dhcp-range=set:red,192.168.0.50,192.168.0.150
    # Use this DHCP range only when the tag "green" is set.
    #dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h
    # Specify a subnet which can't be used for dynamic address allocation,
    # is available for hosts with matching --dhcp-host lines. Note that
    # dhcp-host declarations will be ignored unless there is a dhcp-range
    # of some type for the subnet in question.
    # In this case the netmask is implied (it comes from the network
    # configuration on the machine running dnsmasq) it is possible to give
    # an explicit netmask instead.
    #dhcp-range=192.168.0.0,static
    # Enable DHCPv6. Note that the prefix-length does not need to be specified
    # and defaults to 64 if missing/
    #dhcp-range=1234::2, 1234::500, 64, 12h
    # Do Router Advertisements, BUT NOT DHCP for this subnet.
    #dhcp-range=1234::, ra-only
    # Do Router Advertisements, BUT NOT DHCP for this subnet, also try and
    # add names to the DNS for the IPv6 address of SLAAC-configured dual-stack
    # hosts. Use the DHCPv4 lease to derive the name, network segment and
    # MAC address and assume that the host will also have an
    # IPv6 address calculated using the SLAAC alogrithm.
    #dhcp-range=1234::, ra-names
    # Do Router Advertisements, BUT NOT DHCP for this subnet.
    # Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.)
    #dhcp-range=1234::, ra-only, 48h
    # Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA
    # so that clients can use SLAAC addresses as well as DHCP ones.
    #dhcp-range=1234::2, 1234::500, slaac
    # Do Router Advertisements and stateless DHCP for this subnet. Clients will
    # not get addresses from DHCP, but they will get other configuration information.
    # They will use SLAAC for addresses.
    #dhcp-range=1234::, ra-stateless
    # Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses
    # from DHCPv4 leases.
    #dhcp-range=1234::, ra-stateless, ra-names
    # Do router advertisements for all subnets where we're doing DHCPv6
    # Unless overriden by ra-stateless, ra-names, et al, the router
    # advertisements will have the M and O bits set, so that the clients
    # get addresses and configuration from DHCPv6, and the A bit reset, so the
    # clients don't use SLAAC addresses.
    #enable-ra
    # Supply parameters for specified hosts using DHCP. There are lots
    # of valid alternatives, so we will give examples of each. Note that
    # IP addresses DO NOT have to be in the range given above, they just
    # need to be on the same network. The order of the parameters in these
    # do not matter, it's permissible to give name, address and MAC in any
    # order.
    # Always allocate the host with Ethernet address 11:22:33:44:55:66
    # The IP address 192.168.0.60
    #dhcp-host=11:22:33:44:55:66,192.168.0.60
    # Always set the name of the host with hardware address
    # 11:22:33:44:55:66 to be "fred"
    #dhcp-host=11:22:33:44:55:66,fred
    # Always give the host with Ethernet address 11:22:33:44:55:66
    # the name fred and IP address 192.168.0.60 and lease time 45 minutes
    #dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m
    # Give a host with Ethernet address 11:22:33:44:55:66 or
    # 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume
    # that these two Ethernet interfaces will never be in use at the same
    # time, and give the IP address to the second, even if it is already
    # in use by the first. Useful for laptops with wired and wireless
    # addresses.
    #dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60
    # Give the machine which says its name is "bert" IP address
    # 192.168.0.70 and an infinite lease
    #dhcp-host=bert,192.168.0.70,infinite
    # Always give the host with client identifier 01:02:02:04
    # the IP address 192.168.0.60
    #dhcp-host=id:01:02:02:04,192.168.0.60
    # Always give the host with client identifier "marjorie"
    # the IP address 192.168.0.60
    #dhcp-host=id:marjorie,192.168.0.60
    # Enable the address given for "judge" in /etc/hosts
    # to be given to a machine presenting the name "judge" when
    # it asks for a DHCP lease.
    #dhcp-host=judge
    # Never offer DHCP service to a machine whose Ethernet
    # address is 11:22:33:44:55:66
    #dhcp-host=11:22:33:44:55:66,ignore
    # Ignore any client-id presented by the machine with Ethernet
    # address 11:22:33:44:55:66. This is useful to prevent a machine
    # being treated differently when running under different OS's or
    # between PXE boot and OS boot.
    #dhcp-host=11:22:33:44:55:66,id:*
    # Send extra options which are tagged as "red" to
    # the machine with Ethernet address 11:22:33:44:55:66
    #dhcp-host=11:22:33:44:55:66,set:red
    # Send extra options which are tagged as "red" to
    # any machine with Ethernet address starting 11:22:33:
    #dhcp-host=11:22:33:*:*:*,set:red
    # Give a fixed IPv6 address and name to client with
    # DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2
    # Note the MAC addresses CANNOT be used to identify DHCPv6 clients.
    # Note also the they [] around the IPv6 address are obilgatory.
    #dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5]
    # Ignore any clients which are not specified in dhcp-host lines
    # or /etc/ethers. Equivalent to ISC "deny unknown-clients".
    # This relies on the special "known" tag which is set when
    # a host is matched.
    #dhcp-ignore=tag:!known
    # Send extra options which are tagged as "red" to any machine whose
    # DHCP vendorclass string includes the substring "Linux"
    #dhcp-vendorclass=set:red,Linux
    # Send extra options which are tagged as "red" to any machine one
    # of whose DHCP userclass strings includes the substring "accounts"
    #dhcp-userclass=set:red,accounts
    # Send extra options which are tagged as "red" to any machine whose
    # MAC address matches the pattern.
    #dhcp-mac=set:red,00:60:8C:*:*:*
    # If this line is uncommented, dnsmasq will read /etc/ethers and act
    # on the ethernet-address/IP pairs found there just as if they had
    # been given as --dhcp-host options. Useful if you keep
    # MAC-address/host mappings there for other purposes.
    #read-ethers
    # Send options to hosts which ask for a DHCP lease.
    # See RFC 2132 for details of available options.
    # Common options can be given to dnsmasq by name:
    # run "dnsmasq --help dhcp" to get a list.
    # Note that all the common settings, such as netmask and
    # broadcast address, DNS server and default route, are given
    # sane defaults by dnsmasq. You very likely will not need
    # any dhcp-options. If you use Windows clients and Samba, there
    # are some options which are recommended, they are detailed at the
    # end of this section.
    # Override the default route supplied by dnsmasq, which assumes the
    # router is the same machine as the one running dnsmasq.
    #dhcp-option=3,1.2.3.4
    # Do the same thing, but using the option name
    #dhcp-option=option:router,1.2.3.4
    # Override the default route supplied by dnsmasq and send no default
    # route at all. Note that this only works for the options sent by
    # default (1, 3, 6, 12, 28) the same line will send a zero-length option
    # for all other option numbers.
    #dhcp-option=3
    # Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5
    #dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
    # Send DHCPv6 option. Note [] around IPv6 addresses.
    #dhcp-option=option6:dns-server,[1234::77],[1234::88]
    # Send DHCPv6 option for namservers as the machine running
    # dnsmasq and another.
    #dhcp-option=option6:dns-server,[::],[1234::88]
    # Ask client to poll for option changes every six hours. (RFC4242)
    #dhcp-option=option6:information-refresh-time,6h
    # Set the NTP time server address to be the same machine as
    # is running dnsmasq
    #dhcp-option=42,0.0.0.0
    # Set the NIS domain name to "welly"
    #dhcp-option=40,welly
    # Set the default time-to-live to 50
    #dhcp-option=23,50
    # Set the "all subnets are local" flag
    #dhcp-option=27,1
    # Send the etherboot magic flag and then etherboot options (a string).
    #dhcp-option=128,e4:45:74:68:00:00
    #dhcp-option=129,NIC=eepro100
    # Specify an option which will only be sent to the "red" network
    # (see dhcp-range for the declaration of the "red" network)
    # Note that the tag: part must precede the option: part.
    #dhcp-option = tag:red, option:ntp-server, 192.168.1.1
    # The following DHCP options set up dnsmasq in the same way as is specified
    # for the ISC dhcpcd in
    # http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
    # adapted for a typical dnsmasq installation where the host running
    # dnsmasq is also the host running samba.
    # you may want to uncomment some or all of them if you use
    # Windows clients and Samba.
    #dhcp-option=19,0 # option ip-forwarding off
    #dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
    #dhcp-option=45,0.0.0.0 # netbios datagram distribution server
    #dhcp-option=46,8 # netbios node type
    # Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.
    #dhcp-option=252,"\n"
    # Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client
    # probably doesn't support this......
    #dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com
    # Send RFC-3442 classless static routes (note the netmask encoding)
    #dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8
    # Send vendor-class specific options encapsulated in DHCP option 43.
    # The meaning of the options is defined by the vendor-class so
    # options are sent only when the client supplied vendor class
    # matches the class given here. (A substring match is OK, so "MSFT"
    # matches "MSFT" and "MSFT 5.0"). This example sets the
    # mtftp address to 0.0.0.0 for PXEClients.
    #dhcp-option=vendor:PXEClient,1,0.0.0.0
    # Send microsoft-specific option to tell windows to release the DHCP lease
    # when it shuts down. Note the "i" flag, to tell dnsmasq to send the
    # value as a four-byte integer - that's what microsoft wants. See
    # http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true
    #dhcp-option=vendor:MSFT,2,1i
    # Send the Encapsulated-vendor-class ID needed by some configurations of
    # Etherboot to allow is to recognise the DHCP server.
    #dhcp-option=vendor:Etherboot,60,"Etherboot"
    # Send options to PXELinux. Note that we need to send the options even
    # though they don't appear in the parameter request list, so we need
    # to use dhcp-option-force here.
    # See http://syslinux.zytor.com/pxe.php#special for details.
    # Magic number - needed before anything else is recognised
    #dhcp-option-force=208,f1:00:74:7e
    # Configuration file name
    #dhcp-option-force=209,configs/common
    # Path prefix
    #dhcp-option-force=210,/tftpboot/pxelinux/files/
    # Reboot time. (Note 'i' to send 32-bit value)
    #dhcp-option-force=211,30i
    # Set the boot filename for netboot/PXE. You will only need
    # this is you want to boot machines over the network and you will need
    # a TFTP server; either dnsmasq's built in TFTP server or an
    # external one. (See below for how to enable the TFTP server.)
    #dhcp-boot=pxelinux.0
    # The same as above, but use custom tftp-server instead machine running dnsmasq
    #dhcp-boot=pxelinux,server.name,192.168.1.100
    # Boot for Etherboot gPXE. The idea is to send two different
    # filenames, the first loads gPXE, and the second tells gPXE what to
    # load. The dhcp-match sets the gpxe tag for requests from gPXE.
    #dhcp-match=set:gpxe,175 # gPXE sends a 175 option.
    #dhcp-boot=tag:!gpxe,undionly.kpxe
    #dhcp-boot=mybootimage
    # Encapsulated options for Etherboot gPXE. All the options are
    # encapsulated within option 175
    #dhcp-option=encap:175, 1, 5b # priority code
    #dhcp-option=encap:175, 176, 1b # no-proxydhcp
    #dhcp-option=encap:175, 177, string # bus-id
    #dhcp-option=encap:175, 189, 1b # BIOS drive code
    #dhcp-option=encap:175, 190, user # iSCSI username
    #dhcp-option=encap:175, 191, pass # iSCSI password
    # Test for the architecture of a netboot client. PXE clients are
    # supposed to send their architecture as option 93. (See RFC 4578)
    #dhcp-match=peecees, option:client-arch, 0 #x86-32
    #dhcp-match=itanics, option:client-arch, 2 #IA64
    #dhcp-match=hammers, option:client-arch, 6 #x86-64
    #dhcp-match=mactels, option:client-arch, 7 #EFI x86-64
    # Do real PXE, rather than just booting a single file, this is an
    # alternative to dhcp-boot.
    #pxe-prompt="What system shall I netboot?"
    # or with timeout before first available action is taken:
    #pxe-prompt="Press F8 for menu.", 60
    # Available boot services. for PXE.
    #pxe-service=x86PC, "Boot from local disk"
    # Loads <tftp-root>/pxelinux.0 from dnsmasq TFTP server.
    #pxe-service=x86PC, "Install Linux", pxelinux
    # Loads <tftp-root>/pxelinux.0 from TFTP server at 1.2.3.4.
    # Beware this fails on old PXE ROMS.
    #pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4
    # Use bootserver on network, found my multicast or broadcast.
    #pxe-service=x86PC, "Install windows from RIS server", 1
    # Use bootserver at a known IP address.
    #pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4
    # If you have multicast-FTP available,
    # information for that can be passed in a similar way using options 1
    # to 5. See page 19 of
    # http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf
    # Enable dnsmasq's built-in TFTP server
    #enable-tftp
    # Set the root directory for files available via FTP.
    #tftp-root=/var/ftpd
    # Make the TFTP server more secure: with this set, only files owned by
    # the user dnsmasq is running as will be send over the net.
    #tftp-secure
    # This option stops dnsmasq from negotiating a larger blocksize for TFTP
    # transfers. It will slow things down, but may rescue some broken TFTP
    # clients.
    #tftp-no-blocksize
    # Set the boot file name only when the "red" tag is set.
    #dhcp-boot=net:red,pxelinux.red-net
    # An example of dhcp-boot with an external TFTP server: the name and IP
    # address of the server are given after the filename.
    # Can fail with old PXE ROMS. Overridden by --pxe-service.
    #dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3
    # If there are multiple external tftp servers having a same name
    # (using /etc/hosts) then that name can be specified as the
    # tftp_servername (the third option to dhcp-boot) and in that
    # case dnsmasq resolves this name and returns the resultant IP
    # addresses in round robin fasion. This facility can be used to
    # load balance the tftp load among a set of servers.
    #dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name
    # Set the limit on DHCP leases, the default is 150
    #dhcp-lease-max=150
    # The DHCP server needs somewhere on disk to keep its lease database.
    # This defaults to a sane location, but if you want to change it, use
    # the line below.
    #dhcp-leasefile=/var/lib/misc/dnsmasq.leases
    # Set the DHCP server to authoritative mode. In this mode it will barge in
    # and take over the lease for any client which broadcasts on the network,
    # whether it has a record of the lease or not. This avoids long timeouts
    # when a machine wakes up on a new network. DO NOT enable this if there's
    # the slightest chance that you might end up accidentally configuring a DHCP
    # server for your campus/company accidentally. The ISC server uses
    # the same option, and this URL provides more information:
    # http://www.isc.org/files/auth.html
    #dhcp-authoritative
    # Run an executable when a DHCP lease is created or destroyed.
    # The arguments sent to the script are "add" or "del",
    # then the MAC address, the IP address and finally the hostname
    # if there is one.
    #dhcp-script=/bin/echo
    # Set the cachesize here.
    #cache-size=150
    # If you want to disable negative caching, uncomment this.
    #no-negcache
    # Normally responses which come from /etc/hosts and the DHCP lease
    # file have Time-To-Live set as zero, which conventionally means
    # do not cache further. If you are happy to trade lower load on the
    # server for potentially stale date, you can set a time-to-live (in
    # seconds) here.
    #local-ttl=
    # If you want dnsmasq to detect attempts by Verisign to send queries
    # to unregistered .com and .net hosts to its sitefinder service and
    # have dnsmasq instead return the correct NXDOMAIN response, uncomment
    # this line. You can add similar lines to do the same for other
    # registries which have implemented wildcard A records.
    #bogus-nxdomain=64.94.110.11
    # If you want to fix up DNS results from upstream servers, use the
    # alias option. This only works for IPv4.
    # This alias makes a result of 1.2.3.4 appear as 5.6.7.8
    #alias=1.2.3.4,5.6.7.8
    # and this maps 1.2.3.x to 5.6.7.x
    #alias=1.2.3.0,5.6.7.0,255.255.255.0
    # and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40
    #alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
    # Change these lines if you want dnsmasq to serve MX records.
    # Return an MX record named "maildomain.com" with target
    # servermachine.com and preference 50
    #mx-host=maildomain.com,servermachine.com,50
    # Set the default target for MX records created using the localmx option.
    #mx-target=servermachine.com
    # Return an MX record pointing to the mx-target for all local
    # machines.
    #localmx
    # Return an MX record pointing to itself for all local machines.
    #selfmx
    # Change the following lines if you want dnsmasq to serve SRV
    # records. These are useful if you want to serve ldap requests for
    # Active Directory and other windows-originated DNS requests.
    # See RFC 2782.
    # You may add multiple srv-host lines.
    # The fields are <name>,<target>,<port>,<priority>,<weight>
    # If the domain part if missing from the name (so that is just has the
    # service and protocol sections) then the domain given by the domain=
    # config option is used. (Note that expand-hosts does not need to be
    # set for this to work.)
    # A SRV record sending LDAP for the example.com domain to
    # ldapserver.example.com port 389
    #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389
    # A SRV record sending LDAP for the example.com domain to
    # ldapserver.example.com port 389 (using domain=)
    #domain=example.com
    #srv-host=_ldap._tcp,ldapserver.example.com,389
    # Two SRV records for LDAP, each with different priorities
    #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1
    #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2
    # A SRV record indicating that there is no LDAP server for the domain
    # example.com
    #srv-host=_ldap._tcp.example.com
    # The following line shows how to make dnsmasq serve an arbitrary PTR
    # record. This is useful for DNS-SD. (Note that the
    # domain-name expansion done for SRV records _does_not
    # occur for PTR records.)
    #ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services"
    # Change the following lines to enable dnsmasq to serve TXT records.
    # These are used for things like SPF and zeroconf. (Note that the
    # domain-name expansion done for SRV records _does_not
    # occur for TXT records.)
    #Example SPF.
    #txt-record=example.com,"v=spf1 a -all"
    #Example zeroconf
    #txt-record=_http._tcp.example.com,name=value,paper=A4
    # Provide an alias for a "local" DNS name. Note that this _only_ works
    # for targets which are names from DHCP or /etc/hosts. Give host
    # "bert" another name, bertrand
    #cname=bertand,bert
    # For debugging purposes, log each DNS query as it passes through
    # dnsmasq.
    #log-queries
    # Log lots of extra information about DHCP transactions.
    #log-dhcp
    # Include a another lot of configuration options.
    #conf-file=/etc/dnsmasq.more.conf
    #conf-dir=/etc/dnsmasq.d
    /etc/dhclient.conf
    send host-name = pick-first-value(gethostname(), "ISC-dhclient");
    send dhcp-client-identifier 1:0:a0:24:ab:fb:9c;
    send dhcp-lease-time 3600;
    supersede domain-search "fugue.com", "home.vix.com";
    prepend domain-name-servers 127.0.0.1;
    request subnet-mask, broadcast-address, time-offset, routers,
    domain-name, domain-name-servers, host-name;
    require subnet-mask, domain-name-servers;
    timeout 60;
    retry 60;
    reboot 10;
    select-timeout 5;
    initial-interval 2;
    script "/etc/dhclient-script";
    media "-link0 -link1 -link2", "link0 link1";
    reject 192.33.137.209;
    alias {
    interface "ep0";
    fixed-address 192.5.5.213;
    option subnet-mask 255.255.255.255;
    lease {
    interface "ep0";
    fixed-address 192.33.137.200;
    medium "link0 link1";
    option host-name "andare.swiftmedia.com";
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.33.137.255;
    option routers 192.33.137.250;
    option domain-name-servers 127.0.0.1;
    renew 2 2000/1/12 00:00:01;
    rebind 2 2000/1/12 00:00:01;
    expire 2 2000/1/12 00:00:01;
    Any idea will be appreciated.

    I have this setup according to that thread:
    https://bbs.archlinux.org/viewtopic.php?id=139784&p=1
    I followed wiki on dnsmasq, I set up dhclient.conf accordingly, and still the host file does not get read and all websites are riddled with ad banners.
    Here are my config files:
    /etc/dnsmasq.conf
    # Configuration file for dnsmasq.
    # Format is one option per line, legal options are the same
    # as the long options legal on the command line. See
    # "/usr/sbin/dnsmasq --help" or "man 8 dnsmasq" for details.
    # Listen on this specific port instead of the standard DNS port
    # (53). Setting this to zero completely disables DNS function,
    # leaving only DHCP and/or TFTP.
    #port=5353
    # The following two options make you a better netizen, since they
    # tell dnsmasq to filter out queries which the public DNS cannot
    # answer, and which load the servers (especially the root servers)
    # unnecessarily. If you have a dial-on-demand link they also stop
    # these requests from bringing up the link unnecessarily.
    # Never forward plain names (without a dot or domain part)
    #domain-needed
    # Never forward addresses in the non-routed address spaces.
    #bogus-priv
    # Uncomment this to filter useless windows-originated DNS requests
    # which can trigger dial-on-demand links needlessly.
    # Note that (amongst other things) this blocks all SRV requests,
    # so don't use it if you use eg Kerberos, SIP, XMMP or Google-talk.
    # This option only affects forwarding, SRV records originating for
    # dnsmasq (via srv-host= lines) are not suppressed by it.
    #filterwin2k
    # Change this line if you want dns to get its upstream servers from
    # somewhere other that /etc/resolv.conf
    #resolv-file=
    # By default, dnsmasq will send queries to any of the upstream
    # servers it knows about and tries to favour servers to are known
    # to be up. Uncommenting this forces dnsmasq to try each query
    # with each server strictly in the order they appear in
    # /etc/resolv.conf
    #strict-order
    # If you don't want dnsmasq to read /etc/resolv.conf or any other
    # file, getting its servers from this file instead (see below), then
    # uncomment this.
    #no-resolv
    # If you don't want dnsmasq to poll /etc/resolv.conf or other resolv
    # files for changes and re-read them then uncomment this.
    #no-poll
    # Add other name servers here, with domain specs if they are for
    # non-public domains.
    #server=/localnet/192.168.0.1
    # Example of routing PTR queries to nameservers: this will send all
    # address->name queries for 192.168.3/24 to nameserver 10.1.2.3
    #server=/3.168.192.in-addr.arpa/10.1.2.3
    # Add local-only domains here, queries in these domains are answered
    # from /etc/hosts or DHCP only.
    #local=/localnet/
    # Add domains which you want to force to an IP address here.
    # The example below send any host in double-click.net to a local
    # web-server.
    #address=/double-click.net/127.0.0.1
    # --address (and --server) work with IPv6 addresses too.
    #address=/www.thekelleys.org.uk/fe80::20d:60ff:fe36:f83
    # You can control how dnsmasq talks to a server: this forces
    # queries to 10.1.2.3 to be routed via eth1
    # server=10.1.2.3@eth1
    # and this sets the source (ie local) address used to talk to
    # 10.1.2.3 to 192.168.1.1 port 55 (there must be a interface with that
    # IP on the machine, obviously).
    # [email protected]#55
    # If you want dnsmasq to change uid and gid to something other
    # than the default, edit the following lines.
    #user=
    #group=
    # If you want dnsmasq to listen for DHCP and DNS requests only on
    # specified interfaces (and the loopback) give the name of the
    # interface (eg eth0) here.
    # Repeat the line for more than one interface.
    #interface=
    # Or you can specify which interface _not_ to listen on
    #except-interface=
    # Or which to listen on by address (remember to include 127.0.0.1 if
    # you use this.)
    listen-address=127.0.0.1
    # If you want dnsmasq to provide only DNS service on an interface,
    # configure it as shown above, and then use the following line to
    # disable DHCP and TFTP on it.
    #no-dhcp-interface=
    # On systems which support it, dnsmasq binds the wildcard address,
    # even when it is listening on only some interfaces. It then discards
    # requests that it shouldn't reply to. This has the advantage of
    # working even when interfaces come and go and change address. If you
    # want dnsmasq to really bind only the interfaces it is listening on,
    # uncomment this option. About the only time you may need this is when
    # running another nameserver on the same machine.
    #bind-interfaces
    # If you don't want dnsmasq to read /etc/hosts, uncomment the
    # following line.
    #no-hosts
    # or if you want it to read another file, as well as /etc/hosts, use
    # this.
    addn-hosts=/etc/hosts.block
    # Set this (and domain: see below) if you want to have a domain
    # automatically added to simple names in a hosts-file.
    #expand-hosts
    # Set the domain for dnsmasq. this is optional, but if it is set, it
    # does the following things.
    # 1) Allows DHCP hosts to have fully qualified domain names, as long
    # as the domain part matches this setting.
    # 2) Sets the "domain" DHCP option thereby potentially setting the
    # domain of all systems configured by DHCP
    # 3) Provides the domain part for "expand-hosts"
    #domain=thekelleys.org.uk
    # Set a different domain for a particular subnet
    #domain=wireless.thekelleys.org.uk,192.168.2.0/24
    # Same idea, but range rather then subnet
    #domain=reserved.thekelleys.org.uk,192.68.3.100,192.168.3.200
    # Uncomment this to enable the integrated DHCP server, you need
    # to supply the range of addresses available for lease and optionally
    # a lease time. If you have more than one network, you will need to
    # repeat this for each network on which you want to supply DHCP
    # service.
    #dhcp-range=192.168.0.50,192.168.0.150,12h
    # This is an example of a DHCP range where the netmask is given. This
    # is needed for networks we reach the dnsmasq DHCP server via a relay
    # agent. If you don't know what a DHCP relay agent is, you probably
    # don't need to worry about this.
    #dhcp-range=192.168.0.50,192.168.0.150,255.255.255.0,12h
    # This is an example of a DHCP range which sets a tag, so that
    # some DHCP options may be set only for this network.
    #dhcp-range=set:red,192.168.0.50,192.168.0.150
    # Use this DHCP range only when the tag "green" is set.
    #dhcp-range=tag:green,192.168.0.50,192.168.0.150,12h
    # Specify a subnet which can't be used for dynamic address allocation,
    # is available for hosts with matching --dhcp-host lines. Note that
    # dhcp-host declarations will be ignored unless there is a dhcp-range
    # of some type for the subnet in question.
    # In this case the netmask is implied (it comes from the network
    # configuration on the machine running dnsmasq) it is possible to give
    # an explicit netmask instead.
    #dhcp-range=192.168.0.0,static
    # Enable DHCPv6. Note that the prefix-length does not need to be specified
    # and defaults to 64 if missing/
    #dhcp-range=1234::2, 1234::500, 64, 12h
    # Do Router Advertisements, BUT NOT DHCP for this subnet.
    #dhcp-range=1234::, ra-only
    # Do Router Advertisements, BUT NOT DHCP for this subnet, also try and
    # add names to the DNS for the IPv6 address of SLAAC-configured dual-stack
    # hosts. Use the DHCPv4 lease to derive the name, network segment and
    # MAC address and assume that the host will also have an
    # IPv6 address calculated using the SLAAC alogrithm.
    #dhcp-range=1234::, ra-names
    # Do Router Advertisements, BUT NOT DHCP for this subnet.
    # Set the lifetime to 46 hours. (Note: minimum lifetime is 2 hours.)
    #dhcp-range=1234::, ra-only, 48h
    # Do DHCP and Router Advertisements for this subnet. Set the A bit in the RA
    # so that clients can use SLAAC addresses as well as DHCP ones.
    #dhcp-range=1234::2, 1234::500, slaac
    # Do Router Advertisements and stateless DHCP for this subnet. Clients will
    # not get addresses from DHCP, but they will get other configuration information.
    # They will use SLAAC for addresses.
    #dhcp-range=1234::, ra-stateless
    # Do stateless DHCP, SLAAC, and generate DNS names for SLAAC addresses
    # from DHCPv4 leases.
    #dhcp-range=1234::, ra-stateless, ra-names
    # Do router advertisements for all subnets where we're doing DHCPv6
    # Unless overriden by ra-stateless, ra-names, et al, the router
    # advertisements will have the M and O bits set, so that the clients
    # get addresses and configuration from DHCPv6, and the A bit reset, so the
    # clients don't use SLAAC addresses.
    #enable-ra
    # Supply parameters for specified hosts using DHCP. There are lots
    # of valid alternatives, so we will give examples of each. Note that
    # IP addresses DO NOT have to be in the range given above, they just
    # need to be on the same network. The order of the parameters in these
    # do not matter, it's permissible to give name, address and MAC in any
    # order.
    # Always allocate the host with Ethernet address 11:22:33:44:55:66
    # The IP address 192.168.0.60
    #dhcp-host=11:22:33:44:55:66,192.168.0.60
    # Always set the name of the host with hardware address
    # 11:22:33:44:55:66 to be "fred"
    #dhcp-host=11:22:33:44:55:66,fred
    # Always give the host with Ethernet address 11:22:33:44:55:66
    # the name fred and IP address 192.168.0.60 and lease time 45 minutes
    #dhcp-host=11:22:33:44:55:66,fred,192.168.0.60,45m
    # Give a host with Ethernet address 11:22:33:44:55:66 or
    # 12:34:56:78:90:12 the IP address 192.168.0.60. Dnsmasq will assume
    # that these two Ethernet interfaces will never be in use at the same
    # time, and give the IP address to the second, even if it is already
    # in use by the first. Useful for laptops with wired and wireless
    # addresses.
    #dhcp-host=11:22:33:44:55:66,12:34:56:78:90:12,192.168.0.60
    # Give the machine which says its name is "bert" IP address
    # 192.168.0.70 and an infinite lease
    #dhcp-host=bert,192.168.0.70,infinite
    # Always give the host with client identifier 01:02:02:04
    # the IP address 192.168.0.60
    #dhcp-host=id:01:02:02:04,192.168.0.60
    # Always give the host with client identifier "marjorie"
    # the IP address 192.168.0.60
    #dhcp-host=id:marjorie,192.168.0.60
    # Enable the address given for "judge" in /etc/hosts
    # to be given to a machine presenting the name "judge" when
    # it asks for a DHCP lease.
    #dhcp-host=judge
    # Never offer DHCP service to a machine whose Ethernet
    # address is 11:22:33:44:55:66
    #dhcp-host=11:22:33:44:55:66,ignore
    # Ignore any client-id presented by the machine with Ethernet
    # address 11:22:33:44:55:66. This is useful to prevent a machine
    # being treated differently when running under different OS's or
    # between PXE boot and OS boot.
    #dhcp-host=11:22:33:44:55:66,id:*
    # Send extra options which are tagged as "red" to
    # the machine with Ethernet address 11:22:33:44:55:66
    #dhcp-host=11:22:33:44:55:66,set:red
    # Send extra options which are tagged as "red" to
    # any machine with Ethernet address starting 11:22:33:
    #dhcp-host=11:22:33:*:*:*,set:red
    # Give a fixed IPv6 address and name to client with
    # DUID 00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2
    # Note the MAC addresses CANNOT be used to identify DHCPv6 clients.
    # Note also the they [] around the IPv6 address are obilgatory.
    #dhcp-host=id:00:01:00:01:16:d2:83:fc:92:d4:19:e2:d8:b2, fred, [1234::5]
    # Ignore any clients which are not specified in dhcp-host lines
    # or /etc/ethers. Equivalent to ISC "deny unknown-clients".
    # This relies on the special "known" tag which is set when
    # a host is matched.
    #dhcp-ignore=tag:!known
    # Send extra options which are tagged as "red" to any machine whose
    # DHCP vendorclass string includes the substring "Linux"
    #dhcp-vendorclass=set:red,Linux
    # Send extra options which are tagged as "red" to any machine one
    # of whose DHCP userclass strings includes the substring "accounts"
    #dhcp-userclass=set:red,accounts
    # Send extra options which are tagged as "red" to any machine whose
    # MAC address matches the pattern.
    #dhcp-mac=set:red,00:60:8C:*:*:*
    # If this line is uncommented, dnsmasq will read /etc/ethers and act
    # on the ethernet-address/IP pairs found there just as if they had
    # been given as --dhcp-host options. Useful if you keep
    # MAC-address/host mappings there for other purposes.
    #read-ethers
    # Send options to hosts which ask for a DHCP lease.
    # See RFC 2132 for details of available options.
    # Common options can be given to dnsmasq by name:
    # run "dnsmasq --help dhcp" to get a list.
    # Note that all the common settings, such as netmask and
    # broadcast address, DNS server and default route, are given
    # sane defaults by dnsmasq. You very likely will not need
    # any dhcp-options. If you use Windows clients and Samba, there
    # are some options which are recommended, they are detailed at the
    # end of this section.
    # Override the default route supplied by dnsmasq, which assumes the
    # router is the same machine as the one running dnsmasq.
    #dhcp-option=3,1.2.3.4
    # Do the same thing, but using the option name
    #dhcp-option=option:router,1.2.3.4
    # Override the default route supplied by dnsmasq and send no default
    # route at all. Note that this only works for the options sent by
    # default (1, 3, 6, 12, 28) the same line will send a zero-length option
    # for all other option numbers.
    #dhcp-option=3
    # Set the NTP time server addresses to 192.168.0.4 and 10.10.0.5
    #dhcp-option=option:ntp-server,192.168.0.4,10.10.0.5
    # Send DHCPv6 option. Note [] around IPv6 addresses.
    #dhcp-option=option6:dns-server,[1234::77],[1234::88]
    # Send DHCPv6 option for namservers as the machine running
    # dnsmasq and another.
    #dhcp-option=option6:dns-server,[::],[1234::88]
    # Ask client to poll for option changes every six hours. (RFC4242)
    #dhcp-option=option6:information-refresh-time,6h
    # Set the NTP time server address to be the same machine as
    # is running dnsmasq
    #dhcp-option=42,0.0.0.0
    # Set the NIS domain name to "welly"
    #dhcp-option=40,welly
    # Set the default time-to-live to 50
    #dhcp-option=23,50
    # Set the "all subnets are local" flag
    #dhcp-option=27,1
    # Send the etherboot magic flag and then etherboot options (a string).
    #dhcp-option=128,e4:45:74:68:00:00
    #dhcp-option=129,NIC=eepro100
    # Specify an option which will only be sent to the "red" network
    # (see dhcp-range for the declaration of the "red" network)
    # Note that the tag: part must precede the option: part.
    #dhcp-option = tag:red, option:ntp-server, 192.168.1.1
    # The following DHCP options set up dnsmasq in the same way as is specified
    # for the ISC dhcpcd in
    # http://www.samba.org/samba/ftp/docs/textdocs/DHCP-Server-Configuration.txt
    # adapted for a typical dnsmasq installation where the host running
    # dnsmasq is also the host running samba.
    # you may want to uncomment some or all of them if you use
    # Windows clients and Samba.
    #dhcp-option=19,0 # option ip-forwarding off
    #dhcp-option=44,0.0.0.0 # set netbios-over-TCP/IP nameserver(s) aka WINS server(s)
    #dhcp-option=45,0.0.0.0 # netbios datagram distribution server
    #dhcp-option=46,8 # netbios node type
    # Send an empty WPAD option. This may be REQUIRED to get windows 7 to behave.
    #dhcp-option=252,"\n"
    # Send RFC-3397 DNS domain search DHCP option. WARNING: Your DHCP client
    # probably doesn't support this......
    #dhcp-option=option:domain-search,eng.apple.com,marketing.apple.com
    # Send RFC-3442 classless static routes (note the netmask encoding)
    #dhcp-option=121,192.168.1.0/24,1.2.3.4,10.0.0.0/8,5.6.7.8
    # Send vendor-class specific options encapsulated in DHCP option 43.
    # The meaning of the options is defined by the vendor-class so
    # options are sent only when the client supplied vendor class
    # matches the class given here. (A substring match is OK, so "MSFT"
    # matches "MSFT" and "MSFT 5.0"). This example sets the
    # mtftp address to 0.0.0.0 for PXEClients.
    #dhcp-option=vendor:PXEClient,1,0.0.0.0
    # Send microsoft-specific option to tell windows to release the DHCP lease
    # when it shuts down. Note the "i" flag, to tell dnsmasq to send the
    # value as a four-byte integer - that's what microsoft wants. See
    # http://technet2.microsoft.com/WindowsServer/en/library/a70f1bb7-d2d4-49f0-96d6-4b7414ecfaae1033.mspx?mfr=true
    #dhcp-option=vendor:MSFT,2,1i
    # Send the Encapsulated-vendor-class ID needed by some configurations of
    # Etherboot to allow is to recognise the DHCP server.
    #dhcp-option=vendor:Etherboot,60,"Etherboot"
    # Send options to PXELinux. Note that we need to send the options even
    # though they don't appear in the parameter request list, so we need
    # to use dhcp-option-force here.
    # See http://syslinux.zytor.com/pxe.php#special for details.
    # Magic number - needed before anything else is recognised
    #dhcp-option-force=208,f1:00:74:7e
    # Configuration file name
    #dhcp-option-force=209,configs/common
    # Path prefix
    #dhcp-option-force=210,/tftpboot/pxelinux/files/
    # Reboot time. (Note 'i' to send 32-bit value)
    #dhcp-option-force=211,30i
    # Set the boot filename for netboot/PXE. You will only need
    # this is you want to boot machines over the network and you will need
    # a TFTP server; either dnsmasq's built in TFTP server or an
    # external one. (See below for how to enable the TFTP server.)
    #dhcp-boot=pxelinux.0
    # The same as above, but use custom tftp-server instead machine running dnsmasq
    #dhcp-boot=pxelinux,server.name,192.168.1.100
    # Boot for Etherboot gPXE. The idea is to send two different
    # filenames, the first loads gPXE, and the second tells gPXE what to
    # load. The dhcp-match sets the gpxe tag for requests from gPXE.
    #dhcp-match=set:gpxe,175 # gPXE sends a 175 option.
    #dhcp-boot=tag:!gpxe,undionly.kpxe
    #dhcp-boot=mybootimage
    # Encapsulated options for Etherboot gPXE. All the options are
    # encapsulated within option 175
    #dhcp-option=encap:175, 1, 5b # priority code
    #dhcp-option=encap:175, 176, 1b # no-proxydhcp
    #dhcp-option=encap:175, 177, string # bus-id
    #dhcp-option=encap:175, 189, 1b # BIOS drive code
    #dhcp-option=encap:175, 190, user # iSCSI username
    #dhcp-option=encap:175, 191, pass # iSCSI password
    # Test for the architecture of a netboot client. PXE clients are
    # supposed to send their architecture as option 93. (See RFC 4578)
    #dhcp-match=peecees, option:client-arch, 0 #x86-32
    #dhcp-match=itanics, option:client-arch, 2 #IA64
    #dhcp-match=hammers, option:client-arch, 6 #x86-64
    #dhcp-match=mactels, option:client-arch, 7 #EFI x86-64
    # Do real PXE, rather than just booting a single file, this is an
    # alternative to dhcp-boot.
    #pxe-prompt="What system shall I netboot?"
    # or with timeout before first available action is taken:
    #pxe-prompt="Press F8 for menu.", 60
    # Available boot services. for PXE.
    #pxe-service=x86PC, "Boot from local disk"
    # Loads <tftp-root>/pxelinux.0 from dnsmasq TFTP server.
    #pxe-service=x86PC, "Install Linux", pxelinux
    # Loads <tftp-root>/pxelinux.0 from TFTP server at 1.2.3.4.
    # Beware this fails on old PXE ROMS.
    #pxe-service=x86PC, "Install Linux", pxelinux, 1.2.3.4
    # Use bootserver on network, found my multicast or broadcast.
    #pxe-service=x86PC, "Install windows from RIS server", 1
    # Use bootserver at a known IP address.
    #pxe-service=x86PC, "Install windows from RIS server", 1, 1.2.3.4
    # If you have multicast-FTP available,
    # information for that can be passed in a similar way using options 1
    # to 5. See page 19 of
    # http://download.intel.com/design/archives/wfm/downloads/pxespec.pdf
    # Enable dnsmasq's built-in TFTP server
    #enable-tftp
    # Set the root directory for files available via FTP.
    #tftp-root=/var/ftpd
    # Make the TFTP server more secure: with this set, only files owned by
    # the user dnsmasq is running as will be send over the net.
    #tftp-secure
    # This option stops dnsmasq from negotiating a larger blocksize for TFTP
    # transfers. It will slow things down, but may rescue some broken TFTP
    # clients.
    #tftp-no-blocksize
    # Set the boot file name only when the "red" tag is set.
    #dhcp-boot=net:red,pxelinux.red-net
    # An example of dhcp-boot with an external TFTP server: the name and IP
    # address of the server are given after the filename.
    # Can fail with old PXE ROMS. Overridden by --pxe-service.
    #dhcp-boot=/var/ftpd/pxelinux.0,boothost,192.168.0.3
    # If there are multiple external tftp servers having a same name
    # (using /etc/hosts) then that name can be specified as the
    # tftp_servername (the third option to dhcp-boot) and in that
    # case dnsmasq resolves this name and returns the resultant IP
    # addresses in round robin fasion. This facility can be used to
    # load balance the tftp load among a set of servers.
    #dhcp-boot=/var/ftpd/pxelinux.0,boothost,tftp_server_name
    # Set the limit on DHCP leases, the default is 150
    #dhcp-lease-max=150
    # The DHCP server needs somewhere on disk to keep its lease database.
    # This defaults to a sane location, but if you want to change it, use
    # the line below.
    #dhcp-leasefile=/var/lib/misc/dnsmasq.leases
    # Set the DHCP server to authoritative mode. In this mode it will barge in
    # and take over the lease for any client which broadcasts on the network,
    # whether it has a record of the lease or not. This avoids long timeouts
    # when a machine wakes up on a new network. DO NOT enable this if there's
    # the slightest chance that you might end up accidentally configuring a DHCP
    # server for your campus/company accidentally. The ISC server uses
    # the same option, and this URL provides more information:
    # http://www.isc.org/files/auth.html
    #dhcp-authoritative
    # Run an executable when a DHCP lease is created or destroyed.
    # The arguments sent to the script are "add" or "del",
    # then the MAC address, the IP address and finally the hostname
    # if there is one.
    #dhcp-script=/bin/echo
    # Set the cachesize here.
    #cache-size=150
    # If you want to disable negative caching, uncomment this.
    #no-negcache
    # Normally responses which come from /etc/hosts and the DHCP lease
    # file have Time-To-Live set as zero, which conventionally means
    # do not cache further. If you are happy to trade lower load on the
    # server for potentially stale date, you can set a time-to-live (in
    # seconds) here.
    #local-ttl=
    # If you want dnsmasq to detect attempts by Verisign to send queries
    # to unregistered .com and .net hosts to its sitefinder service and
    # have dnsmasq instead return the correct NXDOMAIN response, uncomment
    # this line. You can add similar lines to do the same for other
    # registries which have implemented wildcard A records.
    #bogus-nxdomain=64.94.110.11
    # If you want to fix up DNS results from upstream servers, use the
    # alias option. This only works for IPv4.
    # This alias makes a result of 1.2.3.4 appear as 5.6.7.8
    #alias=1.2.3.4,5.6.7.8
    # and this maps 1.2.3.x to 5.6.7.x
    #alias=1.2.3.0,5.6.7.0,255.255.255.0
    # and this maps 192.168.0.10->192.168.0.40 to 10.0.0.10->10.0.0.40
    #alias=192.168.0.10-192.168.0.40,10.0.0.0,255.255.255.0
    # Change these lines if you want dnsmasq to serve MX records.
    # Return an MX record named "maildomain.com" with target
    # servermachine.com and preference 50
    #mx-host=maildomain.com,servermachine.com,50
    # Set the default target for MX records created using the localmx option.
    #mx-target=servermachine.com
    # Return an MX record pointing to the mx-target for all local
    # machines.
    #localmx
    # Return an MX record pointing to itself for all local machines.
    #selfmx
    # Change the following lines if you want dnsmasq to serve SRV
    # records. These are useful if you want to serve ldap requests for
    # Active Directory and other windows-originated DNS requests.
    # See RFC 2782.
    # You may add multiple srv-host lines.
    # The fields are <name>,<target>,<port>,<priority>,<weight>
    # If the domain part if missing from the name (so that is just has the
    # service and protocol sections) then the domain given by the domain=
    # config option is used. (Note that expand-hosts does not need to be
    # set for this to work.)
    # A SRV record sending LDAP for the example.com domain to
    # ldapserver.example.com port 389
    #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389
    # A SRV record sending LDAP for the example.com domain to
    # ldapserver.example.com port 389 (using domain=)
    #domain=example.com
    #srv-host=_ldap._tcp,ldapserver.example.com,389
    # Two SRV records for LDAP, each with different priorities
    #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,1
    #srv-host=_ldap._tcp.example.com,ldapserver.example.com,389,2
    # A SRV record indicating that there is no LDAP server for the domain
    # example.com
    #srv-host=_ldap._tcp.example.com
    # The following line shows how to make dnsmasq serve an arbitrary PTR
    # record. This is useful for DNS-SD. (Note that the
    # domain-name expansion done for SRV records _does_not
    # occur for PTR records.)
    #ptr-record=_http._tcp.dns-sd-services,"New Employee Page._http._tcp.dns-sd-services"
    # Change the following lines to enable dnsmasq to serve TXT records.
    # These are used for things like SPF and zeroconf. (Note that the
    # domain-name expansion done for SRV records _does_not
    # occur for TXT records.)
    #Example SPF.
    #txt-record=example.com,"v=spf1 a -all"
    #Example zeroconf
    #txt-record=_http._tcp.example.com,name=value,paper=A4
    # Provide an alias for a "local" DNS name. Note that this _only_ works
    # for targets which are names from DHCP or /etc/hosts. Give host
    # "bert" another name, bertrand
    #cname=bertand,bert
    # For debugging purposes, log each DNS query as it passes through
    # dnsmasq.
    #log-queries
    # Log lots of extra information about DHCP transactions.
    #log-dhcp
    # Include a another lot of configuration options.
    #conf-file=/etc/dnsmasq.more.conf
    #conf-dir=/etc/dnsmasq.d
    /etc/dhclient.conf
    send host-name = pick-first-value(gethostname(), "ISC-dhclient");
    send dhcp-client-identifier 1:0:a0:24:ab:fb:9c;
    send dhcp-lease-time 3600;
    supersede domain-search "fugue.com", "home.vix.com";
    prepend domain-name-servers 127.0.0.1;
    request subnet-mask, broadcast-address, time-offset, routers,
    domain-name, domain-name-servers, host-name;
    require subnet-mask, domain-name-servers;
    timeout 60;
    retry 60;
    reboot 10;
    select-timeout 5;
    initial-interval 2;
    script "/etc/dhclient-script";
    media "-link0 -link1 -link2", "link0 link1";
    reject 192.33.137.209;
    alias {
    interface "ep0";
    fixed-address 192.5.5.213;
    option subnet-mask 255.255.255.255;
    lease {
    interface "ep0";
    fixed-address 192.33.137.200;
    medium "link0 link1";
    option host-name "andare.swiftmedia.com";
    option subnet-mask 255.255.255.0;
    option broadcast-address 192.33.137.255;
    option routers 192.33.137.250;
    option domain-name-servers 127.0.0.1;
    renew 2 2000/1/12 00:00:01;
    rebind 2 2000/1/12 00:00:01;
    expire 2 2000/1/12 00:00:01;
    Any idea will be appreciated.

  • SGE2000 DHCP Relay Issue

    I am looking for some help with DHCP Relay on a SGE2000 switch.
    I have configured two VLANs on the switch, VLAN2 (192.168.10.x/24) and VLAN3 (192.168.9.x/24). I have the switch in Layer 3 mode. I have configured the DHCP relay server of 192.168.10.4 and the DHCP Interfaces as VLAN3. All of the IP Static Routes were generated by the switch.
    If I put a client computer on a port that is Untagged VLAN 3 and try to get a DHCP address from the server on an Untagged VLAN 2 port I never get a response back.
    I have done some packet captures and here is what I have found:
    I see the DHCP broadcast on the client computer
    I see the DHCP Request on the DHCP server coming from the IP assiged to the switch on VLAN 3 (192.168.9.254)
    I see the DHCP server respond with a DHCP Offer
    The DHCP offer never gets to the client computer
    I can't seem to get a DHCP address to any system not on the same VLAN as the DHCP server. Option 82 is disable and I did try enabling it, which made no difference.
    Any help would be great.
    Thanks,
    Phil

    Hi phil,
    Have you created a static route on the DHCP server that points back to the 192.168.9.0/24 network.
    The gateway for that network,  from the DHCP relay servers perspective,  is the VLAN2 IP address of the SGE2000 switch.
    i would think that if you tried to ping the VLAN3 switch  IP address from the DHCP server now,  you will not get a reply.
    When you create a static or persistant route in the DHCP server,   you then should be able to ping VLAN3 IP address of the switch.
    regards Dave

  • Join response does not reach AP

    This problem is also firewall and router/switch related, but the main problem is that the APs do not join.
    I have lightweight access-points (LAPs) on a subnet behind a redundant routed firewall context on an FWSM in a 6509. This context has a DHCP relay configured.
    The outside of the firewall is connected to the router (MSFC) through an interface vlan.
    On that same chassis, a PIX525 is connected. Behind that PIX is the WLC and the DHCP-server.
    When the LAP powers on, it does an DHCP request. The context relays it to the DHCP server, and the response is sent to the LAP. In that response is the IP-address of the WLC, which is on the same subnet as the DHCP server.
    Next step is a join request to the controller (udp to WLC on port 12223).
    When I use the capture facility on the firewall, I see the packet entering the inside interface, and leaving the outside on the FWSM. I do not see any responses.
    Next I do the same on the PIX outside: there I see the requests to the WLC, but also the responses FROM the WLC. I do not see those responses on the OUTSIDE of the context of the FWSM!
    I use the following ACL for capturing data:
    access-list lwapp permit ip any host 192.168.43.10
    access-list lwapp permit ip host 192.168.43.10 any
    capture wlc access-list lwapp interface outside
    Where 192.168.43.10 is the IP-address of the WLC
    show capture wlc detail
    gives me the packets i need to see.
    On the inside of the context this gives me only join requests
    On the outside of the context this gives me only the join requests
    On the outside of the PIX this gives me bot the join request and the join response
    The router does not have any ACL on both interfaces.
    Next step is to put an ACL on the router interfaces:
    access-list 100 permit ip host 192.168.43.10 192.168.37.32 0.0.0.31 log
    access-list 100 permit ip 192.168.37.32 0.0.0.31 host 192.168.43.10 log
    access-list 100 permit ip any any
    this access-list is put both in- and outgoing on the interface towards the PIX. I see both counters incrementing, and with 'show logging' I see both join request and join responses.
    When I place this access-list on the interface towards the FWSM, I see the same.
    My conclusion is therefore: the packets are leaving the interface towards the FWSM, but they do not arrive on the outside of the FW-context.
    HOWEVER: I can access switches with SSH in the same subnet (they have their management IP in that same subnet).
    From the WLC, I can ping the LAPs (there are 2 in that subnet at the moment).
    Because the join response is not received, the LAPs are continuously rebooting (being reachable during 20-30 seconds), but during this interval, I can ping them from the WLC.
    On the firewalls all needed protocols are allowed through.
    Can anyone shed some light on this?
    TIA,
    Marcel

    I found the issue, while sniffing the traffic on the LAP VLAN.
    It appears the WLC is discovered using the management IP-address (43.10 in my case), but the join response is coming from the AP-manager IP address (43.25). That second address was blocked by the firewall, and once allowed, all worked like a charm.
    It appears the capture option of the FWSM is not as reliable as a sniffer on a SPAN port (thank you, Mike!)
    Marcel

  • VWLC DHCP relay flooding

    Hello.
    I have a big problem with a vWLC installation and the DHCP relay. I have a interface for guest access in central Switching mode where is a DHCP Server address which is not in the same subnet. The Proxy mode is on, and the vWLC can reach the DHCP over its default gateway on the Interface. When a clients connects to ssid it sends a DHCP request and the controller sends it with its interface ip to the DHCP. So far so good, but the problem is that the vWLC does not send one packet, it sends thousends of same DHCP requests to the Server. The DHCP Server also ansers with thousends of DHCP acks.
    When i give the DHCP which is also a vm, a interface in the guest vlan everthing works correct. Does anybody know if there is a problem with DHCP relay over Layer 3?
    Regards Stefan
    I use the latest verion of vWLC.

    Hello.
    I have a big problem with a vWLC installation and the DHCP relay. I have a interface for guest access in central Switching mode where is a DHCP Server address which is not in the same subnet. The Proxy mode is on, and the vWLC can reach the DHCP over its default gateway on the Interface. When a clients connects to ssid it sends a DHCP request and the controller sends it with its interface ip to the DHCP. So far so good, but the problem is that the vWLC does not send one packet, it sends thousends of same DHCP requests to the Server. The DHCP Server also ansers with thousends of DHCP acks.
    When i give the DHCP which is also a vm, a interface in the guest vlan everthing works correct. Does anybody know if there is a problem with DHCP relay over Layer 3?
    Regards Stefan
    I use the latest verion of vWLC.

Maybe you are looking for

  • MacBook Pro will not connect to the internet

    Suddenly, my MacBook Pro will not connect to the Internet--even when I take the cable from the Time Capsule and plug it into the laptop... -Internet is good –WiFi is connected -both work with my iPad...

  • I'm not getting incoming mail

    my mail application is no longer sending mail into my inbox.  I can send an email out.  What can I do to fix this?  I am an aol user and have a macbook pro

  • Alternatives to Apple Cinema Displays

    I've seen many comments from pros lamenting qualities of the latest Cinema Displays. So what is the display of choice for the pro these days?

  • Which TNSNAMES.ORA file to update???

    Hi All I have installed Oracle Apps on my local system and I regularly access one more database using internet which is on another server. Now for accessing my local apps database I can use Toad or PL/SQL Developer without modifying the TNS file. But

  • Do big picture by flash player 14 shows related to browsers.IE10 best,chrome 37 worst.

    So whenever my website is opened in IE10, it works perfectly fine, but when it is opened in Chrome37 or Firefox31, my background images  don't show up. It seems like it gets the most problems when opened in Chrome. The image is size of 9450*9450 when