SGE2010P - DHCP Snooping - VLANs - Web GUI

Model: SGE2010P
FW: 3.0.0.18
In the web GUI:
Under DHCP Snooping ---> VLAN Settings
It does not allow you to enter a VLAN higher than 4092
I configured it to listen on VLAN 4094 via the CLI just fine.
I believe this should be fixed in the web GUI.

Yeah, I don't think I want to do that because of all the little troubleshooting steps they usually make me go through.
I buy high-end equipment so I can skip the simple stuff...they usually don't understand that.
I know it's a bug because I've already done the troubleshooting, I don't feel I should have to do the same stuff again.
I only make a call when absolutely necessary because I find the phone support for this product line very un-supportative.
At this level, I think I should get to skip the simple stuff.
If you can't submit a bug report thats fine, I'll just leave it at this.
It's no big deal, I just thought I'd let some one else know.

Similar Messages

SGE2010P DHCP Snooping Bug

In some cases with DHCP snooping enabled, the switch can cause a DHCP request to be blocked.
This is appears to be a corner case but it has happened to me with two different pieces of hardware in two different scenarios.
First, I have a printer on a VLAN where other computers can get an IP address fine but when DHCP snooping is enabled, the printer is unable to obtain an IP.
Second, I created a separate VLAN for an isolated network and enabled DHCP snooping on that VLAN. A modem was hooked up to one port and added as a trusted interface. A computer was hooked up to another port and with DHCP snooping enabled, the computer was unable to obtain an IP address.
In both cases, the DHCP snooping binding table shows an IP of 0.0.0.0 for the port with a very low renew time (~100sec). Also, as soon as I disabled DHCP snooping for either of the above VLANs, the devices are able to obtain IP address. It appears that the DHCP OFFER is never making its way back to the device with DHCP snooping enabled.

Nah,
I think it has something to do with MAC addresses that don't start with 00.
Just a hunch though.
I know they will never fix it and I have moved on.
I guess it's the "quality" you should expect for Cisco Small Biz.

Ip dhcp snooping on vlan

hi
i have following configuration in my switch
ALS1(config)# ip dhcp snooping
ALS1(config)# interface range fastethernet 0/7 - 12
ALS1(config-if-range)# ip dhcp snooping trust
ALS1(config-if-range)# exit
ALS1(config)# interface range fastethernet 0/15 - 24
ALS1(config-if-range)# ip dhcp snooping limit rate 20
ALS1(config-if-range)# exit
ALS1(config)# ip dhcp snooping vlan 100,200
my question is why do we have to configure dhcp snooping on vlan if we already configured on port??
Thanks
vish

I think it just gives you more flexibility ie. you may want to enable DHCP snooping but only for some vlans.
If you are asking why you need to enable it globally and then per vlan when you could just enable it per vlan I agree with what you are saying.
There are a number of other commands etc. that follow this line ie. enable it globally and then per vlan or per interface etc.
I suspect it may be to do with enabling it globally sets up certain things needed on a system wide and not a per vlan or per interface basis but I have wondered that myself sometimes :-)
Jon

IP DHCP snooping, IP source Guard, and DIA

Hi All,
I have Configured DHCP snooping and IP source guard and Dynamic arp inspection on my 3560 and 3750 Network Switches,
on both of them I'm facing that issue. (the printers and access points are configured to get ip addresses via DHCP), but when the lease time expires, they don't get ip addresses, and become unreacheable.
while all other clients get thier ip addresses normally
below you can find the Configuration configuration
ip dhcp snooping vlan 98,105,111
no ip dhcp snooping information option
ip dhcp snooping database flash:dhcpsnooping
ip dhcp snooping database write-delay 15
ip dhcp snooping
ip arp inspection vlan 98,105,111
ip verify trust on all access ports including printers and access point ports
all access ports are DHCP snooping untrusted
also when I create a static dhcp snooping binding record for these devices on the switch it resolves the Issue, but when I reload the switch it's removed automatically.
any resolution will be much appreciated.
regards,
Maher

check the following link for configuration of DHCP snooping
http://packetlife.net/blog/2010/aug/18/dhcp-snooping-and-dynamic-arp-inspection/
http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/configuration/guide/book/snoodhcp.html

C2950 IOS for DHCP Snooping and DAI

hi all,
anyone knows what image i would need for my 2950 to enable DHCP snooping and DAI features (just for lab purpose)?
or are these features just available on the bigger modular switches (4500 and 6500)?
>sh ver
Cisco Internetwork Operating System Software
IOS (tm) C2950 Software (C2950-I6Q4L2-M), Version 12.1(22)EA8a, RELEASE SOFTWARE (fc1)
Copyright (c) 1986-2006 by cisco Systems, Inc.
Compiled Fri 28-Jul-06 15:16 by weiliu
Image text-base: 0x80010000, data-base: 0x8056A000
Switch(config)#ip dhcp snooping ?
information DHCP Snooping information
vlan DHCP Snooping vlan
<cr>
Switch(config)#ip arp ?
% Unrecognized command

Hi Alain,
Thanks for this info! I've read you're CCNA Security.
Just curious, are you gonna write your CCNP Security soon?
Could you recommend a good lab switch for SECURE?
Sent from Cisco Technical Support iPad App

Configuring DHCP snooping

I am settting up DHCP snooping for the first time on an 3750. My DHCP server resides on another switch. The 3750 is connected through a Gig SFP fiber to a 3550 with DHCP relay.
Is the following config correct? The client will not get a dhcp with the option 82 enabled.
(config)#ip dhcp snooping
(config)#ip dhcp snooping vlan 2-200
(config)#no ip dhcp snooping info option
!The client will not get an ip with
!this option enabled.
! trusted interface connected to the 3550
(config)#int gi1/0/4
(config-if)#ip dhcp trust
! untrusted interface
(config-if)#ip dhcp limit rate 100
(config)#ip dhcp snooping database flash:/database1
(config)#ip dhcp snooping database timeout 30
(config)#ip dhcp snooping database write-delay 30

Have you enabled option 82 on your DHCP server? Also, on your DHCP relay switch, configure the following under the VLAN interface in question and see if it makes any difference.
Example:
c3550-A(config)#int vlan 1
c3550-A(config-if)#ip dhcp relay information trusted ?

Enabling DHCP snooping

Hello,
We have a 2960 48 port switch in a remote office with a couple of VLANs (VOIP & Data). The L3 routing is provided via the WAN router and acts as a 'router on a stick' and provides DHCP for both VLANs.
I need to enable DHCP snooping and I have issued the 'ip dhcp snooping trust' on the router port but not for the access ports. I have then added 'ip dhcp snooping' to the switch but not 'ip dhcp snooping vlan x , x' as I was hoping the ip dhcp snooping bindings database would start to fill up after a few days but it hasn't.
If I add 'ip dhcp snooping vlan x , x' I think the users will get issues as there is no database, what should I do as the router is doing the DHCP.
Thanks

You need to identify the vlans where snooping should be implemented using:
ip dhcp snooping vlan #
The default allows dhcp requests on untrusted ports.

Ip dhcp snooping issue

   Hi all,
I am having trouble getting the dhcp snooping to work on a stacked 3750 when a rogue DHCP server is plugged in to the network. I have configured dhcp snooping on one of our user switches with the following commands.
ip dhcp snooping
ip dhcp snooping vlan 11
no ip dhcp snooping information option
int range fa1/0/1 - 48
ip dhcp snooping limit rate 100
VLAN Name                             Status    Ports
11   JKT_Net_DHCP_1
interface FastEthernet1/0/43
description DHCP Subnet 1
switchport access vlan 11
switchport mode access
switchport port-security maximum 3
switchport port-security aging time 1440
switchport port-security violation restrict
switchport port-security aging type inactivity
no logging event link-status
no snmp trap link-status
spanning-tree portfast
spanning-tree bpduguard enable
ip dhcp snooping limit rate 100
end
The configuration works in ther fact that users are still getting their IP address info from the DHCP server and i can see all the dhcp snooping bindings on the switch. But I'm having issues where when a rogue dhcp device is plugged in to one of the user ports i.e fa1/0/43 on the user subnet, and do an ipconfig /release /renew on a machine on the same VLAN, i am still getting a DHCPOFFER from the rogue device and the machine ends up with the wrong IP address.
Currrently the real DHCP server sits off a network behind the firewall, with a layer 3 link (running OSPF) between the user switch to the distribution switch. I have enabled the dhcp snooping on the link from the distribution switch to the real DHCP server (shown below).
DHCP snooping trusted interface
interface GigabitEthernet1/0/9
description JKTADC01 - LAC 1
switchport access vlan 21
switchport mode access
no snmp trap link-status
ip dhcp snooping trust
end
I have also attached a network diagram of the network setup.
I would like to stop the rogue server from being able to give out ip addresses.
Can someone shed some light on this topic please?
Kind regards,
Philip

Pawan,
Based on the error messages it looks like you have a mis-configuration. Looks like
one of the trunks/ports does not have DHCP trust configured on it. Can you
track mac address 34dc.fde5.2c40 to what port it's connected to and verify
that it has DHCP trust enabled?.
Haihua

High cpu with dhcp snooping

Hi all,
I am using 2950T and have configured dhcp snooping with this config:
conf t
ip dhcp snooping
ip dhcp snooping vlan 416
int range fa0/1 - 24
ip dhcp snooping limit rate 50
int gig0/1 (Uplink)
ip dhcp snooping trust
int gig0/2
ip dhcp snooping trust (uplink)
After this the 2950 goes up to 80% cpu, and is barely accessible.
Have i done something wrong, or will the cpu return to 20%?
//Robert Pettersson
senior network engineer, WetterNet

Well,
In Cisco Bug Toolkit there are couple of articles which looks similar to yours.
The first thing to check now is the option-82. It is enabled by default so would be interesting to see what's happen if you disable it.
Otherwise it would be better if you can open case at Cisco because it could be that your problem depends on some other features enabled on the switch.
//Mikhail Galiulin

Is Guest VLAN configurable on the E-series WEB GUI yet

I logged on this board 2 months ago inquiring the availability of the Guest VLAN feature on the WEB GUI of the E-series home router and the answer back then was no.
I saw the Cisco Connect has been updated to work in synch with the WEB GUI and the new firmware has some minor bugs fixed on the Guest VLAN feature. My original:
Is Guest VLAN feature now available to configure on the WEB GUI of the E-series home router?

Are your talking about Guest VLAN or Guest WLAN?
Guest WLAN Feature is only available in E4200.In E4200 Router you have an option to configure the Guest WLAN using the WEB Interface.

Sg200-50 support dhcp snooping and dynamic arp inspection?

do the sg200-50 switches support:
dhcp snooping
dynamic arp inspection
?? thanks

HI d.pennington,
SG200 is L2 switch only. so this mean switch not support dhcp snooping. Switch support IGMP snooping, Switch support dynamic arp table. You can management switch with web page GUI only (CLI) not supported.
Thanks,
Moh

Do sg200-50 support dhcp snooping or dynamic arp inspection (DAI) ?

do the sg200-50 switches support:
dhcp snooping
dynamic arp inspection
?? thanks

HI d.pennington,
SG200 is L2 switch only. so this mean switch not support dhcp snooping. Switch support IGMP snooping, Switch support dynamic arp table. You can management switch with web page GUI only (CLI) not supported.
Thanks,
Moh

ATA190: Web GUI page options are greyed out

ATA190: Web GUI page options are greyed out and device failed registration to CM 10.5
do anyone have a resolution o this issue?

Options Greyed out issue can be due to the below Bug, which is listed as just cosmetic:
ATA190: Web GUI page options are greyed out
CSCur53864
Description
Symptom:
ATA190: Web GUI page options are greyed out.
Most of the options in the Web GUI of the ATA 190 are greyed out and cannot be configured. There is no option in CUCM configuration page or the ATA190 Web GUI to unlock the configuration options.
Here is a list of a few of the pages that are greyed out and do not allow any editing:
Network Setup > Basic Setup > Internet Settings
Network Setup > Basic Setup > Time Settings
Network Setup > Advanced Settings > VLAN
Network Setup > Advanced Settings > CDP & LLDP
Administration> Log > Log Module
Administration> Log > Log Setting
Administration> Log > Log Viewer
Conditions:
ATA 190 Devices running firmware version running 1.1.0 (006)
Workaround:
These options are not configurable and are supposed to be view only. The issue is cosmetic.
Most of the Configurable settings are available under the Voice Menu and Administrative Menu.
-Terry
Please rate all helpful posts

Can I use DHCP snooping and IOS DHCP server on the same switch stack

Hello,
I am shortly going to be deploying a Cisco CallManager solution for a customer whose network comprises stacks of Catalyst 3850 switches.
There is no separate core/server farm switch so the CallManager servers, voice gateways and IP phones will all plug into the same stack and be in the same VLAN (not my choice!).
For security we want to enable DHCP snooping and were planning on using the IOS DHCP server on the Catalyst switch stack.
Will this work? - when I enable DHCP snooping in networks with separate access layer switches I set the uplinks to the core as trusted links.
I am not sure whether DHCP snooping will work in this case. Do I need to set the VLAN interface on the switch as trusted, is this even possible?
Unfortunately I do not have access to a layer 3 switch to test this at the moment.
Thanks

Nope. That's the issue.
They'll sync on a third device acting as a hotspot, but the device sending a signal is not "on" the network it creates so the airport is all by itself on that network. At least that is what it looks like to me. Anyone have another take on it? Seems pretty silly that an iPad can put out a wifi signal, an Airport Express can receive a wifi signal, and yet there is no simple way to get them to communicate under this particular condition.

2602e Reset to Defaults Except IP not Work over Web GUI

Hello,
1. Set a Static IP
2. Apply & Save Configuration
3. After Reboot the IP is correct.
Then do Reset to Defaults Except IP in the WEB Gui.
After Reboot the AP loos the static IP and get a DHCP Address.
Reset to Defaults Except IP = Reset to Defaults !
Whats Wrong ?

OK, here is:
Writing out the event log to flash:/event.log ...
*Jan 22 17:44:56.675: %SYS-7-NV_BLOCK_INIT: Initialized the geometry of nvram
*Jan 22 17:44:57.547: %SYS-5-RELOAD: Reload requested by on console. Reload Reason: Reload Command.
Write of event.log done
IOS Bootloader - Starting system.
flash is writable
FLASH CHIP: Numonyx Mirrorbit (0089)
Xmodem file system is available.
flashfs[0]: 212 files, 7 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 15058432
flashfs[0]: Bytes available: 16939520
flashfs[0]: flashfs fsck took 23 seconds.
Reading cookie from SEEPROM
Base Ethernet MAC address: 10:f3:11:c2:2e:3a
Ethernet speed is 1000 Mb - FULL Duplex
Loading "flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-mx.152-4.JB3a"...##########################
File "flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-mx.152-4.JB3a" uncompressed and installed, entry point: 0x2003000
executing...
Secondary Bootloader - Starting system.
Tide MB - 32MB of flash
Xmodem file system is available.
flashfs[0]: 212 files, 7 directories
flashfs[0]: 0 orphaned files, 0 orphaned directories
flashfs[0]: Total bytes: 31997952
flashfs[0]: Bytes used: 15058432
flashfs[0]: Bytes available: 16939520
flashfs[0]: flashfs fsck took 14 seconds.
Base Ethernet MAC address: 10:f3:11:c2:2e:3a
Boot CMD: 'boot flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-xx.152-4.JB3a;flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-mx.152-4.JB3a'
Loading "flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-xx.152-4.JB3a"...#######################################
File "flash:/ap3g2-k9w7-mx.152-4.JB3a/ap3g2-k9w7-xx.152-4.JB3a" uncompressed and installed, entry point: 0x1003000
executing...
              Restricted Rights Legend
Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.
           cisco Systems, Inc.
           170 West Tasman Drive
           San Jose, California 95134-1706
Cisco IOS Software, C3600 Software (AP3G2-K9W7-M), Version 15.2(4)JB3a, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Mon 23-Dec-13 08:11 by prod_rel_team
Tide MB - 32MB of flash
Initializing flashfs...
flashfs[3]: 212 files, 7 directories
flashfs[3]: 0 orphaned files, 0 orphaned directories
flashfs[3]: Total bytes: 31739904
flashfs[3]: Bytes used: 15058432
flashfs[3]: Bytes available: 16681472
flashfs[3]: flashfs fsck took 12 seconds.
flashfs[3]: Initialization complete.
flashfs[4]: 0 files, 1 directories
flashfs[4]: 0 orphaned files, 0 orphaned directories
flashfs[4]: Total bytes: 11999232
flashfs[4]: Bytes used: 1024
flashfs[4]: Bytes available: 11998208
flashfs[4]: flashfs fsck took 0 seconds.
flashfs[4]: Initialization complete.
Copying radio files from flash: to ram:
Copy in progress...CCCCC
Copy in progress...CCC
Copy in progress...CCCC
Copy in progress...CCCC
Copy in progress...CC
Copy in progress...CCC
Copy in progress...CC
Copy in progress...CCCCC
Uncompressing radio files...
...done Initializing flashfs.
Radio0 present 8764 8000 0 A8000000 A8010000 0
Rate table has 650 entries (20 legacy/224 11n/406 11ac)
POWER TABLE FILENAME = ram:/B2.bin
Radio1 present 8764 8000 0 88000000 88010000 4
POWER TABLE FILENAME = ram:/B5.bin
This product contains cryptographic features and is subject to United
States and local country laws governing import, export, transfer and
use. Delivery of Cisco cryptographic products does not imply
third-party authority to import, export, distribute or use encryption.
Importers, exporters, distributors and users are responsible for
compliance with U.S. and local country laws. By using this product you
agree to comply with applicable laws and regulations. If you are unable
to comply with U.S. and local laws, return this product immediately.
A summary of U.S. laws governing Cisco cryptographic products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html
If you require further assistance please contact us by sending email to
[email protected].
cisco AIR-SAP2602E-E-K9 (PowerPC) processor (revision A0) with 204790K/57344K bytes of memory.
Processor board ID FGL1711Z6K6
PowerPC CPU at 800Mhz, revision number 0x2151
Last reset from power-on
1 Gigabit Ethernet interface
2 802.11 Radios
32K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address: 10:F3:11:C2:2E:3A
Part Number                          : 73-14511-02
PCA Assembly Number                  : 800-37898-01
PCA Revision Number                  : A0
PCB Serial Number                    : FOC17093TXF
Top Assembly Part Number             : 800-38357-01
Top Assembly Serial Number           : FGL1711Z6K6
Top Revision Number                  : A0
Product/Model Number                 : AIR-SAP2602E-E-K9
Press RETURN to get started!
*Mar 1 00:00:16.035: %IFMGR-7-NO_IFINDEX_FILE: Unable to open nvram:/ifIndex-table No such file or directory
*Mar 1 00:00:16.151: %SOAP_FIPS-2-SELF_TEST_IOS_SUCCESS: IOS crypto FIPS self test passed (11)APAVC: WlanPAKs 18174 RadioPaks 17566
*Mar 1 00:00:23.131: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 0 (4)
*Mar 1 00:00:29.443: %SOAP_FIPS-2-SELF_TEST_RAD_SUCCESS: RADIO crypto FIPS self test passed on interface Dot11Radio 1 (4)
*Mar 1 00:00:29.503: initializing dot11 onplus
*Mar 1 00:00:29.667: not a autoconfig enabled device!!!
*Mar 1 00:00:31.671: %LINK-6-UPDOWN: Interface GigabitEthernet0, changed state to up
*Mar 1 00:00:32.671: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to down
*Mar 1 00:01:18.015: Starting Ethernet promiscuous mode
*Jan 22 17:44:57.000: %LINK-5-CHANGED: Interface Dot11Radio0, changed state to administratively down
*Jan 22 17:44:57.000: %LINK-5-CHANGED: Interface Dot11Radio1, changed state to administratively down
*Jan 22 17:44:57.007: %CDP_PD-4-POWER_OK: Full power - HIGH_POWER inline power source
*Jan 22 17:44:57.015: %SYS-5-RESTART: System restarted --
Cisco IOS Software, C3600 Software (AP3G2-K9W7-M), Version 15.2(4)JB3a, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2013 by Cisco Systems, Inc.
Compiled Mon 23-Dec-13 08:11 by prod_rel_team
*Jan 22 17:44:57.015: %SNMP-5-COLDSTART: SNMP agent on host ap is undergoing a cold start
*Jan 22 17:44:57.999: %LINEPROTO-5-UPDOWN: Line protocol on Interface BVI1, changed state to up
*Jan 22 17:44:57.999: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio0, changed state to down
*Jan 22 17:44:57.999: %LINEPROTO-5-UPDOWN: Line protocol on Interface Dot11Radio1, changed state to downERROR: Failed to configure ethernet promiscuous mode. Interface Descriptor mismatch
*Jan 22 17:45:01.667: %SOAP_FIPS-2-SELF_TEST_HW_SUCCESS: HW crypto FIPS self test passed (0-0)
*Jan 22 17:45:01.667: DPAA Initialization Complete
*Jan 22 17:45:01.667: %SYS-3-HARIKARI: Process DPAA INIT top-level routine exited
*Jan 22 17:45:02.667: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0, changed state to up
*Jan 22 17:45:06.863: %DHCP-6-ADDRESS_ASSIGN: Interface BVI1 assigned DHCP address 10.16.33.216, mask 255.255.254.0, hostname ap

SGE2010P - DHCP Snooping - VLANs - Web GUI

Similar Messages

Maybe you are looking for