Solved

Passing DHCP requests via IP helper address

Posted on 2007-11-13
23
7,364 Views
Last Modified: 2010-04-21
I have a cisco 7204 router configured with a fastethernet 0/0 port that has 1 primary ip address and 3 secondary ip addresess.  I've added an IP helper address statement pointing to the DHCP server,  but I can only seem to pull an address from the primary interface addresses scope.  The DHCP server has 4 scopes representing the 4 ip addresses.  Each scope has reservations pre-configured with ip's and MAC addresses.  
0
Comment
Question by:jgarn
  • 8
  • 7
  • 5
  • +3
23 Comments
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
I don't think there's any way to specify that the request is originating from a network other than the primary. There's no keyword or variable in the command reference guide.
0
 
LVL 28

Expert Comment

by:batry_boy
Comment Utility
donjohnston is correct.  I've tried to do exactly what you're doing before and it won't work.  The router will always forward the DHCP request encapsulated inside a packet that has the source address of the primary interface.  Since the DHCP request, by the sheer nature of the traffic, has no source IP attached to it (since that's what the DHCP request is trying to retrieve in the first place, an IP address!), it has no way of knowing which interface to use for encapsulation of the DHCP request (primary or whatever secondary) so it always chooses the primary interface.
0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
If you add subinterfaces instead of using secondary addresses, you should be able to add the helper address to each subinterface.
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
If you use sub-interfaces, how are you going to force the router to use a specific sub-interface/ip address for the DHCP request?

I think the bottom line here is that multinetting and DHCP don't work well together.
0
 

Author Comment

by:jgarn
Comment Utility
Has anyone tried adding a second ip address to the DHCP server that corresponds to the secondary interfaces network? If all the devices are on the same physical network wouldn't the broadcast hit both IP's?
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
The problem is that any DHCP request received by the router will be sourced from the network that corresponds to the primary IP address of the routers interface.
0
 

Author Comment

by:jgarn
Comment Utility
Wouldn't the DHCP server receive the same broadcast if it is on the same lan as the router interface?
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
Yes, but that would require the DHCP server to be connected the network which the request is coming from. The assumption here is that DHCP server can't be connected in that manner.
0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
The DHCP server see's the subnet of the requesting client and services the request from the correct scope.  This is pretty standard stuff, works fine at least with Microsoft's DHCP server.  You don't have to have an address assigned to the dhcp server for each subnet, just the correct scope definitions

Regarding this statement:
"If you use sub-interfaces, how are you going to force the router to use a specific sub-interface/ip address for the DHCP request?"

The whole point of the IP helper-address is that it forwards DHCP broadcasts from one subnet to another.  It doesn't matter if it is being forwarded from a virtual interface, or an actual interface.  The DHCP requests are forwarded from subnet A to subnet B, as long as the DHCP server on subnet B has a scope definition for subnet A, it will service the request.  It works quite well.
0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
If DHCP servers weren't smart enough to deal with forwarded DHCP requests, there would be no point in the ip helper-address command.
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
The point I was trying to make was that the source network that the DHCP request was originating from would be based on the primary IP address of the routers interface. This question is about assigning multiple IP addresses to a router interface and how to get the router to source the DHCP request from one of the secondary networks. I was just pointing out why this wouldn't work.
0
Maximize Your Threat Intelligence Reporting

Reporting is one of the most important and least talked about aspects of a world-class threat intelligence program. Here’s how to do it right.

 

Author Comment

by:jgarn
Comment Utility
Looking a trace of the DHCP request from the client machine,  I could see the request packet go out, but I wasn't seeing a response.  The DHCP server wasn't sending an address from the reservation I had setup in the scope.  I checked the advanced properties of the DHCP server (Microsoft Win2k3) and noticed the server only services requests on the address that the DHCP server is bound to.

I tried adding a second IP address to the DHCP servers NIC thinking that it would add another address under the binding options. Turns out the DHCP server will only bind to one address per NIC. Fortunately the server has two NIC's. I gave the second NIC an address, bound it, and it gave me my reserved address.

This seems like the hard way of getting the scope to dish up addresses.  At this point the helper address on the router is not needed.  What happens when you want to add another local subnet? Another NIC?
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
Somethings not right with the DHCP server. I've setup DHCP servers with multiple scopes and forwarded requests from non-directly-connected networks and it's worked fine.
0
 

Author Comment

by:jgarn
Comment Utility
The non-directly connected networks (across WAN) work fine.  It's the local lan SECOND subnet that is not working.  I can see the DHCP Discover hit the DHCP server on the trace (Wire Shark), but I'm not seeing an offer being returned?

I have 20 scopes altogether, 18 remote and 2 local subnets.
The 18 remote and the FIRST local all work.

If I enable the second NIC and bind it in the DHCP advanced settings, the SECOND local subnet works.

0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
I guess the point I was trying to make was that if he does a subinterface, with a ip helper-address command on the subinterface, it should be no different than having separate physical subnet and forwarding dhcp packets.  Actually, I know this works because I have voice VLAN's where I've done just this so I wouldn't need a DHCP server just for phones.
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
Yeah, but how does the router know which subinterface to associate the request with? There's no tag, no source address, nothing.
0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
The request is forwarded from the source sub-interface, so it maintains the correct subnet information.  Really, this is pretty basic functionality.  The router does DHCP relay when you issue the ip helper-address, it is smart enough to source the DHCP request from the source interface so the DHCP server can issue the lease on the right subnet.  DHCP relay is pretty basic, his issue is just that doing this with a secondary ip address definition is not the same as having a subinterface defined.  If he defines a subinterface, he gets his secondary address, has an ip helper-address on that specific interface, then the router can source the forwarded DHCP broadcasts from the correct subnet.
0
 
LVL 50

Expert Comment

by:Don Johnston
Comment Utility
I guess I'm not phrasing the question correctly.

If I have a Cisco router with 3 sub-interfaces (with IP addresses) defined on the f0/0 interface.

f0/0.1 192.168.1.1/24
f0/0.2 192.168.2.1/24
f0/0.3 192.168.3.1/24

And I put an ip helper-address statement on each sub-interface pointing to the DHCP server out f0/1.

When a host connected to the f0/0 interface transmits a DHCP request, how is the router to know which sub-interface to associate that request with?
0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
Because the ip helper-address is interface specific.  For starters, if you don't have an ip address assigned to f0/0 then it's a moot question.  If you meant f0/0.1, then IOS knows what VLAN f0/0.1 is and will forward any DHCP UDP broadcasts from f0/0.1 to whatever address is specified in the ip helper-address that is present for int f0/0.1.

Once you define the subinterface, it is pretty much just like a physical interface with the exception of certain QOS/VLAN/Encapsulation issues.

So, if a host connected to f0/0(if that is what you really meant) transmits a DHCP request, it will have nothing to do with the subinterfaces since the host wasn't on f0/0.1, f0/0.2 or f0/0.3, it was on f0/0.
0
 
LVL 12

Expert Comment

by:benhanson
Comment Utility
What kind of switches are you using?  Are they VLAN aware?
0
 
LVL 1

Accepted Solution

by:
sajsou earned 500 total points
Comment Utility
Can you please enable DHCP Smart-Relay .This may fix your issue.

Enabling the DHCP Smart-Relay Feature

By default, the DHCP smart-relay feature is disabled. To enable the smart-relay functionality, use the following command in global configuration mode:

Router(config)# ip dhcp smart-relay

 Allows the DHCP relay agent to switch the gateway address (giaddr field of a DHCP packet) to secondary addresses when there is no DHCPOFFER message from a DHCP Server.

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122cgcr/fipr_c/ipcprt1/1cfdhcp.htm#wp1010291
0
 

Author Closing Comment

by:jgarn
Comment Utility
The ip dhcp smart-relay along with the ip helper-address address command did the job.
0
 

Expert Comment

by:ahmedz123abc
Comment Utility
when you use sub-interfaces, the broadcast is turned to a unicast with the source address of the relevant sub-interface; you should then get the correct ip address from the relevant dhcp scope on the dhcp server
0

Featured Post

What Should I Do With This Threat Intelligence?

Are you wondering if you actually need threat intelligence? The answer is yes. We explain the basics for creating useful threat intelligence.

Join & Write a Comment

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
There are two basic ways to configure a static route for Cisco IOS devices. I've written this article to highlight a case study comparing the configuration of a static route using the next-hop IP and the configuration of a static route using an outg…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

7 Experts available now in Live!

Get 1:1 Help Now