Cisco Switching/Routing :: Dhcp Snooping Without Effect In Catalyst 2960-PST-S
Apr 17, 2012
I have a new catalyst 2960,and i want to enable DHCP SNOOPING,but,it doesn't work,the server is stilling offert addresses IP and it's not connected in a trusted port,the schema is very simple:1 switch catalyst 2960 PST-S,1 server dhcp and 1 pc client,the PC and the server are in VLAN 10,DHCP SNOOPING is enabled in all ports and no port is trusted,but the client get addresse IP after retyping ipconfig /release and ipconfig /renew in dos commande.the configuration and the version of the switch are in the file attached.I tested the same configuration in a catalyst C3560-24PS and DHCP SNOOPING work normally,i tested in other catalyst 2960-PST-S,but the same probléme:DHCP SNOOPING without effect,the commands typed is:
-ip dhcp snnoping
-ip dhcp snooping vlan 10
View 5 Replies
ADVERTISEMENT
May 7, 2013
I have a problem with DHCP. I have two 2960 connected with a port channel on ports 47 and 48 as trunk with native vlan 10. I only have this one vlan. In port 1 of sw 1, I have a C800 as DHCP server.
I have an AP autonomous with single ssid on vlan 10. When I connect the AP to sw1, I receive dhcp with no problems.When I connect the AP to sw 2, I’m not getting IP by DHCP.I have DHCP snooping working on vlan 10 on both devices.
The ports where I connect the AP are access ports on vlan 10 config as trusted.The trunk ports are also configured as trusted.The port 1 of ws 1 that goes to the C800 is also configured as trusted.
figure out why I’m not getting IP by DHCP when I connect the AP to the SW 2.The only I notice is that when I connect the AP to sw 2, I get on SW 1 the message of packet drop by option 82, but even after configuring ip dhcp snooping information option allow-untrusted on both switches, the problem persists.
View 5 Replies
View Related
Sep 3, 2012
We have a DHCP SERVER implemented in a cisco router 2610.This router is connected to a switch cisco 2960 configured as DHCP SNOOPING. At the switch appear the next log message: [code] The ip address: 10.100.200.1 belongs to DHCP SERVER configured at router cisco 2610. What to do so these log messages does not appear any more? Do I need to do some configuration changes at some switch or router?
View 11 Replies
View Related
Jun 12, 2013
I Have a problem I'm trying to configure automatically my switch over ther DHCP when I start the switch it request an IP from the DHCP from here everythings is fine but it does nothing more,indeed I put on my dhcp the option 66 and 67 which is an adress of my TFTP server and a file to download and the switch seems not to understand theses options , I tried my dhcp with a cisco airport and everythings works fine the File from the TFTP is automatically downloaded into the airport...There is an option to add or am I missing something in order to make it work with my switch ?
My switch : Catalyst 2960IOS VER : 12.2(55)SE5
View 7 Replies
View Related
Jan 28, 2013
I am going to creat VLANs very 1st time therefore for test purpose I have following simple scnerio.I have created 2 VLANs , VLAN2 and VLAN3 on Cisco Catalyst 2960 series switch. Ports 1-12 is assigned to VLAN2 and Ports 13-24 are assiged to VLAN3. Now I have configured DHCP on Microsoft Server 2003 defining 2 scopes with following configurations.
Scope 1 for VLAN 2--- Range is 172.16.0.17 to 172.16.0.30 with subnet mask=255.255.255.240 . Server IP address 172.16.0.17
( Note: Address 172.16.0.17 is excluded from dhcp server Scope 1 and give to the MS server itself)
Scope 2 for VLAN 3----Range is 172.16.0.33 to 172.16.0.46 with subnet mask=255.255.255.240 .
Now in Cisco 2960 series switches, under Vlan 2 and Vlan 3, I have following configurations...
interface Vlan2
ip address 172.16.0.30 255.255.255.240
ip helper-address 172.16.0.17
interface Vlan3
ip address 172.16.0.46 255.255.255.240
ip helper-address 172.16.0.17
Now the problem is when i connect a client computer to any port from 1-12, It gets correct IP address from Scope 1 but when I connect a computer to any port from 13-24, it does not get the ip address.
Further I want to do inter VLAN comunication as well for that purpose i Have an ISR 2900 series router. What further configuration i will have to do on router for inter vlan communication.
View 3 Replies
View Related
Nov 24, 2011
Our switch model is "Cisco Catalyst Blade Switch 3020 for HP" We are building HA (High Availability) Databases infrastructure.Currently, there are two nodes(hosts- servers) and two above switch for HA.
Oracle said we need to turn off the IGMP Snooping in order to use the multicasting for their interconnect communication.So my question is:
Q1> Is there any way to use Multicasting without turning off IGMP Snooping on Switch side?
Q2> If 'yes', how can we configure the switch for Multicasting ?
Oracle uses 230.0.1.0 & 224.0.0.251 IPs with 42000 range port for Multicasting communication.
View 1 Replies
View Related
Sep 27, 2012
I have a problem at a place where 5 ME3400 switches are connected in a straight line. I can't do much about the topology of that place, but the problem is they are all DHCP Snooping, but uni cast replies from the dhcp server further up the hierarchy gets eaten by the first switch! I can't really see why it not only inspects in and whines about it not being for itself - it then drops the message.
What have we done wrong (apart from the actual layout of that place, which I can't really change)?
Sep 28 13:49:29: DHCP_SNOOPING: received new DHCP packet from input interface (GigabitEthernet0/1)
Sep 28 13:49:29: DHCP_SNOOPING: process new DHCP packet, message type: DHCPOFFER, input interface: Gi0/1, MAC da: 7444.012d.debd, MAC sa: 0013.1a4a.65c7, IP da: XX.YY.186.7, IP sa: XX.YY.186.1, DHCP ciaddr: 0.0.0.0, DHCP yiaddr: XX.YY.186.7, DHCP siaddr: 0.0.0.0, DHCP giaddr: 0.0.0.0, DHCP chaddr: 7444.012d.debd
Sep 28 13:49:29: DHCP_SNOOPING: binary dump of option 82, length: 20 data:
[Code] ......
It really should just send it on, as with any uni cast not on the switch itself - it should go out Gi0/2 really. Why isn't it?
[core] -- [sw1] -- [sw2] -- [sw3] -- [sw4] -- [sw5]
All the trunks are trusted, DAI is on (I've tried shutting it off, as well), port-security is used but it's actually not dying on the switch having the client computer, but the first one in the chain with dhcp snooping.
View 6 Replies
View Related
Mar 2, 2013
I have a problem with high CPU load by DHCP Snooping process on Catalyst 6506 (WS-SUP720-3B, soft: s72033-ipservices_wan-mz.122-18.SXF11.bin). I have it enabled on 15 VLANS, in which there are subscriber devices residing, and sending DHCP requests through Cisco to DHCP server (Cisco acts as DHCP relay, and it's collecting the snooping database, I also use DAI).
Snooping database contains 6962 bindings now.
CPU load goes high only sometimes, and I don't have a clue, why it's going so high. It can load as high as 45-47% of CPU, like this:
PID Runtime(ms) Invoked uSecs 5Sec 1Min 5Min TTY Process
116 81471244 322596368 252 42.95% 43.48% 36.06% 0 DHCP Snooping
When the load is high, the command: show ip dhcp snooping statistics is showing, that the overall quantity of
Packets Processed by DHCP Snooping is increasing rapidly. In normal situations, it's like 10-20 packets per second, but when the load is high, it's 1000-10000 pps.
But when I look at SPAN from my subscriber's VLANS, I don't really see any flood of DHCP requests, or something like that - everything looks as usual. Maybe, some of subscriber's devices are sending incorrect DHCP requests, that are causing packets to loop inside RP, or something like that? How can I detect that thing?
Also I thought, that if I enable the ip dhcp snooping trust mode on all of the Catalyst interfaces, the DHCP snooping will not process the subscribers DHCP packets, and I can, by exclusion of interfaces from one to one, detect, from which interface the problem is originating. But this seems to be incorrect, I turned the ip dhcsp snooping trust on all interfaces, and I still get spikes of CPU load by DHCP snooping process. Why it's still examining packets, even on trusted interfaces, is it ok?
And one more question - if I disable the ip dhcp snooping globally, will it clear all my existing bindings in snooping database?
View 3 Replies
View Related
Oct 12, 2011
I have attempted to implement DHCP snooping and have been having some strange issues. I have 5 3560s taht I use for my edge and when I attempt to implement on all five, the VLAN that houses my voice data appears to no longer be able to recieve DHCP lease renewals so after the 24 expiration all of my phones lose their configs. Once I roll back the changes the voice VLAN comes back. The other VLANs seem to function correctly as theya re able to renew their DHCP addresses.
The 3560s tie into each other using GIG Ports 1 & 2 and the top and bottom switches tie into our core switch, a 4507. The config that I use is below, failry simple and straightforward.
4 of the 5 switches feed our general office vlans for voice and data however the 5th switch is there for expansion and not in use. As such I have left the config changes in place on it and have tied myself and a colleague into it and have been operating fine for over a week now. So the config that I use seems sound in theory and should work on the other 4 switches with no issue.
View 14 Replies
View Related
Apr 9, 2012
I am working in a environment that is classed as collapssed Layer 3 environment. We have a core 6500 with routed links to 3560's which are access switches.
We have layer 3 vlans on the access switches, one for data one for voice.On the layer 3 vlans we have ip helper addresses that are used for DHCP. The DHCP servers are located on the 6500.
I recently had a incident where someone plugged a netgear router into a desk point because they thought they could use it for a switch. This router then started to dish out IP addresses to people in the morning for those who came in and docked their laptops. 99% of people weren't affected because they have desktop PC's are their leases hadn't expired.
Now we have bpduguard, bpdufilter to prevent people from plugging in switches that send out BPDU's. However this doesn't prevent the above senario where someone plugs a router or a 'dumb' switch that doesn't send BPDU's.Because of the above senario I started looking at DHCP Snooping, but I am unsure on a couple of things.
With the topology of our network I understand that I don't need to configure IP DHCP Snooping Trust on the L3 uplinks to our core switch. From what I understand I just need to enable IP DHCP Snooping globaly and then on the VLAN's on the access switch (because of the L3 topology VLAN's are local to the access switches). Only if I had L2 uplinks to the core would I need to configure IP DHCP Snooping Trust on the trunk links.
View 2 Replies
View Related
Jan 18, 2013
I am trying to understand the basics of DHCP snooping. I have a just a 3560 switch and a laptop ( to get a DHCP address) and my DSL router which has a DHCP server running. On the switch I have enabled "IP DHCP Snooping" and "IP DHCP Snooping VLAN 1" plugged the laptop and DSL router in and the laptop gets and IP address, should it?
I thought all ports were untrusted by default so the DHCP server should be blocked at offering IP addresses? If I wanted the DHCP server to be allowed to offer IP's I thought I should need to trust the port.
View 3 Replies
View Related
Nov 24, 2011
I got some problem with enabling dhcp snooping on 4500 (cat4500e-lanbasek9-mz.122-54.SG.bin) the topology is as below: dhcp snooping enabled only on CORE (with interface trusted to dhcp server)the problem is that I put these 2 commands
ip dhcp snooping
ip dhcp snooping vlan 1
but it is not enabled on any vlan
SW-CORE#sh ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
none
DHCP snooping is operational on following VLANs:
[Code]...
On B1 if I turn it on there is a "1" in the section " DHCP snooping is configured on following VLANs:" but on core no.As you can see I did put the trusted on the interface in the direction to the dhcp.First I thought it can be a problem with option 82, I've read a lot about the issues with that, but the problem would be explicable if the client did receive IP address, but it does.
View 3 Replies
View Related
Nov 14, 2012
I am trying to find a command for dhcp snooping rate-limiting on a CatOS. The PFC card is PFC. PFC3B is said to support that command. But there seems no this command.
-6k> (enable) sh ver
WS-C6509-E Software, Version NmpSW: 8.4(5)
Copyright (c) 1995-2005 by Cisco Systems
NMP S/W compiled on Aug 3 2005, 13:26:46
[Code] ......
Up time is 1183 days, 1 hour, 41 minutes
View 3 Replies
View Related
Jan 9, 2013
I recently installed DHCP snooping on a 3750v2 switch (Version 12.2(55)SE4) and configured the uplink(Po2) as a trusted port. The problem is that clients cannot receive an IP address. When I disable DHCP snooping it is working properly. DHCP snooping is configured correctly but I don't have an idea how to resolve it. [code]I tested the solution on the same kind of hardware switch and firmware and it worked out fine. What is causing the clients not to receive an IP address from the DHCP server?
View 10 Replies
View Related
Feb 10, 2011
Just spoke to the TAC and didn't get the information needed. When configuring ip dhcp snooping database I am adding this to my configuration:ip dhcp snooping database scp://dhcpsec@192.168.1.50/home/dhcpsec/switch1.dhcp.database.txt..I assumed that to do this I would either specify the password on the command line, similar to the way its done when using ftp/http, or that I would need to create a public/private key.I have enabled scp and can manually copy a file from the switch to the linux server. So I believe I have all the aaa commands correct. Cisco WS-C3560G-24PS System image file is "flash:/c3560-ipservicesk9-mz.122-55.SE.bin".
View 3 Replies
View Related
Feb 14, 2012
does Cisco 2600 series switch support 802.1x and DHCP snooping?
View 6 Replies
View Related
Oct 8, 2012
i have a strange problem in my campus network.im trying to run port security on my access switches which they are 3550 with ios c3550-ipservicesk9-mz.122-52.SE when i run the port security with Sticky option, even i put 1000 mac address for just learning on the port but when i issue the switchport port-security command every pc connected to that port loses its connection with network UNTIL i enable dhcp snooping!!! all my client are getting they ip address from DHCP server but strange thing is that how on earth i have to enable DHCP snooping to port security work properly? also when i check the configuration under the interface when dhcp snooping is not yet enabled switch doesnt add any mac address under the interface so no one can work until i enable snooping and then switch adds mac addresses under the interface configuration.is this Bug on this version of IOS?[code]
View 4 Replies
View Related
Sep 24, 2012
we've an infrastructure were the Access is based on Cat3750G Stacks connected to both Cores using L3 connections.On the Access Switches are implemented the following features DHCP Snooping, IP Source Guard and Dynamic ARP Inspection and all is working fine since years...the DHCP Servers are on a dedicated stack which act as a SFarm.
On the Access Switches the port configuration is the following:the Uplink Ports to both of the Cores are configured in TRUST for DHCP Snooping and ARP Inspection the Access Ports, where the end-device are connected, are UNTRUST for DHCP and ARP Inspection with IP Source Guard Active Right now I've to add a new L2 switch on one of the Access Port and I'm wondering if this is possible since I've to keep on the Stack Access Ports all the security feature active and I've also to implement DHCP Snooping on the new L2 switch to avoid rouge DHCP Server...
I suppose that the uplink to the L2 switch on the Stack Access Switch should be left as it is connected to an end device...but the uplink port on the L2 switch should be set up as TRUST...isn'it? Keeping in mind that I want to implement DHCP Snooping also on this L2 switch to avoid that Rogue DHCP Servers will impact the end-device connected to this L2 switch...is this scenario possible??? or I can't do that and should leave DHCP Snooping only on the Access Stack.
View 2 Replies
View Related
Sep 14, 2010
I've configured ip dhcp snooping on several vlans I want to monitor and the binding table doesn't seem to be building.eature DHCP is on, global ip dhcp snooping is enabled, VLAN snooping is enabled on the vlan's I want to monitor and my trusted interfaces are also configured. Alas no binding entries in the table! 7K is running 4.2(6).
View 1 Replies
View Related
Sep 25, 2012
I need to apply DHCP snooping on 4500 series switches working as L2 in my Network. We have external DHCL Server in another location connected with 6500 series switch.
Running EIGRP Configured Voice & Data Vlan both
DHCP Server -------- 6509 switch<----------------------------------->6509 Switch -------- 4500 switch ----------------------------------------------------------Ip Phones.
(ving Redundant) (ving Redundant)
I need to know whether the configuration which I mentioned in scenario is enough for apply DHCP snooping in my network.
View 4 Replies
View Related
Jun 13, 2012
I'm having trouble setting up SSH on my new Switch.
no aaa new-model
aaa authentication login default local
ip domain-name king.local
[Code].....
I would like to be able to use Vlan 10 192.168.155.1 for SSH remote management.
View 11 Replies
View Related
Mar 18, 2013
I have Catalyst 2960 S (WS-C2960S-48FPS-L) Switch. I have plugged in SFP module but still interface is down and line protocol down. Is there any configuration to enable SFP module and make the interface up?
This port is connected to nexus 5 k.
View 11 Replies
View Related
Aug 20, 2012
i try to implement layer 2 qos in 2960. when i complete to configure the switch, i want to test the qos.PC1 conect to switch port 1,PC2 conect to switch port 2 . PC1 is source teminal. i use skydata.exe and FTP for the test.
when use the skydata ,the PC2 speed can reach 10mbps.when use the FTP , the PC2 only can reach 1.2mbps. why?
View 3 Replies
View Related
Apr 29, 2012
I can use Putty to SSH into my new switch (Directly connected to my laptop with ethernet cable), but I cant log into my switch.
Sent username "admin"
admin@192.168.251.1's password:
Access denied
It doesnt like my password, but I have only set 1 password (king) on this switch. I've configured 3 other switches with SSH and had no problem. Been trouble shooting for awhile and It'd be great if I could have a 2nd set of eyes take a peek, Also, my running config is attached.
View 5 Replies
View Related
Dec 1, 2012
How would I go about stacking 4 Cisco Catalyst 2960-48PST-L switches? The one switch needs to accept a fiber connection from a distribution switch. Do I have to buy flexstack module and cables? If so where does the module go on the switch? If this switch cannot do this set up, any other switch I should look at.
View 6 Replies
View Related
Sep 20, 2012
Will catalyst2960 supports SSH, and how to configures with CLI.
View 2 Replies
View Related
Apr 9, 2012
I need to upgrade a Catalyst IOS, but I got a bit confused. The catalyst is currently running "c2960-lanbase-mz.122-35.SE5.bin", but I want to upgrade to "c2960-lanbasek9-mz.122-35.SE5.bin", in order to enable ssh. [code] What are the appropriate steps in order to upgrade to "c2960-lanbasek9-mz. 122- 35. SE5.bin". I have downloaded the tar file (c2960-lanbasek9-tar.122-35.SE5.tar)
1) Do I have to delete the old directory (drwx 192 Mar 1 1993 02:07:21 +02:00 c2960-lanbase-mz.122-35.SE5)?
2) Are these the correct steps to download and extract the IOS?
3) Where will the tar files be extracted? Will an new directory be made or do I have to make one manually?
View 3 Replies
View Related
Dec 15, 2012
I have packet loss with QoS configured and I was wondering is it somehow connected with the QoS configured on the switch.The traffic is passing through fa0/19 and gi0/1 interfaces.
mls qos map cos-dscp 0 8 16 24 32 46 48 56
mls qos srr-queue input bandwidth 90 10
mls qos srr-queue input threshold 1 8 16
mls qos srr-queue input threshold 2 34 66
[code]...
View 2 Replies
View Related
Feb 17, 2013
I have 4 Catalyst 2960 connected via Etherchannel to each other. If I plug in my notebook in one port, I see the traffic from the neighbor port. So my switch acts like a hub.. I had a look at my MAC table and saw it isn't full.
View 2 Replies
View Related
Feb 9, 2012
I have ciscl catlyst 2960 8port switch, (flash:c2960-lanbasek9-mz.122-50.SE4/c2960-lanbasek9-mz.122-50.SE4.bin).
and in need to configure bandwidth limit for one of the port as a 1Mbps.
View 5 Replies
View Related
Jan 8, 2013
In an attempt to restore a Cisco IOS I deleted the file C2960-lanbasek9-mz.122-53.SE2.bin my swich
Before deleting the same was as follows:Directory of flash :/
3-rwx 12824 Mar 28 1993 21:00:37 -03:00 vlan.dat4-rwx 3096 Mar 7 2012 08:43:37 -02:00 multiple-fs5-rwx 2289 Mar 7 2012 08:43:37 -02:00 private-config.text6-rwx 7482 Mar 7 2012 08:43:37 -02:00 config.text9 drwx 192 Mar 23 2012 16:18:54 -03:00 C2960-lanbasek9-mz.122-53.SE2
32514048 bytes total (20204544 bytes free)Switch-01 #
Right now this switch as follows:
switch: dir flash:Directory of flash:/
2 drwx 64 <date> crashinfo_ext 3 -rwx 4120 <date> multiple-fs 5 -rwx 12824 <date> vlan.dat 6 -rwx 4018 <date>
[Code].....
View 4 Replies
View Related
Dec 25, 2011
I need to know if Cisco Switch 2960 support Netflow. If it doesn't, how do I configure the switch to enable Netflow?
View 3 Replies
View Related
Mar 21, 2013
I have a Catalyst 2960-S switch and a pre-standard IP Phone (Cisco 7960). When I connect the phone to the switch the switch recognizes the phone and supplies power. I would like to prevent this behaviour. ie. I would like to disable detection of pre-standard equipment. Is there a command I can issue on the 2960-S to do this? For example, on a switch from a different vendor I can issue the command: no power pre-std-detect to prevent it from detecting the 7960 phone, is there an equivalent command on the Catalyst 2960-S ?
View 3 Replies
View Related
