vlan and dhcp

[ful56_uk]

Ok strange problem, not sure what else to look at.

 

A pc which sits in vlan3 doesn't get the correct IP from the dhcp server. It's gets one from vlan1

 

Vlan 3 has its own range on the dhcp server.

 

DHCP servers gateway is set to vlan 1 ip 10.35.248.130

 

A manual IP from the van 3 range for that pc lets you ping the gateway (layer 3 hp switch)

 

Also lets you ping its own gateway (ip address for the vlan on the hp switch)

 

The IP helper address is set to the dhcp server which sits in vlan 1

 

All the other vlans work correctly. Any help would be great as i can’t work this out.

 

Config from layer 3 switch

 

Running configuration:

 

; J8698A Configuration Editor; Created on release #K.15.16.0004

; Ver #06:74.fc.7f.ff.3f.ef:de

hostname "Core-01"

module 1 type j9534a

module 2 type j9536a

module 3 type j9534a

module 4 type j9534a

module 5 type j9550a

module 6 type j9550a

module 7 type j9550a

module 8 type j9546a

module 9 type j9550a

module 10 type j9550a

module 11 type j9538a

module 12 type j8706a

fault-finder broadcast-storm sensitivity high

fault-finder bad-driver sensitivity high

fault-finder bad-transceiver sensitivity high

fault-finder bad-cable sensitivity high

fault-finder too-long-cable sensitivity high

fault-finder over-bandwidth sensitivity high

fault-finder loss-of-link sensitivity high

fault-finder duplex-mismatch-hdx sensitivity high

fault-finder duplex-mismatch-fdx sensitivity high

fault-finder link-flap sensitivity high

trunk E24,F24,G24 trk1 trunk

trunk B21,K8 trk2 trunk

trunk J19-J20 trk3 trunk

trunk J21-J22 trk4 trunk

trunk J23-J24 trk5 trunk

trunk G19-G21 trk10 trunk

timesync sntp

ip default-gateway 172.16.100.1

ip directed-broadcast

ip route 0.0.0.0 0.0.0.0 172.16.100.1

ip route 172.16.0.0 255.255.255.0 172.16.0.1

ip routing

ip udp-bcast-forward

interface B20

name "ICT Office Uplink"

exit

interface E1

lacp active

name "Printers"

exit

interface E2

lacp active

name "Printers"

exit

interface E3

name "Printers"

exit

interface E4

name "Printers"

exit

interface E5

name "Printers"

exit

interface E6

name "Printers"

exit

interface E7

name "Printers"

exit

interface E8

name "Printers"

exit

interface E9

name "Printers"

exit

interface E10

name "Printers"

exit

interface F1

lacp active

exit

interface F2

lacp active

exit

interface G1

lacp active

exit

interface G2

lacp active

exit

interface G5

name "Internet"

exit

interface J19

name "Trunk to Edge 01"

exit

interface J20

name "Trunk to Edge 01"

exit

snmp-server community "public" unrestricted

snmp-server host 10.35.248.45 community "public"

snmp-server host 192.168.100.51 community "public"

snmp-server location "Server Room"

vlan 1

name "DEFAULT_VLAN"

no untagged B18,B20,F1-F23,G5

untagged A9-A24,B1-B17,B19,B22,C1-C24,D1-D24,E1-E23,G1-G4,G6-G18,G22-G23,H1-H8,I1-I24,J1-J18,K1-K7,L1-L24,Trk1-Trk5,Trk10

tagged A1-A8

ip address 10.35.248.130 255.255.252.0

ip forward-protocol udp 10.36.15.255 7

ip forward-protocol udp 10.36.15.255 9

ip igmp

exit

vlan 2

name "WLAN_CLt"

tagged A1-A8,B22

ip address 10.36.0.1 255.255.248.0

ip helper-address 10.35.248.41

exit

vlan 3

name "Wired_Clt"

untagged B18,B20,F1-F23

tagged A1-A8,E23,K1-K7,L1,Trk1-Trk5,Trk10

ip address 10.36.8.1 255.255.248.0

ip helper-address 10.35.248.41

ip igmp

exit

vlan 5

name "SPC_IPADS"

tagged A1-A8,B22

ip address 10.36.16.1 255.255.248.0

ip helper-address 10.35.248.41

exit

vlan 6

name "Sixthform_Wifi"

tagged A1-A8,B22

ip address 10.36.24.1 255.255.248.0

ip helper-address 10.35.248.41

exit

vlan 11

name "Internet"

tagged A1-A8,E23,K1-K7,L1,Trk1-Trk2,Trk10

no ip address

exit

vlan 12

name "Internet_GW"

untagged G5

tagged A1-A8,E23,K1-K7,L1,Trk1-Trk2,Trk10

ip address 172.16.100.2 255.255.255.0

exit

vlan 13

name "Mgmt_AP"

untagged A1-A8

tagged E23,K1-K7,L1,Trk1-Trk2,Trk10

ip address 172.16.101.1 255.255.255.0

ip helper-address 10.35.248.41

exit

vlan 41

name "Guest"

tagged A1-A8,B22,E23,K1-K7,L1,Trk1-Trk2,Trk10

ip address 172.16.0.1 255.255.248.0

ip helper-address 10.35.248.41

exit

spanning-tree Trk1 priority 4

spanning-tree Trk2 priority 4

spanning-tree Trk3 priority 4

spanning-tree Trk4 priority 4

spanning-tree Trk5 priority 4

spanning-tree Trk10 priority 4

no spanning-tree bpdu-throttle

no autorun

no dhcp config-file-update

no dhcp image-file-update

password manager

password operator

 

Edge

 

; J9280A Configuration Editor; Created on release #Y.11.44

 

hostname "Edge-02"

trunk 43-44 Trk4 Trunk

snmp-server community "public" Unrestricted

snmp-server host 10.35.248.45 "public"

snmp-server host 192.168.100.51 "public"

vlan 1

name "DEFAULT_VLAN"

untagged Trk4

ip address 10.35.248.132 255.255.252.0

no untagged 1-42,45-48

ip igmp

exit

vlan 3

name "Wired"

untagged 1-42,45-48

tagged Trk4

exit

gvrp

no stack

spanning-tree Trk4 priority 4

 

Many thanks

[6Foot2]

A while ago one of our classroom machines was getting an IP from the server range even though the workstation and the servers were separated by at least one layer of switches. The answer was tagging on the port of the edge switch that the PC was attached to: It was tagged with the servers VLAN.

 

Helpful?

[FN-GM]

You should never ever use vlan 1. When traffic goes between switches on trunk it applies a temporary "header" to the packet so it knows what VLAN it has come from. So when it reaches the other switch, that switch knows what vlan to put the packet into. This happens on all VLANs apart from VLAN 1, the switch does not apply a header for traffic coming from VLAN 1. This means with a bit of software people can apply there own header and send the packets to another VLAN. This means the traffic can be sent to secure VLANs bypassing security (such as ACL's etc) you have in place.

 

I would discontinue the use of VLAN 1 and use any other number. The other option is to change the native VLAN on your trunks to another and don't use that new VLAN. But this can cause all sorts of problems when trunking between devices.

 

Actually because of the lack of VLAN tagging on trunks it may actually be the cause of this issue. On a Cisco setup, I have seen people put a DHCP in VLAN 1 and it dishes out IP's to all VLANs. They moved DHCP to another VLAN and it resolved the issue.

Edited November 10, 2014 by FN-GM

[ful56_uk]

Ok thanks for the info. The edge and the core are using truck which are tagged in vlan 3. On a wire track I see dhcp nak.

[ruddj]

We had a similar problem when Super Scopes were configured in AD DHCP server.

[mukz]

I second Ruddj's comment, My predecessor set up a superscope and when i redid the network design and changed it all to a normal scope, worked perfectly fine.

[ful56_uk]

Thanks for the advice. Not using superscopes in dhcp each vlan has its own range