This document explains issue that the customer may encounter if the DHCP snooping is enabled on the Layer-3 switches.
This document is applicable to all the Dell networking switches.
Overview:
DHCP snooping is a security feature that builds the binding table using DHCPACK message. The relay agent checks all subsequent DHCP client-originated IP traffic (DHCPRELEASE, DHCPNACK, and DHCPDECLINE) against the binding table to ensure that the MAC-IP address pair is legitimate and that the packet arrived on the correct port. Packets that do not pass this check are forwarded to the server for validation. This checkpoint prevents an attacker from spoofing a client and declining or releasing the real client’s address.
Binding table entries are deleted when a lease expires, or the relay agent encounters a DHCPRELEASE, DHCPNACK, or DHCPDECLINE
Topology:
DHCP Snooping on the Layer-3 switches with redundant links:
In the above topology, the ARP for the host 10.0.0.100 is learned on the VLAN 10 through the Layer-2 interface Te 0/1.
Dell# show arp ip 10.0.0.100
Protocol Address Age(min) Hardware Address Interface VLAN CPU
----------------------------------------------------------------------------------------
Internet 10.0.0.100 9 00:00:00:ab:cd:ef Te 0/1 Vl 10 CP
If the DHCP snooping is enabled, the switch will capture the DHCP messages from the host and build the DHCP snooping binding table.
Dell#show ip dhcp snooping binding
Codes : S - Static D - Dynamic
IP Address MAC Address Expires(Sec) Type VLAN Interface
====================================================
10.0.0.100 00:00:00:ab:cd:ef 86008 D Vl 10 Te 0/1
This binding will internally created a static ARP for the host as below.
Dell#Show _arp
Vrf-ID:0 Owner:0 Clients:0 Service:0x2 Asked:0IsMgid:0Mgid:0
Internet 10.0.0.100 - 00:00:00:ab:cd:ef Te 0/1 Vl 10
As mentioned earlier, the DHCP binding table will get cleared only when when a lease expires, or the relay agent encounters a DHCPRELEASE, DHCPNACK, or DHCPDECLINE. The interface failure will not clear the binding table.
If the interface Te 0/1 goes down, the ARP will be moved to VLAN 10 – Te 0/2.
Dell# show arp ip 10.0.0.100
Protocol Address Age(min) Hardware Address Interface VLAN CPU
----------------------------------------------------------------------------------------
Internet 10.0.0.100 0 00:00:00:ab:cd:ef Te 0/2 Vl 10 CP
Though the ARP and MAC for the host are moved to a different interface (Te 0/2), the binding table and internal ARP entry will continue to point to Te 0/1 untill the host release the IP or lease time expires.
Due the mismatch betweem the regular and internal ARP table, this entry will not be writted on the FIB and CAM tables.
Dell# show arp ip 10.0.0.100
Protocol Address Age(min) Hardware Address Interface VLAN CPU
----------------------------------------------------------------------------------------
Internet 10.0.0.100 0 00:00:00:ab:cd:ef Te 0/2 Vl 10 CP
Dell#show _arp
Vrf-ID:0 Owner:0 Clients:0 Service:0x2 Asked:0IsMgid:0Mgid:0
Internet 10.0.0.100 - 00:00:00:ab:cd:ef Te 0/1 Vl 10
Dell#show ip fib stack-unit 0 10.0.0.100/32
<empty>
Dell#
Since the CAM table is not updated, all the layer-3 packets destined to the host (10.0.0.100) will be soft switched. This behavior will cause the high latency and CPU overload.
Recommendation:
In the network with redundant links where the host move is expected between the interfaces, it is recommended to configure the DHCP snooping only on the Layer-2 switches.