Cisco Switch – How to Ignore or Block Upstream DHCP and Use Switch DHCP

ciscodhcpswitchvlan

edit: Simplified (drastically) question:

Problem:
I have a Cisco IE3000 L2 switch with SVI and DHCP support that needs to be connected to our LAN via the uplink port and to field equipment via the downlink? ports. I need the equipment connected to the downlink ports to ignore the upstream DHCP server and only receive ip addresses from the switch itself. I also need the switch to 'switch' network traffic between the uplink and downlink ports.

Right now, the only way i can do this is by disconnecting the uplink while the switch and downstream equipment boots up and assigns/receives IP addresses from the switch DHCP server. Then I reconnect the uplink and all is good.

If I leave the uplink connected while switch and downlink equipment boots, the downlink equipment receives ip addresses from the upstream DHCP server. This is a problem.

  • side question – when uplink is connected, what mechanism allows upstream dhcp server to override the local switch dhcp server? why doesn't the switch dhcp answer/assign an ip address to the downlink ports before main dhcp server does?

I also tried assigning all the downlink ports to a separate VLAN on the switch. This allowed the downlink ports to get proper IP addresses from the switch, even with the uplink connected, but obviously communication between the uplink port and downlink ports is not possible because they are on separate VLANS.

The vendor's solution is to put their dual-homed application computer between the field equipment switch and rest of the upstream network, but that seems a bit of a hack, and the field equipment environment is not conducive to PC longevity.

obviously any other methods are welcome if they achieve the same end.

Switch does not support inter-vlan communication/SVI routing but even if it did I think I would end up with the same result as option 1.

Best Answer

Your scenario is somewhat confuse. If I uderstand well you want to filtered DHCP request on L2.

You can achieve it by using the function DHCP Snooping features available on your platform.

You could set all ports in untrusted mode so only DHCP reply from the switch will be accepted.

DHCP Snooping - configuration guide

DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You use DHCP snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another switch.

Which is what you are looking, filtering DHCP communication between your hosts and upstream DHCP.

Related Topic