D-Link DGS-1210 DHCP Relay Option 82

3

I'm having problems with DHCP relay (option 82) on a DGS-1210-10 switch. The configuration is:

  • Port 1-8 is untagged VLAN 80 (this is also PVID) Port 9 and 10 are tagged VLAN 80 and 99 (where 99 is my management VLAN)

  • The switch has a static IP on VLAN 99 (management).

  • Clients are connected on ports 1-8.

I would like the switch to insert DHCP Relay Agent Information Option (Option 82) on the DHCP messages in order to identify the port.

I've done this on other switches, but cannot get it to work on a D-Link DGS-1210

This is what I've tried:

  1. Enabled DHCP Relay State under DHCP Relay -> DHCP Relay Global Settings (and nothing else). DHCP Relay Agent Information is not inserted, and the switch seems to do nothing at all.

  2. Enable DHCP Local Relay Status and Config VLAN by VID 80. DHCP Relay Agent Information is inserted but the reply from the DHCP server is dropped by the switch. The client cannot see the reply and keeps sending discovery messages.

  3. Under DHCP Relay Interface Settings I can set the DHCP-server, but then the DHCP messages are coming in on another interface. I can configure the DHCP server to listen to both interfaces, but then I get the warning Multiple interfaces match the same shared network: eth0 eth1. eth1 is the wrong interface. I need the DHCP server to listen to eth0.

My question is: Is there a way to configure the DGS-1210 to simply insert DHCP Relay Agent Information (Option 82) on DHCP messages? I'm out of options. I should probably get another switch.

Giving the switch an IP in my DHCP subnet is not an option.

Edit: I would like to point out a few things.

1) I agree that the DHCP Relay Agent is not necessary for DHCP to work. After all my DHCP server is on the same subnet (broadcast domain) as the clients.

2) I disagree that a DHCP Agent cannot be run on a Layer 2 switch, although I agree that it is not necessary. It can be done however, and my DGS-1210 does it. I can see the DHCP Relay Agent Information with a packet sniffer like tcpdump.


Edit:

Consider this scenario:

I would like my DHCP server to assign IP addresses to clients based on what port the client is connected. If the client is on port 1 I would like it's IP to be 192.168.0.1, the client connected to port 2 should get 192.168.0.2, and so on. Now we need information from the switch. This can be done by SNMP, but that would probably be slow. So what if the DHCP DISCOVER message contained the port? Yes, that's where Option 82 comes to play. The Circuit ID could contain the port. And that is what switches do. The switch inserts Option 82 in the DHCP messages and forwards the messages to the DHCP server.

Jeff Merlin

Posted 2016-11-12T15:01:28.913

Reputation: 61

That is a layer-2 switch. You should be configuring the DHCP relay agent on a layer-3 device (your router). DHCP will work correctly on layer-2 because broadcasts work across the layer-2 broadcast domain. It is layer-3 that needs the help because broadcasts do not cross a layer-3 device. – Ron Maupin – 2016-11-12T16:30:03.057

Ron, the point is I want to know what port on a switch a client is connected to. Only the switch knows that. Hence the switch (even if it is a Layer2-switch) should act as a relay agent. And indeed it does. The manual says: "the relay agent will insert and remove DHCP relay information (option 82 field) in messages between DHCP servers and clients" . – Jeff Merlin – 2016-11-12T16:42:30.560

That is not where you would put a DHCP relay agent. You would put it on the router interface for the LAN. It is the router that needs the help to send a DHCP request to another LAN. – Ron Maupin – 2016-11-12T16:44:11.093

Ron, no one need help (except me) ;-) Could you please explain how the router would know the port number on another switch? – Jeff Merlin – 2016-11-12T16:52:50.900

The router, or any host on the LAN, doesn't need to know anything about switch ports. The switch builds a MAC address table that relates MAC addresses to the ports where the MAC addresses came in. The hosts (a router is a host on the LAN) simply address frames with MAC addresses, and the switch sends the frames to the correct port. If the MAC address is not in the MAC address table, the switch floods the frame to every other port. Hosts will send to the router MAC address the when the IP address is on a different LAN. DHCP requests are broadcast to every host on the LAN, including the router. – Ron Maupin – 2016-11-12T16:59:10.817

Option 82 was designed to allow a DHCP Relay Agent to insert circuit specific information into a request that is being forwarded to a DHCP server. The Circuit ID sub-option is supposed to include information specific to which circuit the request came in on. It's an identifier that is specific to the relay agent, so what kind of circuit is described will vary depending on the relay agent. In an Ethernet-based network this is probably a port on a switch. That's what I want. And the DGS-1210 is capable of doing that, even if it's just a Layer2-switch. – Jeff Merlin – 2016-11-12T17:01:05.720

Option 82 is used by a router to package a broadcast DHCP request and send it to a DHCP server on a different LAN. The router acts as a DHCP relay agent, but this must be configured on the LAN interface of the router. DHCP on a LAN where the requester and the DHCP server both are doesn't need Option 82 because the DHCP server will receive the broadcast DHCP request. If both are on the same LAN, DHCP work without Option 82. Hosts on a LAN, including the DHCP server know nothing about switches or switch ports, and they don't need to. – Ron Maupin – 2016-11-12T17:04:44.697

Ron, I don't think you understand. Let's say this is a switch, some clients a DHCP server AND NOTHING ELSE. No router at all. The DHCP server still wants to know what port on a switch a client is connected to. There is no router to run a DHCP Relay Agen on. What do we do? Run the agent on the switch. See? – Jeff Merlin – 2016-11-12T17:04:46.760

No, you are incorrect. No host on a LAN is even aware of a switch or the switch ports. A switch is a transparent device. Option 82 is not needed on a LAN. – Ron Maupin – 2016-11-12T17:05:43.197

So why does the DGS-1210 have a DHCP Relay agent???? – Jeff Merlin – 2016-11-12T17:07:44.173

Probably because it share a common code with layer-3 switches by the same manufacturer. I will add a detailed answer about how this works. – Ron Maupin – 2016-11-12T17:10:21.943

Hehe... Well, it works on a DES-3010G... Just as expected. :-) – Jeff Merlin – 2016-11-12T17:11:59.240

It will work on the switch without Option 82 if both the DHCP server and requesting host are on the same LAN. I will explain in my answer. – Ron Maupin – 2016-11-12T17:13:01.103

When I say "it works" I mean the Circuit ID is inserted in the Option 82 info. That has nothing to to with subnet, DHCP server or router. It's done by the switch and no one else! ;-) – Jeff Merlin – 2016-11-12T17:20:08.263

My point is that it is unnecessary on a LAN. Option 82 was designed to help routers package a broadcast DHCP request to send it to a different LAN because broadcast cannot leave the LAN on which they were originated. This tells the DHCP server that this was done, and it should send the DHCP Offer back to the router, rather than sending it back on its own LAN. – Ron Maupin – 2016-11-12T17:23:11.437

By the way, when you edit a question, especially when it changes the question, you should MARK the edit in the question. – Ron Maupin – 2016-11-12T18:25:17.810

The question is not changed. I still want to know if it is possible to configure the DGS-1210 to add Option 82 information to DHCP messages like the DES-3010 does. The scenario I added was to give an example of why I need a relay agen on a Layer 2 switch. You said "You should be configuring the DHCP relay agent on a layer-3 device" and that doesn't work (or is pretty pointless). – Jeff Merlin – 2016-11-12T22:20:31.110

Answers

2

Answering my own question. After tried everything, I think the only way to make this work is to let the switch forward DHCP messages on its management VLAN. That is option 3 in my original question.

Under DHCP Relay Interface Settings I can set the DHCP-server, but then the DHCP messages are coming in on another interface. I can configure the DHCP server to listen to both interfaces, but then I get the warning Multiple interfaces match the same shared network: eth0 eth1. eth1 is the wrong interface. I need the DHCP server to listen to eth0.

Insertion of Agent Circuit ID and Agent Remote ID is done as expected with no problems at all, despite this being a Layer 2 switch. It may have some Layer 3 functionality hidden somewhere. :-)

The DHCP server is happy, except for the warning Multiple interfaces match the same shared network. Yes, the DHCP server is right; There are multiple interfaces on the same shared network, but that the way is it...

A solution to this would be to bridge the two interfaces, but as long as it works I'm fine.

Please note: This question was about D-Link DGS-1210 series switches, not how to use (or not to use) a DHCP Relay Agent. DGS-1210 is able to act as a DHCP Relay Agent. This can be configured from the web interface. It is also documented in the manual.

Jeff Merlin

Posted 2016-11-12T15:01:28.913

Reputation: 61

0

Based on your comments, I think you misunderstand DHCP relay agents and DHCP Option 82. I will explain this below.

You need to understand the difference between layer-2 (MAC) addresses and layer-3 (IP) addresses, and how they are used.

Layer-2 addresses are used on a LAN to deliver frames from one host on the LAN directly to another host on the LAN. Layer-2 frames have source and destination layer-2 (MAC) addresses. A host sending to a host on the same LAN will use the layer-2 (MAC) address of the destination host as the destination layer-2 (MAC) address, and the layer-2 protocol (ethernet) will deliver the frames directly to the destination hosts. A host sending frames from one LAN to another LAN will use the layer-2 (MAC) address of its configured gateway (router) as the destination layer-2 (MAC) address. The sending host knows nothing about how ethernet does this (via direct connection, switch, hub, or anything else); it only knows that it sends frames out its interface. That means the host is ignorant of any switches or switch ports on the LAN.

Layer-2 (MAC) has a special broadcast address (ff-ff-ff-ff-ff-ff) that means the frames with that address are delivered to all the hosts on the LAN. a DHCP Request uses that broadcast address as the destination layer-2 (MAC) address, so every host on a LAN, including the DHCP server will receive it. Layer-2 frames only exist on the LAN on which they were originated (explained below), so this presents a problem for broadcasts, including DHCP requests, because they cannot be sent from on LAN to another LAN. That is why DHCP relay agents and DHCP Option 82 were created.

Layer-3 addresses are used to deliver packets from one LAN to another LAN, and they have layer-3 (IP) source and destination addresses. When a router receives a layer-2 frame with it layer-2 (MAC) address, it will strip off and discard the layer-2 frame, including the layer-2 (MAC) addresses, to expose the layer-3 packet. The router will look at the layer-3 (IP) destination address and compare it to the destination networks in its routing table. If if finds that the layer-3 (IP) address matches one of the networks in its routing table, it will send the packet to the next interface, and it will build a new layer-2 frame for the protocol of the new interface, which may, or may not, use MAC addresses, but the layer-2 addresses for the new layer-2 frame will be for the new interface; all the previous layer-2 frame information was discarded.

When a host sends a DHCP Request, it is sent to the layer-2 (MAC) broadcast address in the frame, and the layer-3 (IP) broadcast address (255.255.255.255, which is not allowed to be routed) in the packet. If the DHCP server is on the same LAN as the requesting host, this works well because the DHCP server gets the request. The DHCP server will then send a DHCP Offer back to to the requesting host. Depending on how the DHCP server is configured, it can send it to the layer-2 (MAC) broadcast address, or the layer-2 (MAC) host address because it learned that from the layer-2 DHCP Request frame. This also works well if the DHCP server and requesting host are on the same LAN. No special DHCP options are needed.

The problem arises when the DHCP server and the requesting host are on different LANs. DHCP is broken because they cannot broadcast to each other, and the requesting host's layer-2 (MAC) address is no good on the DHCP server's LAN. In fact the requesting host's layer-2 (MAC) address would be stripped at the first router.

To solve this problem, DHCP relay agents were created. The DHCP relay agent is configured on the router's LAN interface. The router will receive the DHCP Request because it is sent to the layer-2 (MAC) broadcast address. The DHCP relay agent is configured with layer-3 (IP) addresses of one or more DHCP servers. That is because the DHCP servers are on other LANs. The DHCP relay agent will take the broadcast DHCP Request and package it into a layer-3 packet and send it to the LANs where the DHCP servers are.

The next problem arises when the DHCP server needs to send back a DHCP offer. It would normally send it to the layer-2 (MAC) broadcast address, or the layer-2 (MAC) source address seen in the DHCP request frame on the DHCP server's LAN, but that is not where the requesting host is. That will not work because the requesting host is on a different LAN. This is where DHCP Option 82 comes in.

DHCP Option 82 allows the DHCP relay agent to tell the DHCP server to send the DHCP Offer back to it, instead of trying to deliver it on the LAN where the DHCP server is as it normally would. That is the circuit to which you refer in your comments.

As you can see, DHCP works well when both the DHCP server and the requesting host are on the same LAN, and DHCP doesn't require a DHCP relay agent or DHCP Option 82 in that case. DHCP relay agents and DHCP Option 82 were later added to DHCP as a way to centralize DHCP servers on a LAN that is different than the LAN where the requesting hosts are. Using a DHCP relay agent and DHCP Option 82 when both the DHCP server and the requesting host are on the same LAN is pointless, and they actually add unnecessary complexity to the DHCP process, but they are essential for the situation when the DHCP server and the requesting host are on different LANs.


Edit:

Consider this scenario:

I would like my DHCP server to assign IP addresses to clients based on what port the client is connected. If the client is on port 1 I would like it's IP to be 192.168.0.1, the client connected to port 2 should get 192.168.0.2, and so on. Now we need information from the switch. This can be done by SNMP, but that would probably be slow. So what if the DHCP DISCOVER message contained the port? Yes, that's where Option 82 comes to play. The Circuit ID could contain the port. And that is what switches do. The switch inserts Option 82 in the DHCP messages and forwards the messages to the DHCP server.

As I explained in my comments, a switch is a transparent device, and both the DHCP server and the hosts connected to the switch are unaware of the switch or the switch ports. That is not how DHCP server work, and DHCP is not assigned as you would like, and if you were to move a host from one switch port to another during its DHCP lease time, it will still get the same IP address because it is based on its MAC address.

DHCP uses scopes as pools from which to choose IP addresses to assign to MAC addresses. Since the DHCP server and hosts are ignorant of even whether or not a switch is used, you cannot have DHCP assign addresses using the method you would like.

If your concern is knowing which IP address is assigned to which switch port, you can find that information by comparing the DHCP MAC/IP address assignments (tells you which IP address is assigned to which MAC address) and the switch's MAC address table (tells you to which switch port a MAC address is connected).

Ron Maupin

Posted 2016-11-12T15:01:28.913

Reputation: 3 130

Ron, please see my edit and the scenario described. – Jeff Merlin – 2016-11-12T18:14:17.790

See my edit to explain that this isn't possible. – Ron Maupin – 2016-11-12T18:23:47.310

Please read RFC 3046 section-3.1 rfc3046#section-3.1 3.1 Agent Circuit ID Sub-option. Possible uses of this field include: Switching Hub port number.

– Jeff Merlin – 2016-11-12T18:30:54.693

That is referring to actual WAN circuit technologies, not an ethernet switch on a LAN. I don't think your DHCP relay agent is even aware of which switch port is used by the requesting host. The problem is that you want the DHCP relay agent to decide which IP address it is requesting, but it has no knowledge of what IP addresses are available on the DHCP scope. – Ron Maupin – 2016-11-12T18:34:20.847

Sorry for ranting... But I have another switch a "DES-3010G Layer 2 Managed 8-Port 10 100Mbps Switch" which does exactly what I want. The switch (yes, Layer 2) inserts Option 82 in the DHCP messages (all of them) and sends it to the DHCP server. Your answer is "should not be done", which I cannot accept. If your answer is "cannot be done on a Layer 2 switch", I'll beg to differ because thats what I do on the 3010. – Jeff Merlin – 2016-11-12T18:45:16.113

What are you claiming that I said couldn't be done? The DHCP relay and DHCP Option 82? My answer doesn't say that. The Agent Circuit ID Sub-option is for telling the DHCP server how to get back the the DHCP relay agent. The "circuit" is what is between the DHCP relay agent and the DHCP server, not what is between the DHCP relay agentand the requesting host. – Ron Maupin – 2016-11-12T18:49:36.910

You said "If your concern is knowing which IP address is assigned to which switch port, you can find that information by comparing the DHCP MAC/IP address assignments (tells you which IP address is assigned to which MAC address) and the switch's MAC address table (tells you to which switch port a MAC address is connected)". I claim that the "Agent Circuit ID Sub-option" contain this information if the switch is a relay agent. Getting to the switch's MAC address table seems cumbersome to say the least. Not to mention that this should be done between DISCOVERY and OFFER by the DHCP server. – Jeff Merlin – 2016-11-12T22:29:36.283