10

Came across a situation where DHCP snooping was enabled on a Cisco switch, but only for certain VLANs. However, all access ports had a ip dhcp snooping limit rate 15 applied whether or not DHCP snooping was configured for the assigned access VLAN.

My instinct is that if DHCP snooping is not enabled for that VLAN, then this statement isn't doing anything at all on those ports. I would prefer to remove the unnecessary configuration if this is the case, however I couldn't find anything definitive in a quick search.

Does anyone know of a reference that addresses this? Or alternatively tested this use case and can provide any data one way or another?

YLearn
  • 27,291
  • 5
  • 59
  • 128

2 Answers2

9

It appears the answer is that it is unnecessary configuration. If DHCP snooping is not running on that VLAN, then this configuration has no effect.

I still couldn't find documentation that clearly states this, so I decided to test this myself.

Started off with DHCP snooping enabled for all VLANs and a rate limit of one (1) DHCP packet per second (assuming that the client will send the DISCOVER and REQUEST in one second if the DHCP server responds quickly enough):

router#show ip dhcp snoop
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
1-4094
Insertion of option 82 is disabled
Interface                    Trusted     Rate limit (pps)
------------------------     -------     ----------------
FastEthernet0/8              no          1         
router#show run int fa 0/8
Building configuration...

Current configuration : 230 bytes
!
interface FastEthernet0/8
 switchport access vlan 841
 switchport mode access
 ip dhcp snooping limit rate 1
 shutdown
end

Time for the control test, which should err-disable the port, which is exactly what occurs in about a second after the port transitions to up/up:

router#term mon
router#config t
Enter configuration commands, one per line.  End with CNTL/Z.
router(config)#int fa 0/8
router(config-if)#no shut
router(config-if)#
Feb 13 22:57:04.589 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Feb 13 22:57:07.701 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Feb 13 22:57:08.553 CST: %PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Fa0/8, putting Fa0/8 in err-disable state
Feb 13 22:57:08.561 CST: %DHCP_SNOOPING-4-DHCP_SNOOPING_RATE_LIMIT_EXCEEDED: The interface Fa0/8 is receiving more than the threshold set
Feb 13 22:57:10.561 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
router(config-if)#shut

Since the control worked as expected, I now remove VLAN 841 from the DHCP snooping configuration and enable the port again. One minute later, I shut the port (to show the timestamp):

router(config-if)#no ip dhcp snooping vlan 841
router(config)#do sh ip dhcp snoop
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
1-840,842-4094
Insertion of option 82 is disabled
Interface                    Trusted     Rate limit (pps)
------------------------     -------     ----------------
FastEthernet0/8              no          1         
router(config)#int fa   0/8
router(config-if)#no shut
router(config-if)#
Feb 13 22:58:49.150 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to down
Feb 13 22:58:52.290 CST: %LINK-3-UPDOWN: Interface FastEthernet0/8, changed state to up
Feb 13 22:58:53.290 CST: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to up
router(config-if)#shut
Feb 13 22:59:55.119 CST: %LINK-5-CHANGED: Interface FastEthernet0/8, changed state to administratively down
Feb 13 22:59:56.119 CST: %LINEPROTO-5-UPDOWN: Line protocol on Interface FastEthernet0/8, changed state to down

Repeated multiple times with the same results using the following:

  1. Three different client devices
  2. 2950 running 12.1(22)EA14
  3. 3750 running 12.2(55)SE8

Would still love for someone to find documentation for this though.

YLearn
  • 27,291
  • 5
  • 59
  • 128
  • Good post. I am on the same way to avoid unnecessary configuration on IOS switches. Thanks for your share to save my time for test~ –  Mar 05 '14 at 02:28
  • 1
    Well documented... definitely a good answer. – cpt_fink Jul 03 '14 at 03:26
-1

I feel its better to leave the command on all ports since it doesn't have any effect on the ports which hasn't got the dhcp snooping enabled vlans assigned to them. The advantage of it is that it gives you capability to change ports to any access port anytime without each time checking whether they are part of dhcp snooping vlan and adding the limit command if needed.

Arun
  • 1
  • 1
  • 2
    While there is no effect in the operation of the switch (barring bugs) it does have an effect. In my case, at the site in question the system admin falsely believed he was getting a benefit from the line. This creates confusion and a false sense of security. In my experience, simplifying the configuration as much as possible generally makes it easier to understand what is going on, helps to prevent problems and assists in troubleshooting. This to me means removing any unnecessary configuration, whether that is unused SVIs/subinterfaces, ACLs, useless config, etc. – YLearn Jul 02 '14 at 02:22