What is DHCP option 82, and why can clients stop getting addresses right after you enable DHCP snooping?
Show the answer
Say this first
Option 82 (relay agent information) lets a relay or access switch tag a request with where it came
from: circuit ID (VLAN and port) and remote ID (the switch). Catalyst switches insert it by default
when DHCP snooping is on, but they are not relays, so giaddr stays 0.0.0.0. A Cisco IOS relay or
DHCP server that receives option 82 with a zero giaddr on an untrusted interface drops the packet.
The fix is one line: ip dhcp relay information trusted on the router interface, or
no ip dhcp snooping information option on the switch.
Go deeper
What option 82 carries
- Sub-option 1, circuit ID: usually the VLAN, module and port of the client.
- Sub-option 2, remote ID: usually the switch MAC address.
The server can use it for policy (fixed address per port, subscriber identity at service providers) and logs it. The relay strips it from the reply before the client sees it.
Why the router drops it
RFC 3046 tells a relay to discard a packet that arrives on an untrusted circuit with option 82
already present and giaddr zero, because a client could be forging it. A snooping switch creates
exactly that packet. debug ip dhcp server packet on the router shows it complaining that the relay
information option is present while giaddr is zero.
Fixes
On the router, trust the option on the interface facing the switch, or everywhere:
interface GigabitEthernet0/0/1.40
ip dhcp relay information trusted
!
ip dhcp relay information trust-allOr stop the switch inserting it:
no ip dhcp snooping information optionIf the server really uses option 82 (service provider style), keep the insertion and trust it on the relay. Otherwise turn insertion off at the access layer.
They will ask next
The uplink is already trusted for DHCP snooping. Why does that not fix it?
Snooping trust on the switch uplink lets server messages (OFFER, ACK) in through that port. It says nothing about whether the router accepts the option 82 the switch added. Different device, different trust setting.
What does a snooping switch do with option 82 arriving on an untrusted access port?
It drops the packet by default, since an access port should never carry option 82. On an aggregation switch that receives already-tagged requests from edge switches, you allow it with
ip dhcp snooping information option allow-untrusted.
Traps
- Assuming snooping trust on the uplink covers this.
- Turning DHCP snooping off to make DHCP work again. That removes the protection when one line fixes it.