How does DHCP relay work, and what does the giaddr field do?
Show the answer
Say this first
A DISCOVER is a broadcast, so it stops at the router. With ip helper-address on the interface that
faces the clients, the router picks it up, writes that interface's address into giaddr, and
unicasts it to the server. The server uses giaddr to choose the scope for that subnet and sends
its reply to giaddr. The relay then delivers it to the client on port 68.
Go deeper
Step by step
- PC1 in VLAN 20 broadcasts a DISCOVER. The gateway SVI is
10.20.0.1/24withip helper-address 10.0.12.1. - The relay sets
giaddrto 10.20.0.1, the primary address of the interface the request came in on. It adds 1 to thehopsfield and unicasts the packet to 10.0.12.1 on UDP 67. - The server finds the pool whose network contains
giaddr. No matching pool means no offer. - The server unicasts the OFFER to
giaddron UDP 67. A relay listens on 67. - The relay forwards the OFFER to the client on UDP 68, as broadcast or unicast per the broadcast flag.
- REQUEST and ACK take the same path.
Configuration
interface Vlan20
ip address 10.20.0.1 255.255.255.0
ip helper-address 10.0.12.1
ip helper-address 10.0.12.2With two helpers the relay sends a copy to each server. That is how you feed a failover pair.
feature dhcp
interface Vlan20
ip dhcp relay address 10.0.12.1What breaks it
- The server has no route back to the client subnet. It must reach
giaddr. - The helper is on the wrong interface. It belongs on the client-facing interface.
- No scope on the server for the
giaddrsubnet, or the scope is full. - A firewall between relay and server blocks UDP 67.
- Renewals at T1 are unicast from the client straight to the server address in option 54, not through the relay. The client subnet needs a routed, permitted path to the server as well.
They will ask next
Why is giaddr the receiving interface address and not the one facing the server?
giaddrtells the server which subnet the client lives on. The address of the interface toward the server would only identify a transit link, and the server would pick the wrong scope or none.The VLAN has a primary and a secondary subnet. Which one do clients get?
The relay uses the primary address as
giaddr, so the server answers from the primary subnet. To serve both, the server must treat them as one shared network: a superscope on Windows, ashared-networkblock in ISC DHCP.What does the hops field do?
Each relay adds 1. Relays drop the packet when it exceeds a limit, which stops relay loops when two relays point at each other.
Traps
- Putting the helper address on the uplink toward the server instead of on the client-facing interface.
- Forgetting the return route. The DISCOVER arrives, the server offers, and the OFFER is routed into nothing.