Octet

How does DHCP relay work, and what does the giaddr field do?

Show the answer

Say this first

A DISCOVER is a broadcast, so it stops at the router. With ip helper-address on the interface that faces the clients, the router picks it up, writes that interface's address into giaddr, and unicasts it to the server. The server uses giaddr to choose the scope for that subnet and sends its reply to giaddr. The relay then delivers it to the client on port 68.

Go deeper

Step by step

  1. PC1 in VLAN 20 broadcasts a DISCOVER. The gateway SVI is 10.20.0.1/24 with ip helper-address 10.0.12.1.
  2. The relay sets giaddr to 10.20.0.1, the primary address of the interface the request came in on. It adds 1 to the hops field and unicasts the packet to 10.0.12.1 on UDP 67.
  3. The server finds the pool whose network contains giaddr. No matching pool means no offer.
  4. The server unicasts the OFFER to giaddr on UDP 67. A relay listens on 67.
  5. The relay forwards the OFFER to the client on UDP 68, as broadcast or unicast per the broadcast flag.
  6. REQUEST and ACK take the same path.

Configuration

Cisco IOS
interface Vlan20
 ip address 10.20.0.1 255.255.255.0
 ip helper-address 10.0.12.1
 ip helper-address 10.0.12.2

With two helpers the relay sends a copy to each server. That is how you feed a failover pair.

NX-OS
feature dhcp
interface Vlan20
  ip dhcp relay address 10.0.12.1

What breaks it

  • The server has no route back to the client subnet. It must reach giaddr.
  • The helper is on the wrong interface. It belongs on the client-facing interface.
  • No scope on the server for the giaddr subnet, or the scope is full.
  • A firewall between relay and server blocks UDP 67.
  • Renewals at T1 are unicast from the client straight to the server address in option 54, not through the relay. The client subnet needs a routed, permitted path to the server as well.

Traps

  • Putting the helper address on the uplink toward the server instead of on the client-facing interface.
  • Forgetting the return route. The DISCOVER arrives, the server offers, and the OFFER is routed into nothing.
How did you do?Book 3.3 Internet (IP)