topic Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC in ExtremeSwitching (VSP/Fabric Engine)

DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Mon, 27 Nov 2023 15:51:12 GMT

Hi, I've got a Fabric engine where I use the NAC to assign the VLANs, and I've configured DHCP-Relay for dynamic ip address assignment for both L2VSN and L3VSN.

In L2VSN all works well and the client connected to a port of the switch when unauthorized is on a vlan where receive correctly and ip address and when the user autenticate and I assign a L2VSN with the new VLAN also the new ip address in the new vlan is obtained correctly.

The problem is when the autenticated user belong to a L3vsn vlan and no ip address is obtained (the dhcp relay on the vrf is configured as admin guide and knowledge base) and NAC correctly indicate the correct per-user-acl rule and also on the switch the show eapol sessions eap verbose show me the correct autentication and I-SID and also on the interface I see the correct VLAN.

On the client if I capture the pachet on the interface I see the dhcp requests, but seems nothing happens on the switch because the dhcp-realy counters on the VRF remains to 0.

If on the same client I configure a static IP address all works well, also the multicast routing.

Enabling debug on eapol I see the message EAP ingored DHCP packet in my VLAN 202 that is the l3vsn vlan configured on the switch (i attach the debug message).

How I can solve and debug more the problem?

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

ItsJaredKushner — Mon, 27 Nov 2023 22:01:22 GMT

As far as i know, our network has working eapol & properly forwards dhcp packets within l3vsn vlans

Would you be okay sharing some config info?
show run mod vlan (display only vlan 202)
show run mod eap
show run mod ip (looking for "ip dhcp-relay fwd-path <vlan interface IP address> <DHCP Relay IP address>" of relevant vlan / vrf)
show run mod spbm (relavant vrf)
show run mod port (looking for specific interface gigbitethernet you tested on)

That's all i can think of at the moment.

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Tue, 28 Nov 2023 11:33:22 GMT

No problem to share the configurations (it's a lab environment)

I attach the schema of the lab (4 fabric engine switches and one Switche Engine, but in my test the client is attached to port 1/23 of BEB switch named Distribution1 and I uplod the file with the output of the show command on this switch filtered to VRF Purple and port 1/23.

Thanks in advance for help.

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

ItsJaredKushner — Tue, 28 Nov 2023 18:13:42 GMT

so, something I noticed in the port configuration when compared to what we have.

eapol multihost non-eap-mac-max 3
eapol re-authentication-period 1800
eapol re-authentication enable

^ Is missing from the config context for port 1/23.

Then again, I'm not sure if you are using site engine & or using MAC Authenticaion, but we have to have those three lines in the config context to for site engine to see the request, and for the switch to properly forward traffic to the requesting client.

We also have a slightly modified radius attribute in site engine.

Passport-Access-Priority=%MGMT_SERV_TYPE%
FA-VLAN-ISID=0:%CUSTOM1%
%ORG1_RADIUS_ATTRS_LIST%

But again, this works for us as we use Mac authentication through site engine, or "NEAP"

Good Luck

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Wed, 29 Nov 2023 08:38:33 GMT

I'm using Site Engine and also the ExtremeControl to push VLAN and I-SID with a per-user-acl and 802.1x authentication, so the radius attribute list is correctly assigned to the port from the NAC (the prove is the fact that if on this machine I assign a static IP address all works well), but I don't see the forwarding of the dhcp requests in case I want to use a dynamic ip address.

Thanks anyway

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Miguel-Angel_RO — Wed, 29 Nov 2023 09:12:16 GMT

Antonio,

All ok from my side forwarding DHCP as relay in a L3VSN.

I would also redistribute the static routes in the vrf.

Could you share a "show ip route vrf purple"?

Mig

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Wed, 29 Nov 2023 13:43:02 GMT

Miguel,

attached there are my ip routes for vrf Purple.

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Miguel-Angel_RO — Thu, 30 Nov 2023 13:54:26 GMT

Antonio,

What is the output of "traceroute 192.168.30.2 vrf purple source 10.9.202.2" on the CORE?

Mig

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Thu, 30 Nov 2023 14:35:31 GMT

Miguel,

here are the output from all the Fabric engine switches of my lab:

Distribution1:1#traceroute 192.168.30.2 vrf purple source 10.9.202.2

Sending traceroute in context vrf purple
traceroute to 192.168.30.2, 30 hops max, 56 byte packets (vrf purple)
1 * * *
2 10.9.201.2 1.425 ms 1.090 ms 1.094 ms
3 10.9.201.254 3.088 ms 2.351 ms 2.280 ms
4 192.168.30.2 2.943 ms * 1.604 ms
Distribution1:1#

Core1:1#traceroute 192.168.30.2 vrf purple source 10.9.202.2

Sending traceroute in context vrf purple
traceroute to 192.168.30.2, 30 hops max, 56 byte packets (vrf purple)
1 10.9.201.254 1.326 ms 1.226 ms 1.007 ms
2 192.168.30.2 1.159 ms 0.990 ms 0.960 ms
Core1:1#

Core2:1#traceroute 192.168.30.2 vrf purple source 10.9.202.2

Sending traceroute in context vrf purple
traceroute to 192.168.30.2, 30 hops max, 56 byte packets (vrf purple)
1 10.9.201.254 1.907 ms 0.933 ms 0.841 ms
2 192.168.30.2 1.403 ms 1.184 ms 1.076 ms
Core2:1#

Distribution2:1#traceroute 192.168.30.2 vrf purple source 10.9.202.3

Sending traceroute in context vrf purple
traceroute to 192.168.30.2, 30 hops max, 56 byte packets (vrf purple)
1 * * *
2 10.9.201.3 1.345 ms 1.185 ms 1.182 ms
3 10.9.201.254 1.147 ms 0.969 ms 0.972 ms
4 192.168.30.2 1.251 ms 0.995 ms 0.974 ms
Distribution2:1#

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Ludovico_Steven — Thu, 30 Nov 2023 22:12:16 GMT

Make sure DHCP Snooping is not globally enabled on the switch where you configured DHCP Relay. The former kills the latter. But they are usually mutually exclusive as the former is applied on core/distribution L3 BEBs while the latter is used on access L2 BEBs.

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Fri, 01 Dec 2023 15:10:30 GMT

Thanks Ludovico, in effect in my switch I've the setting: ip dhcp-snooping enable at global level also.

Next week when I'll return in office I try to disable this as you suggest and I'll give a you a feedback.

Thanks in davance

Re: DHCP-relay config on l3vsn with dynamic assignment of VLAN from NAC

Antonio_Opromol — Tue, 05 Dec 2023 10:05:00 GMT

Hi Ludovico, removing on the switch the ip dhcp-snooping enable setting, now dhcp-relay on the L3VSN works well.

Thanks for your support.