networking protocol_error ai_generated true

DHCP: Option 82 (relay agent information) missing from DHCPDISCOVER, server ignoring request

ID: networking/dhcp-option-82-missing

Also available as: JSON · Markdown · 中文
90%Fix Rate
88%Confidence
1Evidence
2023-11-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Cisco IOS 15.2(7)E active — — —
ISC DHCP Server 4.4.2-P1 active — — —
dnsmasq 2.86 active — — —

Root Cause

A DHCP relay agent or switch configured to require Option 82 (RFC 3046) for DHCP snooping is not inserting the option into client DHCPDISCOVER packets, causing the DHCP server to silently drop the request.

generic

中文

配置为需要选项82（RFC 3046）进行DHCP侦听的中继代理或交换机未将选项插入客户端DHCPDISCOVER报文中，导致DHCP服务器静默丢弃请求。

Official Documentation

https://www.rfc-editor.org/rfc/rfc3046

Workarounds

  1. 92% success Enable DHCP snooping trust on the switch port facing the DHCP server and configure Option 82 insertion: ip dhcp snooping trust; interface GigabitEthernet0/1; ip dhcp snooping information option allow-untrusted 
    Enable DHCP snooping trust on the switch port facing the DHCP server and configure Option 82 insertion: ip dhcp snooping trust; interface GigabitEthernet0/1; ip dhcp snooping information option allow-untrusted
  2. 85% success On the DHCP server, disable Option 82 validation: in /etc/dhcp/dhcpd.conf, add 'allow unknown-clients;' and 'ignore option-82;' then restart the service. 
    On the DHCP server, disable Option 82 validation: in /etc/dhcp/dhcpd.conf, add 'allow unknown-clients;' and 'ignore option-82;' then restart the service.
  3. 78% success Upgrade the switch firmware to a version that correctly supports RFC 3046 Option 82 insertion. 
    Upgrade the switch firmware to a version that correctly supports RFC 3046 Option 82 insertion.

中文步骤

  1. Enable DHCP snooping trust on the switch port facing the DHCP server and configure Option 82 insertion: ip dhcp snooping trust; interface GigabitEthernet0/1; ip dhcp snooping information option allow-untrusted
  2. On the DHCP server, disable Option 82 validation: in /etc/dhcp/dhcpd.conf, add 'allow unknown-clients;' and 'ignore option-82;' then restart the service.
  3. Upgrade the switch firmware to a version that correctly supports RFC 3046 Option 82 insertion.

Dead Ends

Common approaches that don't work:

  1. 95% fail

    The client is sending valid DHCPDISCOVER packets; the issue is on the relay/switch side not inserting Option 82.

  2. 70% fail

    This avoids the error but defeats the purpose of DHCP and is not scalable for large deployments.

  3. 60% fail

    Disabling DHCP snooping reduces network security by allowing rogue DHCP servers; it should only be done as a last resort.