ISC DHCP Users

First time relayed network

Classic

List

Threaded

8 messages Options

Tuc at Beach House

First time relayed network

Hi,

I'm trying to figure out how to do relayed subnets within a datacenter
owners environment and our (sorry, old) 4.1.1-38.P1 ISC DHCP server.
Normally we allocated an interface to our machine for every subnet
that its on, but this new network is "remote" and they won't stretch
L2 to us.

So the normal config isn't what I'm used to, but works :

subnet 10.14.14.0 netmask 255.255.255.0 {

interface eth0;
authoritative;
allow booting;
option routers 10.14.14.1;
option subnet-mask 255.255.255.0;
option domain-name "cust19782.dc.example.com";
option domain-name-servers 10.14.2.1;
option ntp-servers 10.14.2.1;
next-server 10.14.14.11
filename "pxelinux.0";
pool {
option routers 10.14.14.1;
option domain-name-servers 10.14.2.1;
max-lease-time 600;
range 10.14.14.200 10.14.14.254;
allow unknown-clients;
}
}

And the others all are the same, but with different "interface"
statements. It is not wrapped in any sort of "shared-network"
statement.

I'm getting valid Option 82 information, so I did :

class "EXTDHCP" {
match if option agent.link-selection = "10.14.18.0";
}

And then pretty much the same except removed the "interface"
statement, and added "allow members of "EXTDHCP";" into the pool
statement.

However, all I keep seeing in my logs is :

dhcpd: DHCPDISCOVER from 81:9c:de:3b:61:02 via 10.14.17.2: unknown
network segment

10.14.17.2 is the TOR switch IP thats handling the relay. I can't seem
to find any more in depth debug. Pointers to where I went wrong? (And
"Using DHCPD 4.1.1" if it can't do it is acceptable)

Thanks, Tuc
_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

Patrick Trapp

Re: First time relayed network

When I see those in my logs, it is because the request is coming from a network the DHCP server is not addressing and it does not know what pool to associate the request with. I create a shared-network statement including the intended pool and the mystery network. Since I'm not providing an address for the mystery network, the network statement (where i would normally define the network) is a pair of empty braces.

I hope that makes sense - I can provide example configs later, but not at the moment. Hope it helps.

Patrick

> On Mar 24, 2017, at 7:51 PM, Tuc at Beach House <[hidden email]> wrote:
>
> Hi,
>
>
> I'm trying to figure out how to do relayed subnets within a datacenter
> owners environment and our (sorry, old) 4.1.1-38.P1 ISC DHCP server.
> Normally we allocated an interface to our machine for every subnet
> that its on, but this new network is "remote" and they won't stretch
> L2 to us.
>
> So the normal config isn't what I'm used to, but works :
>
> subnet 10.14.14.0 netmask 255.255.255.0 {
>
> interface eth0;
> authoritative;
> allow booting;
> option routers 10.14.14.1;
> option subnet-mask 255.255.255.0;
> option domain-name "cust19782.dc.example.com";
> option domain-name-servers 10.14.2.1;
> option ntp-servers 10.14.2.1;
> next-server 10.14.14.11
> filename "pxelinux.0";
> pool {
> option routers 10.14.14.1;
> option domain-name-servers 10.14.2.1;
> max-lease-time 600;
> range 10.14.14.200 10.14.14.254;
> allow unknown-clients;
> }
> }
>
>
> And the others all are the same, but with different "interface"
> statements. It is not wrapped in any sort of "shared-network"
> statement.
>
> I'm getting valid Option 82 information, so I did :
>
> class "EXTDHCP" {
> match if option agent.link-selection = "10.14.18.0";
> }
>
> And then pretty much the same except removed the "interface"
> statement, and added "allow members of "EXTDHCP";" into the pool
> statement.
>
> However, all I keep seeing in my logs is :
>
> dhcpd: DHCPDISCOVER from 81:9c:de:3b:61:02 via 10.14.17.2: unknown
> network segment
>
> 10.14.17.2 is the TOR switch IP thats handling the relay. I can't seem
> to find any more in depth debug. Pointers to where I went wrong? (And
> "Using DHCPD 4.1.1" if it can't do it is acceptable)
>
>
> Thanks, Tuc
> _______________________________________________
> dhcp-users mailing list
> [hidden email]
> https://lists.isc.org/mailman/listinfo/dhcp-users

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

Tuc at Beach House

Re: First time relayed network

Hi,

Thanks. Actually solved it this morning after piecing together help from a few people. Option 82 googling makes it FAR scarier than it needs to be. I also then started debugging source to figure out the problem with the "unknown network segment" to find out it was my misreading the correct subnet 205 times.

Yes, it was actually as easy as adding a shared-network and putting the correct subnet. I didn't need to mess with agent.link-selection or anything!

Thanks, Tuc

On Fri, Mar 24, 2017 at 9:41 PM, Patrick Trapp <[hidden email]> wrote:

When I see those in my logs, it is because the request is coming from a network the DHCP server is not addressing and it does not know what pool to associate the request with. I create a shared-network statement including the intended pool and the mystery network. Since I'm not providing an address for the mystery network, the network statement (where i would normally define the network) is a pair of empty braces.

I hope that makes sense - I can provide example configs later, but not at the moment. Hope it helps.

Patrick

> On Mar 24, 2017, at 7:51 PM, Tuc at Beach House <[hidden email]> wrote:
>
> Hi,
>
>
> I'm trying to figure out how to do relayed subnets within a datacenter
> owners environment and our (sorry, old) 4.1.1-38.P1 ISC DHCP server.
> Normally we allocated an interface to our machine for every subnet
> that its on, but this new network is "remote" and they won't stretch
> L2 to us.
>
> So the normal config isn't what I'm used to, but works :
>
> subnet 10.14.14.0 netmask 255.255.255.0 {
>
> interface eth0;
> authoritative;
> allow booting;
> option routers 10.14.14.1;
> option subnet-mask 255.255.255.0;
> option domain-name "cust19782.dc.example.com";
> option domain-name-servers 10.14.2.1;
> option ntp-servers 10.14.2.1;
> next-server 10.14.14.11
> filename "pxelinux.0";
> pool {
> option routers 10.14.14.1;
> option domain-name-servers 10.14.2.1;
> max-lease-time 600;
> range 10.14.14.200 10.14.14.254;
> allow unknown-clients;
> }
> }
>
>
> And the others all are the same, but with different "interface"
> statements. It is not wrapped in any sort of "shared-network"
> statement.
>
> I'm getting valid Option 82 information, so I did :
>
> class "EXTDHCP" {
> match if option agent.link-selection = "10.14.18.0";
> }
>
> And then pretty much the same except removed the "interface"
> statement, and added "allow members of "EXTDHCP";" into the pool
> statement.
>
> However, all I keep seeing in my logs is :
>
> dhcpd: DHCPDISCOVER from 81:9c:de:3b:61:02 via 10.14.17.2: unknown
> network segment
>
> 10.14.17.2 is the TOR switch IP thats handling the relay. I can't seem
> to find any more in depth debug. Pointers to where I went wrong? (And
> "Using DHCPD 4.1.1" if it can't do it is acceptable)
>
>
> Thanks, Tuc
> _______________________________________________
> dhcp-users mailing list
> [hidden email]
> https://lists.isc.org/mailman/listinfo/dhcp-users
_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

Tuc at Beach House

Re: First time relayed network

Hi,

Either I spoke too soon, or I didn't test well enough.

We had someone try to dhcp in the OTHER range in the shared network and we got :

Apr 5 13:18:28 dhcp1 dhcpd: DHCPREQUEST for 10.9.18.215 (10.9.12.0) from 00:50:56:ac:d9:bf via eth0

(This is a different site, but same issues...)

It seems it was just giving out 10.9.18 IPs even though it seemed to know it needed to give a 10.9.12.0 . Do I need to start doing something like

class newsubnet {

match if option agent.link-selection = "10.9.18.1"

}

and put in the 10.9.12 pool

deny members of newsubnet;

and in 10.9.18

allow members of newsubnet;

Thanks, Tuc

On Fri, Mar 24, 2017 at 9:50 PM, Tuc at Beach House <[hidden email]> wrote:

<img width="0" height="0" class="gmail-mt-old-signature" src="data:image/gif;base64,R0lGODlhAQABAIAAAAAAAP///yH5BAEAAAAALAAAAAABAAEAAAIBRAA7">Hi,

Thanks. Actually solved it this morning after piecing together help from a few people. Option 82 googling makes it FAR scarier than it needs to be. I also then started debugging source to figure out the problem with the "unknown network segment" to find out it was my misreading the correct subnet 205 times.

Yes, it was actually as easy as adding a shared-network and putting the correct subnet. I didn't need to mess with agent.link-selection or anything!

Thanks, Tuc

On Fri, Mar 24, 2017 at 9:41 PM, Patrick Trapp <[hidden email]> wrote:
When I see those in my logs, it is because the request is coming from a network the DHCP server is not addressing and it does not know what pool to associate the request with. I create a shared-network statement including the intended pool and the mystery network. Since I'm not providing an address for the mystery network, the network statement (where i would normally define the network) is a pair of empty braces.

I hope that makes sense - I can provide example configs later, but not at the moment. Hope it helps.

Patrick

> On Mar 24, 2017, at 7:51 PM, Tuc at Beach House <[hidden email]> wrote:
>
> Hi,
>
>
> I'm trying to figure out how to do relayed subnets within a datacenter
> owners environment and our (sorry, old) 4.1.1-38.P1 ISC DHCP server.
> Normally we allocated an interface to our machine for every subnet
> that its on, but this new network is "remote" and they won't stretch
> L2 to us.
>
> So the normal config isn't what I'm used to, but works :
>
> subnet 10.14.14.0 netmask 255.255.255.0 {
>
> interface eth0;
> authoritative;
> allow booting;
> option routers 10.14.14.1;
> option subnet-mask 255.255.255.0;
> option domain-name "cust19782.dc.example.com";
> option domain-name-servers 10.14.2.1;
> option ntp-servers 10.14.2.1;
> next-server 10.14.14.11
> filename "pxelinux.0";
> pool {
> option routers 10.14.14.1;
> option domain-name-servers 10.14.2.1;
> max-lease-time 600;
> range 10.14.14.200 10.14.14.254;
> allow unknown-clients;
> }
> }
>
>
> And the others all are the same, but with different "interface"
> statements. It is not wrapped in any sort of "shared-network"
> statement.
>
> I'm getting valid Option 82 information, so I did :
>
> class "EXTDHCP" {
> match if option agent.link-selection = "10.14.18.0";
> }
>
> And then pretty much the same except removed the "interface"
> statement, and added "allow members of "EXTDHCP";" into the pool
> statement.
>
> However, all I keep seeing in my logs is :
>
> dhcpd: DHCPDISCOVER from 81:9c:de:3b:61:02 via 10.14.17.2: unknown
> network segment
>
> 10.14.17.2 is the TOR switch IP thats handling the relay. I can't seem
> to find any more in depth debug. Pointers to where I went wrong? (And
> "Using DHCPD 4.1.1" if it can't do it is acceptable)
>
>
> Thanks, Tuc
> _______________________________________________
> dhcp-users mailing list
> [hidden email]
> https://lists.isc.org/mailman/listinfo/dhcp-users
_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

Simon Hobson-2

Re: First time relayed network

I can't quite figure out exactly what your topology is from your original description.

As I read it, you are using a DHCP relay agent to get DHCP packets from clients on one network to a server that doesn't have a direct connection to that network ? Is it as simple as that, or is there some other complication ?

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

Simon Hobson

Re: First time relayed network

In reply to this post by Tuc at Beach House

Tuc at Beach House

Re: First time relayed network

In reply to this post by Simon Hobson-2

Hi,

Yes, sorry, simple as that.

A current network comes over eth0, and the relayed network also comes over eth0. I thought they were "doing the right thing" but someone came out for the "local eth0" network and it assigned it in the "relayed eth0" network pool.

Tuc

On Wed, Apr 5, 2017 at 4:38 PM, Simon Hobson <[hidden email]> wrote:

I can't quite figure out exactly what your topology is from your original description.

As I read it, you are using a DHCP relay agent to get DHCP packets from clients on one network to a server that doesn't have a direct connection to that network ? Is it as simple as that, or is there some other complication ?

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users

Simon Hobson

Re: First time relayed network

Scott Ellentuch <[hidden email]> wrote:

>> As I read it, you are using a DHCP relay agent to get DHCP packets from clients on one network to a server that doesn't have a direct connection to that network ? Is it as simple as that, or is there some other complication ?

> Yes, sorry, simple as that.

So client network <-> relay agent <-> DHCP server

To handle that you just don't need to do anything other than define the subnet(s). If the network (specifically the relay agent) is correctly configured then "it just works" and you definitely don't need any shared networks or address assignment logic.

> A current network comes over eth0, and the relayed network also comes over eth0. I thought they were "doing the right thing" but someone came out for the "local eth0" network and it assigned it in the "relayed eth0" network pool.

Sorry, I really have no idea what that means !

_______________________________________________
dhcp-users mailing list
[hidden email]
https://lists.isc.org/mailman/listinfo/dhcp-users