Cisco IP Helper-Address: DHCP Relay Configuration

When every VLAN has its own DHCP scope you end up managing dozens of pools; the cleaner design is one central DHCP server with the switches or routers relaying client broadcasts to it. On Cisco IOS and IOS XE the relay is configured with a single command per VLAN interface: ip helper-address. This article explains what helper-address actually forwards, how to configure it for one or many servers, and how to verify that clients are getting addresses through the relay.

What ip helper-address Does

By default ip helper-address turns the interface into a DHCP relay agent for UDP broadcasts and also forwards several other UDP services (TFTP, DNS, TACACS, time, NetBIOS and a few more). In most deployments you only want DHCP; disable the extra services with no ip forward-protocol udp <port> for each one you want to suppress.

Configuration

Clients live in VLAN 20 (192.168.20.0/24) and the DHCP server is 10.55.11.3 in VLAN 10. On the Layer 3 interface of VLAN 20, point the helper at the server:

Router# configure terminal
Router(config)# interface vlan 20
Router(config-if)# ip address 192.168.20.1 255.255.255.0
Router(config-if)# ip helper-address 10.55.11.3
Router(config-if)# exit
Router(config)# no ip forward-protocol udp tftp
Router(config)# no ip forward-protocol udp domain
Router(config)# end

Add the same command on every VLAN interface whose clients should use the central server. To relay to multiple servers (for redundancy or split scopes), configure several helper addresses on one interface; the router forwards the client's request to each of them.

Relay Agent Information (Option 82)

When the server needs to know which VLAN/subnet a client came from, enable option-82 insertion on the relay interface so the giaddr and option 82 identify the source circuit:

Router(config)# interface vlan 20
Router(config-if)# ip dhcp relay information option
Router(config-if)# end

On Nexus NX-OS the equivalent is ip dhcp relay information option plus ip dhcp relay information option vpn for VRFs; IOS XE Catalyst switches use the same ip helper-address on SVIs.

Verification and Troubleshooting

show ip interface vlan 20 | include Helper
show ip dhcp relay
debug ip dhcp server packet
debug ip udp

Confirm the helper address is listed on the SVI, then watch debug ip dhcp while a client requests an address: the relay should show the DISCOVER arriving on VLAN 20, being forwarded to 10.55.11.3, and the OFFER coming back. Common failures: helper-address on the wrong interface (it must be the client-facing SVI), an ACL blocking UDP 67/68 between relay and server, the server's scope not matching the giaddr subnet, or the relay interface having no IP. DHCP relay is the routing-side companion to the access-layer protections in our DHCP snooping guide; the SVI design it depends on is in Cisco inter-VLAN routing.

原文链接：https://www.cisco.com/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htdhcpre.html