Configure and Verify DHCP in a VxLAN Fabric for Nexus 9000 with NX-OS and Windows Server 2022
Available Languages
Contents
Introduction
This document describes how to configure and troubleshoot DHCP in a VxLAN Fabric with Nexus 9000 switches.
Prerequisites
Requirements
Cisco recommends that you have knowledge of these topics:
- Nexus NX-OS Software.
- Virtual Port Channel (vPC).
- VxLAN BGP L2VPN EVPN
- BGP address-family IPv4
- OSPF
- Multicast PIM (sparse-mode)
- DHCP
Components Used
The information in this document is based on these software and hardware versions:
- Cisco Nexus 9000 with Cisco NX-OS.
- N9K-C93180YC-EX
- N9K-C93180YC-FX
- NX-OS 10.3(4a)
- Windows Server 2022 Data Center
The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, ensure that you understand the potential impact of any command.
Note: Any questions about the configuration and integrability of third-party software or hardware are outside of Cisco support. The use of third-party tools is a best effort to demonstrate your configuration and operation with Cisco equipment to customer.
Background Information
Underlay and Overlay Configuration for VxLAN in Laboratory
VxLAN Fabric Diagram in Laboratory
- SPINE:
- This Nexus switch sends DHCP (Discover, Offer, Request, Ack) packets without being decapsulated in this scenario. Only the outer header is used.
- Acts as the central routing points in the network fabric.
- Responsible for interconnecting all the LEAF switches and facilitating the flow of data between them.
- Participates in BGP to distribute EVPN routes to the LEAF switches.
- Performs IP routing and can route traffic between different subnets or VxLAN segments by looking at the outer IP headers.
- Separates the overlay network (VxLAN) from the underlay physical network.
- Manages the underlay with traditional IP routing protocols, while the overlay is managed by VxLAN with BGP EVPN, providing a scalable and flexible network architecture.
- LEAF-1:
- LEAF switches provide physical connectivity for endpoints like servers, storage devices, and other network appliances.
- LEAF switches act as VTEPs, which means they encapsulate and de-encapsulate the VxLAN packets.
- In this scenario HOST#1 makes the IP address request.
- LEAF-1 is responsible for encapsulating the DCHP packets within VxLAN header.
- HOST#1 receives DCHP packets transparently as classic Ethernet.
- LEAF-1-vPC and LEAF-2-vPC:
- LEAF switches participate in the EVPN control plane by running BGP and exchanging route information. This allows for the distribution of MAC and IP address information, ensuring that traffic can be efficiently routed across the VxLAN fabric.
- In this scenario, the DHCP server is associated with VLAN 10 with VNI 101010 as is HOST#1. This means it is only VxLAN bridging.
- If the DHCP Server was associated with a VNI other than HOST#1, then an L3VNI would be strictly necessary for routing. The source and destination VNI must be created.
- DCHP server receives DCHP packets transparently as classic Ethernet.
- The BUM traffic is received by both Nexus switches in vPC, but only the operationally primary Nexus switch in vPC sends the traffic. The secondary Nexus switch drop the traffic. In this scenario LEAF-1-vPC is operationally primary.
- The use of infra-vlans is mandatory because if the interface on LEAF-2-vPC to SPINE goes down, DCHP packets could not be sent. To send VxLAN-encapsulated traffic to LEAF-1-vPC, this backup VLAN is required. In this way LEAF-1-vPC could send DCHP packets to SPINE.
- N9K-ACCESS:
- This Nexus switch only provides connectivity to both Leafs using a vPC port-channel for redundancy purposes towards HOST#2
SPINE
nv overlay evpn
feature ospf
feature bgp
feature pim
feature netconf
feature nv overlay
ip pim rp-address 192.168.11.11 group-list 224.10.10.0/24
ip pim ssm range 232.0.0.0/8
ip pim anycast-rp 192.168.11.11 192.168.0.11
ip prefix-list direct_routes seq 5 permit 10.104.11.0/30 le 32
route-map redistribution permit 10
match ip address prefix-list direct_routes
interface Ethernet1/1
speed 1000
ip address 10.104.11.1/30
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface Ethernet1/2
ip address 10.102.11.1/30
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface Ethernet1/3
speed 1000
ip address 10.103.11.1/30
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface loopback0
description ANYCAST-RP
ip address 192.168.0.11/32
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface loopback1
description ANYCAST-RP-CANDIDATE
ip address 192.168.11.11/32
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
router ospf 1
router bgp 65000
neighbor 192.168.3.3
remote-as 65000
update-source loopback0
address-family l2vpn evpn
send-community
send-community extended
route-reflector-client
neighbor 192.168.4.4
remote-as 65000
update-source loopback0
address-family l2vpn evpn
send-community
send-community extended
route-reflector-client
neighbor 192.168.5.5
remote-as 65000
update-source loopback0
address-family l2vpn evpn
send-community
send-community extended
route-reflector-clientLEAF-1
nv overlay evpn
feature ospf
feature bgp
feature pim
feature interface-vlan
feature vn-segment-vlan-based
feature dhcp
feature nv overlay
fabric forwarding anycast-gateway-mac 0000.0a0a.0a0a
ip pim rp-address 192.168.11.11 group-list 224.10.10.0/24
ip pim ssm range 232.0.0.0/8
vlan 1,10,20,300
vlan 10
vn-segment 101010
vlan 20
vn-segment 202020
vlan 300
vn-segment 303030
spanning-tree vlan 10 priority 4096
ip prefix-list host_subnets seq 5 permit 10.10.10.0/24 le 32
ip prefix-list host_subnets seq 10 permit 192.168.20.0/24 le 32
ip prefix-list host_subnets seq 15 permit 172.16.10.8/32
route-map direct_routes_tenant-a permit 10
match ip address prefix-list host_subnets
vrf context tenant-a
vni 303030
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
interface Vlan10
no shutdown
vrf member tenant-a
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150
ip dhcp relay source-interface loopback100
interface Vlan20
no shutdown
vrf member tenant-a
no ip redirects
ip address 192.168.20.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
interface Vlan300
no shutdown
vrf member tenant-a
no ip redirects
ip forward
no ipv6 redirects
interface nve1
no shutdown
host-reachability protocol bgp
source-interface loopback0
member vni 101010
suppress-arp
mcast-group 224.10.10.10
member vni 202020
suppress-arp
mcast-group 224.10.10.10
member vni 303030 associate-vrf
interface Ethernet1/1
ip address 10.104.11.2/30
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface loopback0
description UNDERLAY-VERIFICATION
ip address 192.168.5.5/32
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface loopback100
vrf member tenant-a
ip address 172.16.10.8/32
router ospf 1
router bgp 65000
address-family ipv4 unicast
neighbor 192.168.0.11
remote-as 65000
update-source loopback0
address-family l2vpn evpn
send-community
send-community extended
vrf tenant-a
address-family ipv4 unicast
redistribute direct route-map direct_routes_tenant-a
evpn
vni 101010 l2
rd auto
route-target import auto
route-target export auto
vni 202020 l2
rd auto
route-target import auto
route-target export autoLEAF-1-vPC
nv overlay evpn
feature ospf
feature bgp
feature pim
feature interface-vlan
feature vn-segment-vlan-based
feature lacp
feature dhcp
feature vpc
feature nv overlay
fabric forwarding anycast-gateway-mac 0000.0a0a.0a0a
ip pim rp-address 192.168.11.11 group-list 224.10.10.0/24
ip pim ssm range 232.0.0.0/8
vlan 1,10,300,777
vlan 10
vn-segment 101010
vlan 300
vn-segment 303030
vlan 777
name BACKUP_VLAN_ROUTING_NVE_INFRA
spanning-tree vlan 1,10,300 hello-time 4
ip prefix-list host_subnets seq 5 permit 10.10.10.0/24 le 32
ip prefix-list host_subnets seq 15 permit 172.16.10.9/32
route-map direct_routes_tenant-a permit 10
match ip address prefix-list host_subnets
vrf context tenant-a
vni 303030
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
system nve infra-vlans 777
vpc domain 1
peer-switch
peer-keepalive destination 10.88.238.195
peer-gateway
layer3 peer-router
ip arp synchronize
interface Ethernet1/3
switchport
switchport mode trunk
switchport trunk allowed vlan 1,10,20
channel-group 10 mode active
no shutdown
interface Ethernet1/19
switchport
switchport mode trunk
channel-group 1 mode active
no shutdown
interface port-channel1
switchport
switchport mode trunk
spanning-tree port type network
vpc peer-link
interface port-channel10
switchport
switchport mode trunk
switchport trunk allowed vlan 1,10
vpc 10
interface mgmt0
vrf member management
ip address 10.88.238.194/29
interface loopback0
description UNDERLAY-VERIFICATION
ip address 192.168.3.3/32
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface loopback1
description OVERLAY-NVE
ip address 192.168.13.1/32
ip address 192.168.13.254/32 secondary
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface loopback10
vrf member tenant-a
ip address 172.16.10.1/32
interface loopback100
vrf member tenant-a
ip address 172.16.10.9/32
interface Vlan10
no shutdown
vrf member tenant-a
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150
ip dhcp relay source-interface loopback100
interface Vlan300
no shutdown
vrf member tenant-a
no ip redirects
ip forward
no ipv6 redirects
interface Vlan777
description BACKUP_UNDERLAY_INFRA-VLAN
no shutdown
no ip redirects
ip address 10.255.77.1/30
no ipv6 redirects
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface Ethernet1/2
ip address 10.102.11.2/30
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface nve1
no shutdown
host-reachability protocol bgp
advertise virtual-rmac
source-interface loopback1
member vni 101010
suppress-arp
mcast-group 224.10.10.10
member vni 303030 associate-vrf
router ospf 1
router bgp 65000
address-family ipv4 unicast
address-family l2vpn evpn
advertise-pip
neighbor 192.168.0.11
remote-as 65000
update-source loopback0
address-family l2vpn evpn
send-community
send-community extended
neighbor 192.168.88.2
remote-as 65000
description OVERLAY_BACKUP
update-source Vlan888
address-family l2vpn evpn
send-community
send-community extended
vrf tenant-a
address-family ipv4 unicast
redistribute direct route-map direct_routes_tenant-a
evpn
vni 101010 l2
rd auto
route-target import auto
route-target export auto
vni 202020 l2
rd auto
route-target import auto
route-target export autoLEAF-2-vPC
nv overlay evpn
feature ospf
feature bgp
feature pim
feature interface-vlan
feature vn-segment-vlan-based
feature lacp
feature dhcp
feature vpc
feature nv overlay
fabric forwarding anycast-gateway-mac 0000.0a0a.0a0a
ip pim rp-address 192.168.11.11 group-list 224.10.10.0/24
ip pim ssm range 232.0.0.0/8
vlan 1,10,20,300,777
vlan 10
vn-segment 101010
vlan 20
vn-segment 202020
vlan 300
vn-segment 303030
vlan 777
name BACKUP_VLAN_ROUTING_NVE_INFRA
spanning-tree vlan 1,10,20,300 hello-time 4
ip prefix-list host_subnets seq 5 permit 10.10.10.0/24 le 32
ip prefix-list host_subnets seq 10 permit 192.168.20.0/24 le 32
ip prefix-list host_subnets seq 15 permit 172.16.10.10/32
route-map direct_routes_tenant-a permit 10
match ip address prefix-list host_subnets
vrf context tenant-a
vni 303030
rd auto
address-family ipv4 unicast
route-target both auto
route-target both auto evpn
system nve infra-vlans 777
vpc domain 1
peer-switch
peer-keepalive destination 10.88.238.194
peer-gateway
layer3 peer-router
ip arp synchronize
interface Ethernet1/1
ip address 10.103.11.2/30
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
no shutdown
interface Ethernet1/19
switchport
switchport mode trunk
channel-group 1 mode active
no shutdown
interface port-channel1
switchport
switchport mode trunk
spanning-tree port type network
vpc peer-link
interface port-channel10
switchport
switchport mode trunk
switchport trunk allowed vlan 1,10,20
vpc 10
interface mgmt0
vrf member management
ip address 10.88.238.195/29
interface loopback0
description UNDERLAY-VERIFICATION
ip address 192.168.4.4/32
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface loopback1
description OVERLAY-NVE
ip address 192.168.13.2/32
ip address 192.168.13.254/32 secondary
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface loopback10
vrf member tenant-a
ip address 172.16.10.2/32
interface loopback100
vrf member tenant-a
ip address 172.16.10.10/32
interface Vlan10
no shutdown
vrf member tenant-a
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150
ip dhcp relay source-interface loopback100
interface Vlan20
no shutdown
vrf member tenant-a
no ip redirects
ip address 192.168.20.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
interface Vlan300
no shutdown
vrf member tenant-a
no ip redirects
ip forward
no ipv6 redirects
interface Vlan777
description BACKUP_UNDERLAY_INFRA-VLAN
no shutdown
no ip redirects
ip address 10.255.77.2/30
no ipv6 redirects
ip ospf network point-to-point
ip router ospf 1 area 0.0.0.0
ip pim sparse-mode
interface nve1
no shutdown
host-reachability protocol bgp
advertise virtual-rmac
source-interface loopback1
member vni 101010
suppress-arp
mcast-group 224.10.10.10
member vni 202020
suppress-arp
mcast-group 224.10.10.10
member vni 303030 associate-vrf
router ospf 1
router bgp 65000
address-family ipv4 unicast
address-family l2vpn evpn
advertise-pip
neighbor 192.168.0.11
remote-as 65000
update-source loopback0
address-family l2vpn evpn
send-community
send-community extended
neighbor 192.168.88.1
remote-as 65000
description OVERLAY_BACKUP
update-source Vlan888
address-family l2vpn evpn
send-community
send-community extended
vrf tenant-a
address-family ipv4 unicast
redistribute direct route-map direct_routes_tenant-a
evpn
vni 101010 l2
rd auto
route-target import auto
route-target export auto
vni 202020 l2
rd auto
route-target import auto
route-target export autoN9K-ACCESS
feature lacp
vlan 1,10
interface port-channel10
switchport
switchport mode trunk
interface Ethernet1/11
switchport
switchport access vlan 10
no shutdown
interface Ethernet1/45
switchport
switchport mode trunk
channel-group 10 mode active
no shutdown
interface Ethernet1/46
switchport
switchport mode trunk
channel-group 10 mode active
no shutdownDHCP Configuration on Nexus switches
LEAF-1
Step 1. Enable the feature DCHP.
LEAF-1(config)# feature dhcpNote: The DHCP server and the relay agent command service dhcp, ip dhcp relay, and ipv6 dhcp relay are enabled by default since NX-OS 7.x.
Step 2. Apply the command ip dhcp relay information option.
LEAF-1(config)# ip dhcp relay information optionNote: This command enables the DHCP relay agent to insert and remove Option 82 information on the packets that are forwarded.
Step 3. Apply the command ip dhcp relay information option vpn.
LEAF-1(config)# ip dhcp relay information option vpnNote: This command enables the DHCP relay requests that arrives on different VRF where the DHCP server belongs.
Step 4. Apply the command "ip dhcp relay address [ip address of DCHP server]".
Note: In this example the IP address for DCHP server is 10.10.10.150.
LEAF-1(config)# interface vlan 10
LEAF-1(config-if)# ip dhcp relay address 10.10.10.150Step 5. Apply the command "ip dhcp relay source-interface [unique loopback]".
Note: This command configures the source IP address for DHCP relay agent to handle Discover, Offer, Request, and ACK, for unicast communication which the DHCP relay agent uses the IP address of SVI as source IP address for DHCP relay agent. This is not desired because this IP address is shared by multiples VTEPs and black-holing of DHCP packets can happen. To avoid this, a unique IP address (using a loopback interface) is necessary to differentiate each VTEP.
LEAF-1(config)# interface vlan 10
LEAF-1(config-if)# ip dhcp relay source-interface loopback100Step 6. In the VRF corresponding tenant within BGP, direct route redistribution with a prefix-list and route-map that includes the IP address of the loopback interface.
Note: This loopback interface belongs to the tenant of SVI.
LEAF-1(config)# show running-config interface loopback 100
interface loopback100
vrf member tenant-a
ip address 172.16.10.8/32
LEAF-1(config)# ip prefix-list host_subnets seq 15 permit 172.16.10.8/32
LEAF-1(config)# route-map direct_routes_tenant-a permit 10
LEAF-1(config-route-map)# match ip address prefix-list host_subnets
LEAF-1(config-route-map)# router bgp 65000
LEAF-1(config-router)# vrf tenant-a
LEAF-1(config-router-vrf)# address-family ipv4 unicast
LEAF-1(config-router-vrf-af)# redistribute direct route-map direct_routes_tenant-aStep 7. Verify that the IP address of the loopback interface is advertised in BGP L2VPN EVPN to the Spines with the command: show bgp l2vpn evpn [loopback IP] vrf [tenant vrf].
LEAF-1(config)# show bgp l2vpn evpn 172.16.10.8 vrf tenant-a
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 192.168.5.5:4 (L3VNI 303030)
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.8]/224, version 421
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn
Advertised path-id 1
Path type: local, path is valid, is best path, no labeled nexthop
Gateway IP: 0.0.0.0
AS-Path: NONE, path locally originated
192.168.5.5 (metric 0) from 0.0.0.0 (192.168.5.5)
Origin incomplete, MED 0, localpref 100, weight 32768
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:707d.b9b8.4daf
Path-id 1 advertised to peers:
192.168.0.11 <<<< SpineStep 8. Verify that the IP address of the loopback interface is injected in BGP L2VPN EVPN where DHCP server is located.
Note: If there are Nexus switches in vPC, verify that they both learn the IP address of the loopback interface in BGP L2VPN EVPN.
LEAF-1# show bgp l2vpn evpn 172.16.10.8
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 192.168.5.5:4
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.8]/224, version 754
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not in HW
Advertised path-id 1
Path type: internal, path is valid, is best path, no labeled nexthop
Imported to 2 destination(s)
Imported paths list: tenant-a L3-303030
Gateway IP: 0.0.0.0
AS-Path: NONE, path sourced internal to AS
192.168.5.5 (metric 45) from 192.168.0.11 (192.168.0.11)
Origin incomplete, MED 0, localpref 100, weight 0
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:707d.b9b8.4daf
Originator: 192.168.5.5 Cluster list: 192.168.0.11
Path-id 1 not advertised to any peer
Route Distinguisher: 192.168.3.3:4 (L3VNI 303030)
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.8]/224, version 761
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn, is not in HW
Advertised path-id 1
Path type: internal, path is valid, is best path, no labeled nexthop
Imported from 192.168.5.5:4:[5]:[0]:[0]:[32]:[172.16.10.8]/224
Gateway IP: 0.0.0.0
AS-Path: NONE, path sourced internal to AS
192.168.5.5 (metric 45) from 192.168.0.11 (192.168.0.11)
Origin incomplete, MED 0, localpref 100, weight 0
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:707d.b9b8.4daf
Originator: 192.168.5.5 Cluster list: 192.168.0.11
Path-id 1 not advertised to any peerStep 9. Verify that there is a route for the DHCP server on the source tenant with command show ip route [DHCP server IP] vrf [tenant vrf].
Note: The route entry to use must be from VxLAN to default VRF. If there is no route available, check if the VTEP locally knows the DCHP server IP address.
LEAF-1# show running-config interface vlan 10
interface Vlan10
no shutdown
vrf member tenant-a <<<< source tenant
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150 <<<< DHCP server
ip dhcp relay source-interface loopback100
LEAF-1# show ip route 10.10.10.150 vrf tenant-a
10.10.10.150/32, ubest/mbest: 1/0
*via 192.168.13.254%default, [200/0], 2w0d, bgp-65000, internal, tag 65000, segid: 303030 tunnelid: 0xd0d0dfe encap: VXLANStep 10. Verify that the DCHP server IP is reachable using the loopback interface and the corresponding VRF as a VRF source with command ping [DHCP server IP] source-interface loopback [x] vrf [tenant vrf].
LEAF-1# ping 10.10.10.150 source-interface loopback 100 vrf tenant-a
PING 10.10.10.150 (10.10.10.150): 56 data bytes
64 bytes from 10.10.10.150: icmp_seq=0 ttl=126 time=1.262 ms
64 bytes from 10.10.10.150: icmp_seq=1 ttl=126 time=0.833 ms
64 bytes from 10.10.10.150: icmp_seq=2 ttl=126 time=0.808 ms
64 bytes from 10.10.10.150: icmp_seq=3 ttl=126 time=0.795 ms
64 bytes from 10.10.10.150: icmp_seq=4 ttl=126 time=0.78 ms
--- 10.10.10.150 ping statistics ---
5 packets transmitted, 5 packets received, 0.00% packet lossStep 11. Verify the status of the DHCP relay agent.
LEAF-1# show ip dhcp status
Current CLI Operation: show ip dhcp status
Last CLI Operation: DME: ip dhcp relay information option enable
Last CLI Operation Status: SUCCESSStep 12. Verify the option82, such as vpn option and the correct relay IP address under the relay agent.
LEAF-1# show ip dhcp relay
DHCP relay service is enabled <<<<<<
Insertion of option 82 is enabled <<<<<<
Insertion of option 82 customize circuitid is disabled
TLV format in CircuitId and RemoteId suboptions is enabled
Insertion of VPN suboptions is enabled <<<<<<<
Insertion of cisco suboptions is disabled
Global smart-relay is disabled
Relay Trusted functionality is disabled
Relay Trusted Port is Globally disabled
V4 Relay Source Address HSRP is Globally disabled
Server-ID-override-disable is disabled
Smart-relay is enabled on the following interfaces:
------------------------------------------------------
Subnet-broadcast is enabled on the following interfaces:
------------------------------------------------------
Relay Trusted Port is enabled on the following interfaces:
----------------------------------------------------------
Relay Source Address HSRP is enabled on the following interfaces:
-------------------------------------------------------------------
Helper addresses are configured on the following interfaces:
Interface Relay Address VRF Name
------------- ------------- --------
Vlan10 10.10.10.150 <<<<<<<<<Step 13. Verify the statistics of packets processed and forwarded.
LEAF-1# show ip dhcp global statistics
Packets processed 1297177
Packets received through cfsoe 0
Packets forwarded 1297175
Packets forwarded on cfsoe 0
Total packets dropped 0
Packets dropped from untrusted ports 0
Packets dropped due to MAC address check failure 0
Packets dropped due to Option 82 insertion failure 0
Packets dropped due to o/p intf unknown 0
Packets dropped which were unknown 0
Packets dropped due to no trusted ports 0
Packets dropped due to dhcp relay not enabled 0
Packets dropped due to no binding entry 0
Packets dropped due to interface error/no interface 0
Packets dropped due to max hops exceeded 0
Packets dropped due to Queue full 0Step 14. Verify the statistics of relay packets.
LEAF-1# show ip dhcp relay statistics
----------------------------------------------------------------------
Message Type Rx Tx Drops
----------------------------------------------------------------------
Discover 260521 260520 0
Offer 289330 289330 0
Request(*) 267162 267161 0
Ack 8322 8322 0
Release(*) 181121 181121 0
Decline 1 1 0
Inform(*) 0 0 0
Nack 289280 289280 0
----------------------------------------------------------------------
Total 1295737 1295735 0
----------------------------------------------------------------------
DHCP L3 FWD:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
Non DHCP:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
DROP:
DHCP Relay not enabled : 0
Invalid DHCP message type : 0
Interface error : 0
Tx failure towards server : 0
Tx failure towards client : 0
Unknown output interface : 0
Unknown vrf or interface for server : 0
Max hops exceeded : 0
Option 82 validation failed : 0
Packet Malformed : 0
DHCP Request dropped on MCT : 0
Relay Trusted port not configured : 0
* - These counters will show correct value when switch
receives DHCP request packet with destination ip as broadcast
address. If request is unicast it will be HW switchedLEAF-1-vPC DHCP
Step 1. Enable the feature DCHP.
LEAF-1-VPC(config)#feature dhcpNote: The DHCP server and the relay agent command service dhcp, ip dhcp relay, and ipv6 dhcp relay are enabled by default since NX-OS 7.x.
Step 2. Apply the command ip dhcp relay information option.
LEAF-1-VPC(config)#ip dhcp relay information optionNote: This command enables the DHCP relay agent to insert and remove Option 82 information on the packets that are forwarded.
Step 3. Apply the command “ip dhcp relay information option vpn".
LEAF-1-VPC(config)# ip dhcp relay information option vpnNote: This command enables the DHCP relay requests that arrives on different VRF where the DHCP server belongs.
Step 4. Apply the command ip dhcp relay address [ip address of DCHP server].
Note: In this example the IP address for DCHP server is 10.10.10.150.
LEAF-1-VPC(config)#interface vlan 10
LEAF-1-VPC(config-if)#ip dhcp relay address 10.10.10.150Step 5. Apply the command "ip dhcp relay source-interface [unique loopback]".
Note: This command configures the source IP address for DHCP relay agent to handle Discover, Offer, Request, and ACK, for unicast communication which the DHCP relay agent uses the IP address of SVI as source IP address for DHCP relay agent. This is not desired because this IP address is shared by multiples VTEPs and black-holing of DHCP packets can happen. To avoid this, a unique IP address (using a loopback interface) is necessary to differentiate each VTEP.
LEAF-1-VPC(config)#interface vlan 10
LEAF-1-VPC(config-if)# ip dhcp relay source-interface loopback100Step 6. In the VRF corresponding tenant within BGP, direct route redistribution with a prefix-list and route-map that includes the IP address of the loopback interface.
Note: This loopback interface belongs to the tenant of SVI.
LEAF-1-VPC(config)# show running-config interface loopback 100
interface loopback100
vrf member tenant-a
ip address 172.16.10.9/32
LEAF-1-VPC(config)# ip prefix-list host_subnets seq 15 permit 172.16.10.9/32
LEAF-1-VPC(config)# route-map direct_routes_tenant-a permit 10
LEAF-1-VPC(config-route-map)# match ip address prefix-list host_subnets
LEAF-1-VPC(config-route-map)# router bgp 65000
LEAF-1-VPC(config-router)# vrf tenant-a
LEAF-1-VPC(config-router-vrf)# address-family ipv4 unicast
LEAF-1-VPC(config-router-vrf-af)# redistribute direct route-map direct_routes_tenant-aStep 7. Verify that the IP address of the loopback interface is advertised in BGP L2VPN EVPN to the Spines with the command: show bgp l2vpn evpn [loopback IP] vrf [tenant vrf].
LEAF-1-VPC# show bgp l2vpn evpn 172.16.10.9 vrf tenant-a
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 192.168.3.3:4 (L3VNI 303030)
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.9]/224, version 637
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn
Advertised path-id 1
Path type: local, path is valid, is best path, no labeled nexthop
Gateway IP: 0.0.0.0
AS-Path: NONE, path locally originated
192.168.13.1 (metric 0) from 0.0.0.0 (192.168.3.3)
Origin incomplete, MED 0, localpref 100, weight 32768
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:6026.aa85.9887
Path-id 1 advertised to peers:
192.168.0.11 Step 8. Verify that the IP address of the loopback interface is injected in BGP L2VPN EVPN where DHCP server is located.
Note: If there are Nexus switches in vPC, verify that they both learn the IP address of the loopback interface in BGP L2VPN EVPN.
LEAF-1-VPC# show bgp l2vpn evpn 172.16.10.9
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 192.168.3.3:4 (L3VNI 303030)
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.9]/224, version 637
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn
Advertised path-id 1
Path type: local, path is valid, is best path, no labeled nexthop
Gateway IP: 0.0.0.0
AS-Path: NONE, path locally originated
192.168.13.1 (metric 0) from 0.0.0.0 (192.168.3.3)
Origin incomplete, MED 0, localpref 100, weight 32768
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:6026.aa85.9887
Path-id 1 advertised to peers:
192.168.0.11 Step 9. Verify that there is a route for the DHCP server on the source tenant with command show ip route [DHCP server IP] vrf[tenant vrf].
Note: The route entry to use must be from VxLAN to default VRF. If there is no route available, check if the VTEP locally knows the DCHP server IP address.
LEAF-1-VPC# show running-config interface vlan 10
interface Vlan10
no shutdown
vrf member tenant-a <<<< source tenant
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150
ip dhcp relay source-interface loopback100
LEAF-1-VPC# show ip route 10.10.10.150 vrf tenant-a
10.10.10.150/32, ubest/mbest: 1/0, attached
*via 10.10.10.150, Vlan10, [190/0], 6d07h, hmmStep 10. Verify that the DCHP server IP is reachable using the loopback interface and the corresponding VRF as a VRF source with command ping [DHCP server IP] source-interface loopback [x] vrf [tenvrf].
LEAF-1-VPC# ping 10.10.10.150 source-interface loopback 100 vrf tenant-a
PING 10.10.10.150 (10.10.10.150): 56 data bytes
64 bytes from 10.10.10.150: icmp_seq=0 ttl=126 time=0.965 ms
64 bytes from 10.10.10.150: icmp_seq=1 ttl=126 time=0.57 ms
64 bytes from 10.10.10.150: icmp_seq=2 ttl=126 time=0.488 ms
64 bytes from 10.10.10.150: icmp_seq=3 ttl=126 time=0.524 ms
64 bytes from 10.10.10.150: icmp_seq=4 ttl=126 time=0.502 ms
--- 10.10.10.150 ping statistics ---Step 11. Verify the status of the DHCP relay agent.
LEAF-1-VPC# show ip dhcp status
Current CLI Operation: show ip dhcp status
Last CLI Operation: DME: ip dhcp relay information option vpn enable
Last CLI Operation Status: SUCCESSStep 12. Verify the option82, such as vpn option and the correct relay IP address under the relay agent.
LEAF-1-VPC# show ip dhcp relay
DHCP relay service is enabled <<<<<<
Insertion of option 82 is enabled <<<<<<<
Insertion of option 82 customize circuitid is disabled
TLV format in CircuitId and RemoteId suboptions is enabled
Insertion of VPN suboptions is enabled <<<<<<<
Insertion of cisco suboptions is disabled
Global smart-relay is disabled
Relay Trusted functionality is disabled
Relay Trusted Port is Globally disabled
V4 Relay Source Address HSRP is Globally disabled
Server-ID-override-disable is disabled
Smart-relay is enabled on the following interfaces:
------------------------------------------------------
Subnet-broadcast is enabled on the following interfaces:
------------------------------------------------------
Relay Trusted Port is enabled on the following interfaces:
----------------------------------------------------------
Relay Source Address HSRP is enabled on the following interfaces:
-------------------------------------------------------------------
Helper addresses are configured on the following interfaces:
Interface Relay Address VRF Name
------------- ------------- --------
Vlan10 10.10.10.150 <<<<<<<<<Step 13. Verify the statistics of packets processed and forwaded.
LEAF-1-VPC# show ip dhcp global statistics
Packets processed 263162
Packets received through cfsoe 0
Packets forwarded 263161
Packets forwarded on cfsoe 0
Total packets dropped 0
Packets dropped from untrusted ports 0
Packets dropped due to MAC address check failure 0
Packets dropped due to Option 82 insertion failure 0
Packets dropped due to o/p intf unknown 0
Packets dropped which were unknown 0
Packets dropped due to no trusted ports 0
Packets dropped due to dhcp relay not enabled 0
Packets dropped due to no binding entry 0
Packets dropped due to interface error/no interface 0
Packets dropped due to max hops exceeded 0
Packets dropped due to Queue full 0Step 14. Verify the statistics of relay packets.
LEAF-1-VPC# show ip dhcp relay statistics
----------------------------------------------------------------------
Message Type Rx Tx Drops
----------------------------------------------------------------------
Discover 8 7 0
Offer 29304 29304 0
Request(*) 5029 5029 0
Ack 6535 6535 0
Release(*) 191482 191482 0
Decline 0 0 0
Inform(*) 3 3 0
Nack 29281 29281 0
----------------------------------------------------------------------
Total 261642 261641 0
----------------------------------------------------------------------
DHCP L3 FWD:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
Non DHCP:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
DROP:
DHCP Relay not enabled : 0
Invalid DHCP message type : 0
Interface error : 0
Tx failure towards server : 0
Tx failure towards client : 0
Unknown output interface : 0
Unknown vrf or interface for server : 0
Max hops exceeded : 0
Option 82 validation failed : 0
Packet Malformed : 0
DHCP Request dropped on MCT : 0
Relay Trusted port not configured : 0
* - These counters will show correct value when switch
receives DHCP request packet with destination ip as broadcast
address. If request is unicast it will be HW switchedLEAF-2-vPC DHCP
Step 1. Enable the feature DCHP.
LEAF-2-VPC(config)# feature dhcpNote: The DHCP server and the relay agent command service dhcp, ip dhcp relay and ipv6 dhcp relay are enabled by default since NX-OS 7.x.
Step 2. Apply the command “ip dhcp relay information option”.
LEAF-2-VPC(config)# ip dhcp relay information optionNote: This command enables the DHCP relay agent to insert and remove Option 82 information on the packets that are forwarded.
Step 3. Apply the command “ip dhcp relay information option vpn".
LEAF-2-VPC(config)# ip dhcp relay information option vpnNote: This command enables the DHCP relay requests that arrives on different VRF where the DHCP server belongs.
Step 4. Apply the command "ip dhcp relay address [ip address of DCHP server]".
Note: In this example the IP address for DCHP server is 10.10.10.150.
LEAF-2-VPC(config)# interface vlan 10
LEAF-2-VPC(config-if)# ip dhcp relay address 10.10.10.150Step 5. Apply the command "ip dhcp relay source-interface [unique loopback]".
Note: This command configures the source IP address for DHCP relay agent to handle Discover, Offer, Request, and ACK, for unicast communication which the DHCP relay agent uses the IP address of SVI as source IP address for DHCP relay agent. This is not desired because this IP address is shared by multiples VTEPs and black-holing of DHCP packets can happen. To avoid this, a unique IP address (using a loopback interface) is necessary to differentiate each VTEP.
LEAF-2-VPC(config)# interface vlan 10
LEAF-2-VPC(config-if)# ip dhcp relay source-interface loopback 100Step 6. In the VRF corresponding tenant within BGP, direct route redistribution with a prefix-list and route-map that includes the IP address of the loopback interface.
Note: This loopback interface belongs to the tenant of SVI.
LEAF-2-VPC(config-if)# show running-config interface loopback 100
interface loopback100
vrf member tenant-a
ip address 172.16.10.10/32
LEAF-2-VPC(config)# ip prefix-list host_subnets seq 15 permit 172.16.10.10/32
LEAF-2-VPC(config)# route-map direct_routes_tenant-a permit 10
LEAF-2-VPC(config-route-map)# match ip address prefix-list host_subnets
LEAF-2-VPC(config-route-map)# router bgp 65000
LEAF-2-VPC(config-router)# vrf tenant-a
LEAF-2-VPC(config-router-vrf)# address-family ipv4 unicast
LEAF-2-VPC(config-router-vrf-af)# redistribute direct route-map direct_routes_tenant-a
Step 7. Verify that the IP address of the loopback interface is advertised in BGP L2VPN EVPN to the Spines with the command: show bgp l2vpn evpn [loopback IP] vrf [tenant vrf].
LEAF-2-VPC(config-if)# show bgp l2vpn evpn 172.16.10.10 vrf tenant-a
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 192.168.4.4:4 (L3VNI 303030)
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.10]/224, version 49
5
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn
Advertised path-id 1
Path type: local, path is valid, is best path, no labeled nexthop
Gateway IP: 0.0.0.0
AS-Path: NONE, path locally originated
192.168.13.2 (metric 0) from 0.0.0.0 (192.168.4.4)
Origin incomplete, MED 0, localpref 100, weight 32768
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:6026.aa85.9587
Path-id 1 advertised to peers:
192.168.0.11 <<<<< Spine Step 8. Verify that the IP address of the loopback interface is injected in BGP L2VPN EVPN where DHCP server is located.
Note: If there are Nexus switches in vPC, verify that they both learn the IP address of the loopback interface in BGP L2VPN EVPN.
LEAF-2-VPC(config-if)# show bgp l2vpn evpn 172.16.10.10
BGP routing table information for VRF default, address family L2VPN EVPN
Route Distinguisher: 192.168.4.4:4 (L3VNI 303030)
BGP routing table entry for [5]:[0]:[0]:[32]:[172.16.10.10]/224, version 49
5
Paths: (1 available, best #1)
Flags: (0x000002) (high32 00000000) on xmit-list, is not in l2rib/evpn
Advertised path-id 1
Path type: local, path is valid, is best path, no labeled nexthop
Gateway IP: 0.0.0.0
AS-Path: NONE, path locally originated
192.168.13.2 (metric 0) from 0.0.0.0 (192.168.4.4)
Origin incomplete, MED 0, localpref 100, weight 32768
Received label 303030
Extcommunity: RT:65000:303030 ENCAP:8 Router MAC:6026.aa85.9587
Path-id 1 advertised to peers:
192.168.0.11 Step 9. Verify that there is a route for the DHCP server on the source tenant with command show ip route [DHCP server IP] vrf[tenvrf].
Note: The route entry to use must be from VxLAN to default VRF. If there is no route available, check if the VTEP locally knows the DCHP server IP address.
LEAF-2-VPC(config-if)# show running-config interface vlan 10
interface Vlan10
no shutdown
vrf member tenant-a
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150
ip dhcp relay source-interface loopback100
LEAF-2-VPC(config-if)# show ip route 10.10.10.150 vrf tenant-a
10.10.10.150/32, ubest/mbest: 1/0, attached
*via 10.10.10.150, Vlan10, [190/0], 01:01:28, hmmStep 10. Verify that the DCHP server IP is reachable using the loopback interface and the corresponding VRF as a VRF source with command ping [DHCP server IP] source-interface loopback [x] vrf [tenant vrf].
LEAF-2-VPC(config-if)# ping 10.10.10.150 source-interface loopback 100 vrf tenant-a
PING 10.10.10.150 (10.10.10.150): 56 data bytes
64 bytes from 10.10.10.150: icmp_seq=0 ttl=127 time=0.928 ms
64 bytes from 10.10.10.150: icmp_seq=1 ttl=127 time=0.475 ms
64 bytes from 10.10.10.150: icmp_seq=2 ttl=127 time=0.455 ms
64 bytes from 10.10.10.150: icmp_seq=3 ttl=127 time=0.409 ms
64 bytes from 10.10.10.150: icmp_seq=4 ttl=127 time=0.465 ms
--- 10.10.10.150 ping statistics ---Step 11. Verify the status of the DHCP relay agent.
LEAF-2-VPC(config)# show ip dhcp status
Current CLI Operation: show ip dhcp status
Last CLI Operation: DME: ip dhcp relay information option vpn enable
Last CLI Operation Status: SUCCESSStep 12. Verify the option82, such as vpn option and the correct relay IP address under the relay agent.
LEAF-2-VPC(config)# show ip dhcp relay
DHCP relay service is enabled <<<<<<<
Insertion of option 82 is enabled <<<<<<<<<
Insertion of option 82 customize circuitid is disabled
TLV format in CircuitId and RemoteId suboptions is enabled
Insertion of VPN suboptions is enabled <<<<<<<
Insertion of cisco suboptions is disabled
Global smart-relay is disabled
Relay Trusted functionality is disabled
Relay Trusted Port is Globally disabled
V4 Relay Source Address HSRP is Globally disabled
Server-ID-override-disable is disabled
Smart-relay is enabled on the following interfaces:
------------------------------------------------------
Subnet-broadcast is enabled on the following interfaces:
------------------------------------------------------
Relay Trusted Port is enabled on the following interfaces:
----------------------------------------------------------
Relay Source Address HSRP is enabled on the following interfaces:
-------------------------------------------------------------------
Helper addresses are configured on the following interfaces:
Interface Relay Address VRF Name
------------- ------------- --------
Vlan10 10.10.10.150 <<<<Step 13. Verify the statistics of packets processed and forwaded.
LEAF-2-VPC(config)# show ip dhcp global statistics
Packets processed 103030
Packets received through cfsoe 0
Packets forwarded 103030
Packets forwarded on cfsoe 0
Total packets dropped 0
Packets dropped from untrusted ports 0
Packets dropped due to MAC address check failure 0
Packets dropped due to Option 82 insertion failure 0
Packets dropped due to o/p intf unknown 0
Packets dropped which were unknown 0
Packets dropped due to no trusted ports 0
Packets dropped due to dhcp relay not enabled 0
Packets dropped due to no binding entry 0
Packets dropped due to interface error/no interface 0
Packets dropped due to max hops exceeded 0
Packets dropped due to Queue full 0Step 14. Verify the statistics of relay packets.
LEAF-2-VPC# show ip dhcp relay statistics
----------------------------------------------------------------------
Message Type Rx Tx Drops
----------------------------------------------------------------------
Discover 29312 29311 0
Offer 300001 300001 0
Request(*) 29324 29324 0
Ack 1574 1574 0
Release(*) 191493 191493 0
Decline 0 0 0
Inform(*) 1540 1540 0
Nack 472890 472890 0
----------------------------------------------------------------------
Total 1026134 1026133 0
----------------------------------------------------------------------
DHCP L3 FWD:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
Non DHCP:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
DROP:
DHCP Relay not enabled : 0
Invalid DHCP message type : 0
Interface error : 0
Tx failure towards server : 0
Tx failure towards client : 0
Unknown output interface : 0
Unknown vrf or interface for server : 0
Max hops exceeded : 0
Option 82 validation failed : 0
Packet Malformed : 0
DHCP Request dropped on MCT : 0
Relay Trusted port not configured : 0
* - These counters will show correct value when switch
receives DHCP request packet with destination ip as broadcast
address. If request is unicast it will be HW switchedDHCP server configuration on Windows Server 2022
IP addressing scope configuration for hosts.
Step 1. Open Server Manager and validate that there are no alarms on DCHP Server in the Dashboard.
Dashboard from Server Manager on Windows Server 2022
Tip: The image enlarges when double-clicking.
Step 2. Open DHCP Server application.
DHCP Server on Windows Server 2022
Step 3. Right-click on IPv4 and click New Scope.
New Scope in DCHP
Step 4. Click Next.
Step 5. Write a Name and Description. In this example, the name is the subnet which belongs to VLAN 10 and the description is the L2VNI as L2VNI listed to VLAN 10.
Step 6. Configure the IP address range. This is the pool for hosts.
Step 6. Exclude the shared IP address from the SVI configuration in the VTEPs. In this example Interface VLAN 10 has address IP.10.10.1/24.
Warning: Failure to exclude the IP address from the SVI (or default-gateway) can cause duplication of IP addresses and impact traffic delivery.
LEAF-1# show running-config interface vlan 10
<snip>
interface Vlan10
no shutdown
vrf member tenant-a
no ip redirects
ip address 10.10.10.1/24
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.10.10.150
ip dhcp relay source-interface loopback100
Step 7. Configure lease duration of IP address. This refers to the amount of time a host can use the assigned IP address before renewing it.
Step 8. Select Yes, I want to configure these options now.
Step 9. Configure the default-gateway IP address.
Step 10. Configure domain name and DNS server.
Step 11. Configure WINS server if applicable. This can be skipped if the information is not known.
Step 12. Select Yes, I want to activate this scope now.
Configuring scope for unique IP addresses from loopbacks in SVI as DCHP relay agent.
Step 1. Right-click on IPv4 and select IPv4Scope.
New Scope in DCHP
Step 2. Write a Name and Description. In this example, name is the subnet used for subnet with loopbacks address.
IPte: A loopback is used loopbackunique IP address throughout the VxLAN fabric for VxLAN tenant. This must be advertised in BGP L2VPN EVPN route redistribution in BGP within the VRF of the corresponding tenant in the IPv4 address-famIPv4
LEAF-1# show running-config interface loopback 100
<snip>
interface loopback100
vrf member tenant-a
ip address 172.16.10.8/32
Step 3. Configure the IP address rangeIP. This is the pool for loopbacks.
Step 4. Configure exclusions (optional because the DHCP server does lease IP addresses that belong to this subnet).
Step 5. Skip the lease duration and click Next.
Step 6. Select No, I will configure these options later.
Step 7. Click Finish.
Step 8. Right-click on the created scope and select activate.
Configuring superscope for VxLAN fabric.
Step 1. Right-click in IPv4 and select New Superscope.
Step 2. Click Next.
Step 3. Write the superscope name.
Step 4. Select all the scopes that belongs to VxLAN Fabric.
Step 5. Select all the scopes that belongs to VxLAN Fabric.
Step 6. Verify that all VxLAN fabric superscope in place and click Finish.
Configure Option 82 in host scopes.
Step 1. Right-click on Policies (last option) within the scope for host and click New Policy.
Step 2. Write a name and description and click Next.
Note: In this example, the policy is created to select IP addressing paIPicularly for hosts in Leaf-1 for VNI 101010 basedVNI Remote-ID (parameter of Option 82).
Step 3. Click Add. In Criteria, select Relay Agent Information. In Operator, select Equals. Then select Agent Remote ID and type the value. Click OK and then Next.
Note: The Remote ID is obtained from the MAC address of the SVI to which the SVII is associated.
Tip: A policy can be applied to multiple Remote-IDs (or VTEPs) by adding more conditions and selecting OR instead of AND.
LEAF-1# show interface vlan 10
Vlan10 is up, line protocol is up, autostate enabled
Hardware is EtherSVI, address is 707d.b9b8.4daf <<<<
Internet Address is 10.10.10.1/24
<snip>
Step 4. Configure the IP addressing that existing IP can use on the VTEP(s) selected by the ID and then click Next.
Note: In this example there is only one virtual machine connected to Leaf-1, so only one IP address is require IPd. Here a second IP address is addedIPn case another host connects.
Step 5. Select the box to the left of 003 Router under DCHP Standard Option. Then write the IP address of the default-gateway for the hosts that belong to this policy and press Add. Click Next.
Caution: You can select more than one option but if you are not sure which value to enter, do not do so. Inconsistent or erroneous configuration can cause unexpected behavior.
Step 6. Check the policy conditions and click Finish.
DCHP packet-walk from beginning to end in VxLAN Fabric.
Discovery send by HOST-1
 |
Discovery on LEAF-1
| Discovery received on LEAF-1 | Discovery send by LEAF-1 |
|
 |
Tip: The image enlarges when double-clicking.
Discovery on SPINE
| Discovery received on SPINE | Discovery send by SPINE |
|
|
 |
Discovery on LEAF-1-vPC
| Discovery received on LEAF-1-vPC | Discovery send by LEAF-1-vPC |
 |
 |
Note: LEAF-2-vPC receives the Discovert packet but this is only switched. Destination MAC address belongs to DHCP server.
Disccovery received on DCHP Server
 |
DCHP Offer send by DCHP Server
 |
DCHP Offer on LEAF-2-vPC
| Offer received on LEAF-2-vPC | Offer send by LEAF-2-vPC |
 |
 |
DHCP Offer vPC SPINE
| Offer received on SPINE | Offer send by SPINE |
 |
 |
DHCP Offer on LEAF-1
| Offer received on LEAF-1 | Offer send on LEAF-1 |
 |
 |
DHCP Offer received on HOST-1
 |
Request send by HOST-1
 |
Request on LEAF-1
| Request received on LEAF-1 | Request send by LEAF-1 |
 |
 |
Request on SPINE
| Request received on SPINE | Request send by SPINE |
 |
 |
Request on LEAF-2-vPC
| Request recevPCd on LEAF-2-vPC | Request send byvPCAF-2-vPC |
 |
 |
Request received on DCHP Server
 |
ACK send by DCHP Server
 |
ACK on LEAF-2-vPC
| ACK received on LEAF-2-vPC | ACK send by LEAF-2-vPC |
 |
 |
ACK on SPINE
| ACK received on SPINE | ACK send by SPINE |
 |
 |
ACK on LEAF-1
| ACK received on LEAF-1 | ACK send by LEAF-1 |
 |
 |
ACK on HOST-1
 |
Related information
Troubleshoot DHCP Related Issues on Nexus 9000
Cisco Nexus 9000 Series NX-OS VXLAN Configuration Guide, Release 10.4(x)
Revision History
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Apr-2024 |
Initial Release |
FeedbackContact Cisco
- Open a Support Case
- (Requires a Cisco Service Contract)