Interminent DHCP issues

[127.0.0.1]

2 scopes with one pool each

• How many subnet mask bits are you using?  /24?  Something else?
  
• What do the scopes look like?  Maybe a screen shot of your scopes expanded?
  Scope A
  --lease range = w.w.w.w thru x.x.x.x
  Scope B
  --lease range = y.y.y.y thru z.z.z.z
  
• Previously you mentioned 130 phones.  Are there more?
  
• You confirmed a single VLAN for all voice devices and that it extends between floors.  This makes makes a single broadcast domain and each scope would be reachable by either floor.  One DHCP server would be fine.

If the lease ranges overlap you can run into DHCP offer issues where scope B will offer an in-use address already leased by scope A, or vice-versa.  If this is occurring, then when the phone receives the offer it will immediately ARP for the address to see if another device owns it.  Actually, this happens every time an offer is received, but it should never receive a reply to this ARP request in a clean network.  If it does, then it declines the offer and broadcasts another DHCP discovery packet.  Since the offering scope did not lease it successfully, it re-offers the same address.  Rinse and repeat.  The wireshark capture will reveal this.

[MartinM]

One thing I guess I forgot to ask.
Are you using the same DHCP server for both vlans or is the 3300 handling the voice vlan?


Ralph

One DHCP server handling all the scopes. Should I think about moving the voice scope to the controller instead?

[martyn]

Shifting DHCP to a different spot could resolve the problem, but ultimately it is just masking the issue, which will just rear its head later on, usually at a much more inconvenient time!

[MartinM]

Yes, that is true. But I am at the end of my wit with this one.

[127.0.0.1]

2 scopes with one pool each

• How many subnet mask bits are you using?  /24?  Something else?
• What do the scopes look like?  Maybe a screen shot of your scopes expanded?
  Scope A
  --lease range = w.w.w.w thru x.x.x.x
  Scope B
  --lease range = y.y.y.y thru z.z.z.z
• Previously you mentioned 130 phones.  Are there more?
• You confirmed a single VLAN for all voice devices and that it extends between floors.  This makes makes a single broadcast domain and each scope would be reachable by either floor.  One DHCP server would be fine.

If the lease ranges overlap you can run into DHCP offer issues where scope B will offer an in-use address already leased by scope A, or vice-versa.  If this is occurring, then when the phone receives the offer it will immediately ARP for the address to see if another device owns it.  Actually, this happens every time an offer is received, but it should never receive a reply to this ARP request in a clean network.  If it does, then it declines the offer and broadcasts another DHCP discovery packet.  Since the offering scope did not lease it successfully, it re-offers the same address.  Rinse and repeat.  The wireshark capture will reveal this.

^^^^^^^

[MartinM]

   

• How many subnet mask bits are you using?  /24?  Something else?

Both scopes are /24

   

• What do the scopes look like?  Maybe a screen shot of your scopes expanded?
  
  

Scope A
--lease range = 10.61.20.0 -> 20-250
Scope B
--lease range = 10.61.21.0 -> 20-250

   

• Previously you mentioned 130 phones.  Are there more?

Currently there is a big growth within the company and we expect doubling of users within a year.

   

• You confirmed a single VLAN for all voice devices and that it extends between floors.  This makes makes a single broadcast domain and each scope would be reachable by either floor.  One DHCP server would be fine.

The are separate broadcast domains, different switches separated by a firewall

If the lease ranges overlap you can run into DHCP offer issues where scope B will offer an in-use address already leased by scope A, or vice-versa.  If this is occurring, then when the phone receives the offer it will immediately ARP for the address to see if another device owns it.  Actually, this happens every time an offer is received, but it should never receive a reply to this ARP request in a clean network.  If it does, then it declines the offer and broadcasts another DHCP discovery packet.  Since the offering scope did not lease it successfully, it re-offers the same address.  Rinse and repeat.  The wireshark capture will reveal this.

The scopes do not overlap

Still looking into doing the wire shark, just a little busy with other stuff. Should have this by tomorrow


Thanks again

[127.0.0.1]

The two subnets do have different VLAN ID's, right?  1001 and 100_?

[MartinM]

No same VLAN id. They VLAN ID gets stripped at the firewall and gets passed on only as normal IP traffic

[127.0.0.1]

OK, I haven't seen a diagram yet, so here's Visio 0.1....  Is this close?  If so, where is your layer 3 happening?  In the firewall?

phone1---{sw1.vlan1001}---{fw}---{sw2.vlan1001}---phone2
         { 10.61.20.0 }    |     { 10.61.21.0 }
                           |
                          DHCP.192.168.0.2
                           |
                           |_scopeA.10.61.20.0
                           |_scopeB.10.61.21.0

[MartinM]

OK, I haven't seen a diagram yet, so here's Visio 0.1....  Is this close?  If so, where is your layer 3 happening?  In the firewall?

phone1---{sw1.vlan1001}---{fw}---{sw2.vlan1001}---phone2
         { 10.61.20.0 }    |     { 10.61.21.0 }
                           |
                          DHCP.192.168.0.2
                           |
                           |_scopeA.10.61.20.0
                           |_scopeB.10.61.21.0

Nice diagram!

Yes, that is correct, and the routing is done on the firewall.

[127.0.0.1]

A few unsolicited thoughts here.  Switch where you can, route where you must.  Do you really need to route between floors?  Flattening the voice subnets into a larger broadcast domain (drop a mask bit or two) and then just straight trunking between floors would actually be more efficient.  Layer 2 is always faster than layer 3.  It's science.

Is the controller in the .20 or .21 subnet?  Can you just kill the helper and turn on DHCP in the controller for a minute and just get a test?  Per RFC, DHCP only refreshes at T1 and T2, which are 1/2 and 7/8 of the way through a lease duration.  I doubt it will cause any interruption if you bang this out quickly.


Sent from my iPad using Tapatalk

[MartinM]

The route between floor is unfortunately required. The floors needs to be separated due to the way the physical wiring is set up.

The controller is on another subnet once again, this one is 192.168.102.0/24. So if I use it for DHCP, the ip-helper will still be required. Only thing I can think of is using the switches for the VOICE LAN DHCP.