Cisco Nexus 1000V Troubleshooting Guide, Release 4.2(1)SV2(2.1)

With snooping configured, DHCP client is not able to obtain an IP address from the server.

IP address was not added to binding database.

Faulty connection between DHCP server and client.

1. Verify the connection between the DHCP server(s) and the host connected to the client.

vmkping

2. If the connection between DHCP server and the host is broken, do the following:

– Check the configuration in the upstream switch, for example, verifying that the VLAN is allowed, etc.

– Make sure the server itself is up and running.

The interface of the DHCP server(s) connected to the DVS as a VM is not trusted.

1. On the VSM, verify that the interface is trusted.

show ip dhcp snooping

2. On the VSM, verify the vEthernet interface attached to the server is trusted.

module vem mod# execute vemcmd show dhcps interfaces

DHCP requests from the VM are not reaching the server for acknowledgement.

On the DHCP server, log in and use a packet capture utility to verify requests and acknowledgements in packets.

DHCP requests and acknowledgements are not reaching the Cisco Nexus 1000V.

• From the client vEthernet interface, SPAN the packets to verify they are reaching the client.
• On the host connected to the client, enable VEM packet capture to verify incoming requests and acknowledgements in packets.

The Cisco Nexus 1000V is dropping packets.

On the VSM, verify DHCP statistics.

show ip dhcp snooping statistics

module vem mod# execute vemcmd show dhcps stats

ARP inspection is not configured on the VSM

On the VSM, verify that ARP inspection is configured as expected.

show ip arp inspection

For detailed information about configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1))

DHCP snooping is not enabled globally on the VSM, or is not enabled on the VLAN.

On the VSM, verify the DHCP snooping configuration.

show ip dhcp snooping

For detailed information about enabling DHCP, and configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1)).

DHCP snooping is not enabled on the VEM, or is not enabled on the VLAN.

1. From the VSM, verify the VEM DHCP snooping configuration.

module vem mod# execute vemcmd show dhcps vlan

2. Do one of the following:

– Correct any errors in the VSM DHCP configuration. For detailed information, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1)).

– If the configuration appears correct on the VSM but fails on the VEM, capture and analyze the error logs from both VSM and the VEM to identify the reason for the failure.

If snooping is disabled, the binding entry is not statically configured in the binding table.

1. On the VSM, display the binding table.

show ip dhcp snooping binding

2. Correct any errors in the static binding table.

For detailed information about clearing entries from the table, enabling DHCP, and configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1)).

The binding corresponding to the VM sending the ARP response is not present in the binding table.

1. On the VSM, display the binding table.

show ip dhcp snooping binding

2. Correct any errors in the static binding table.

For detailed information about clearing entries from the table, enabling DHCP, and configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1)).

3. If all configurations are correct, make sure to turn on DHCP snooping before DAI or IPSG. This is to make sure the Cisco Nexus 1000V has enough time to add the binding in the snooping database.

For more information, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1)).

Traffic disruptions

ARP inspection is not configured on the VSM.

On the VSM, verify that IP Source Guard is configured as expected.

show port-profile name profile_name

show running interface if_ID

show ip verify source

For detailed information about configuring IP Source Guard, see the Cisco Nexus 1000V Security Configuration Guide, Release 4.2(1)SV2(1.1))

The IP address corresponding to the vEthernet interface is not in the snooping binding table.

1. On the VSM, display the binding table.

show ip dhcp snooping binding

2. Configure the missing static entry or renew the lease on the VM.

3. On the VSM, display the binding table again to verify the entry is added correctly.

show ip dhcp snooping binding

show running-config dhcp

Displays the DHCP snooping, DAI, and IP Source Guard configuration

See Example 19-1 on page 19-7 .

show ip dhcp snooping

Displays general information about DHCP snooping.

See Example 19-2 on page 19-7 .

show ip dhcp snooping binding

Display the contents of the DHCP snooping binding table.

See Example 19-3 on page 19-7 .

show feature

Displays the features available, such as DHCP, and whether they are enabled.

See Example 19-4 on page 19-8 .

show ip arp inspection

Displays the status of DAI.

See Example 19-5 on page 19-8 .

show ip arp inspection interface vethernet interface-number

Displays the trust state and ARP packet rate for a specific interface.

See Example 19-6 on page 19-8 .

show ip arp inspection vlan vlan-ID

Displays the DAI configuration for a specific VLAN.

See Example 19-7 on page 19-8 .

show ip verify source

Displays interfaces where IP source guard is enabled and the IP-MAC address bindings.

See Example 19-8 on page 19-9 .

show system internal dhcp { event-history | mem-stats | msgs }

Debugs any issues in the filter-mode configuration. See Example 19-9 on page 19-9 , Example 19-10 on page 19-9 , and Example 19-11 on page 19-10 .

Debug dhcp all

Enables debug all for dhcp configuration flags on the VSM. See Example 19-12 on page 19-10 .