Cisco Nexus 1000V Troubleshooting Guide, Release 5.2(1)SV3(1.1)

With snooping configured, the DHCP client is not able to obtain an IP address from the server.

The IP address was not added to the binding database.

A faulty connection is between the DHCP server and client.

1. Verify the connection between the DHCP server(s) and the host connected to the client.

vmkping

2. If the connection between the DHCP server and the host is broken, do the following:

– Check the configuration in the upstream switch, for example, verifying that the VLAN is allowed.

– Make sure that the server is up and running.

The interface of the DHCP server(s) connected to the DVS as a VM is not trusted.

1. On the Virtual Supervisor Module (VSM), verify that the interface is trusted.

show ip dhcp snooping

2. On the VSM, verify that the vEthernet interface attached to the server is trusted.

module vem mod# execute vemcmd show dhcps interfaces

DHCP requests from the VM are not reaching the server for acknowledgement.

On the DHCP server, log in and use a packet capture utility to verify requests and acknowledgements in packets.

DHCP requests and acknowledgements are not reaching the Cisco Nexus 1000V.

• From the client vEthernet interface, SPAN the packets to verify they are reaching the client.
• On the host connected to the client, enable VEM packet capture to verify incoming requests and acknowledgements in packets.

The Cisco Nexus 1000V is dropping packets.

On the VSM, verify DHCP statistics.

show ip dhcp snooping statistics

module vem mod# execute vemcmd show dhcps stats

ARP inspection is not configured on the VSM

On the VSM, verify that ARP inspection is configured as expected.

show ip arp inspection

For detailed information about configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide.

DHCP snooping is not enabled globally on the VSM or is not enabled on the VLAN.

On the VSM, verify the DHCP snooping configuration.

show ip dhcp snooping

For detailed information about enabling DHCP and configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide.

DHCP snooping is not enabled on the VEM or is not enabled on the VLAN.

1. From the VSM, verify the VEM DHCP snooping configuration.

module vem mod# execute vemcmd show dhcps vlan

2. Do one of the following:

– Correct any errors in the VSM DHCP configuration. For detailed information, see the Cisco Nexus 1000V Security Configuration Guide.

– If the configuration appears correct on the VSM but fails on the VEM, capture and analyze the error logs from both the VSM and the VEM to identify the reason for the failure.

If snooping is disabled, the binding entry is not statically configured in the binding table.

1. On the VSM, display the binding table.

show ip dhcp snooping binding

2. Correct any errors in the static binding table.

For detailed information about clearing entries from the table, enabling DHCP, and configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide.

The binding that corresponds to the VM sending the ARP response is not present in the binding table.

1. On the VSM, display the binding table.

show ip dhcp snooping binding

2. Correct any errors in the static binding table.

For detailed information about clearing entries from the table, enabling DHCP, and configuring DAI, see the Cisco Nexus 1000V Security Configuration Guide.

3. If all configurations are correct, make sure to turn on DHCP snooping before DAI or IPSG to make sure the Cisco Nexus 1000V has enough time to add the binding in the snooping database.

For more information, see the Cisco Nexus 1000V Security Configuration Guide.

Traffic disruptions

ARP inspection is not configured on the VSM.

On the VSM, verify that IP Source Guard is configured as expected.

show port-profile name profile_name

show running interface if_ID

show ip verify source

For detailed information about configuring IP Source Guard, see the Cisco Nexus 1000V Security Configuration Guide

The IP address that corresponds to the vEthernet interface is not in the snooping binding table.

1. On the VSM, display the binding table.

show ip dhcp snooping binding

2. Configure the missing static entry or renew the lease on the VM.

3. On the VSM, display the binding table again to verify that the entry is added correctly.

show ip dhcp snooping binding

show running-config dhcp

Displays the DHCP snooping, DAI, and IP Source Guard configuration

See Example 20-1 on page 20-7 .

show ip dhcp snooping

Displays general information about DHCP snooping.

See Example 20-2 on page 20-7 .

show ip dhcp snooping binding

Displays the contents of the DHCP snooping binding table.

See Example 20-3 on page 20-8 .

show feature

Displays the features available, such as DHCP, and whether they are enabled.

See Example 20-4 on page 20-8 .

show ip arp inspection

Displays the status of DAI.

See Example 20-5 on page 20-8 .

show ip arp inspection interface vethernet interface-number

Displays the trust state and ARP packet rate for a specific interface.

See Example 20-6 on page 20-8 .

show ip arp inspection vlan vlan-ID

Displays the DAI configuration for a specific VLAN.

See Example 20-7 on page 20-9 .

show ip verify source

Displays interfaces where IP source guard is enabled and the IP-MAC address bindings.

See Example 20-8 on page 20-9 .

show system internal dhcp {event-history | mem-stats | msgs}

Debugs any issues in the filter-mode configuration. See Example 20-9 on page 20-9 , Example 20-10 on page 20-9 , and Example 20-11 on page 20-10 .

debug dhcp all

Enables debug all for DHCP configuration flags on the VSM. See Example 20-12 on page 20-10 .