DHCP Option82

Information About DHCP Option 82

DHCP Option 82 is organized as a single DHCP option that contains information known by the relay agent. This feature provides additional security when DHCP is used to allocate network addresses, and enables the Cisco controller to act as a DHCP relay agent to prevent DHCP client requests from untrusted sources.

The controller can be configured to add Option 82 information to DHCP requests from clients before forwarding the requests to a DHCP server. The DHCP server can then be configured to allocate IP addresses to the wireless client based on the information present in DHCP Option 82.

DHCP provides a framework for passing configuration information to hosts on a TCP/IP network. Configuration parameters and other control information are carried in tagged data items that are stored in the Options field of the DHCP message. The data items themselves are also called options. Option 82 contains information known by the relay agent.

The Relay Agent Information option is organized as a single DHCP option that contains one or more suboptions that convey information known by the relay agent. Option 82 was designed to allow a DHCP Relay Agent to insert circuit−specific information into a request that is being forwarded to a DHCP server. This option works by setting two suboptions:

  • Circuit ID

  • Remote ID

The Circuit ID suboption includes information that is specific to the circuit the request came in on. This suboption is an identifier that is specific to the relay agent. Thus, the circuit that is described will vary depending on the relay agent.

The Remote ID suboption includes information on the remote host–end of the circuit. This suboption usually contains information that identifies the relay agent. In a wireless network, this would likely be a unique identifier of the wireless access point.


Note

All valid Remote ID combinations are separated with a colon (:) as the delimiter.

You can configure the following DHCP Option 82 options in a controller :

  • DHCP Enable

  • DHCP Opt82 Enable

  • DHCP Opt82 Ascii

  • DHCP Opt82 RID

  • DHCP Opt Format

  • DHCP AP MAC

  • DHCP SSID

  • DHCP AP ETH MAC

  • DHCP AP NAME

  • DHCP Site Tag

  • DHCP AP Location

  • DHCP VLAN ID


Note

The controller includes the SSID in ASCII and the VLAN-ID in hexadecimal format within the remote-ID sub-option of option 82 in the outgoing DHCP packets to the server for the following configurations: 

ipv4 dhcp opt82 format ssid
ipv4 dhcp opt82 format vlan-id

However, if ipv4 dhcp opt82 ascii configuration is also present, the controller adds VLAN-ID and SSID in ASCII format.

For Cisco Catalyst 9800 Series Configuration Best Practices, see the following link: https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/guide-c07-743627.html

Configuring DHCP Option 82 Global Interface

Configuring DHCP Option 82 Globally Through Server Override (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

ip dhcp-relay information option server-override

Example:

Device(config)# ip dhcp-relay information option server-override

Inserts global server override and link selection suboptions.

Configuring DHCP Option 82 Through Server Override (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

ip dhcp compatibility suboption server-override [cisco | standard]

Example:

Device(config)# ip dhcp compatibility suboption server-override cisco

Configures the server override suboption to an RFC or Cisco specific value.

Step 3

ip dhcp compatibility suboption link-selection [cisco | standard]

Example:

Device(config)# ip dhcp compatibility suboption link-selection cisco

Configures the link-selection suboption to an RFC or Cisco specific value.

Configuring DHCP Option 82 Globally Through Different SVIs (GUI)

Procedure

Step 1

Choose Configuration > VLAN.

Step 2

Choose a VLAN from the drop-down list.

The Edit SVI window appears.

Step 3

Click the Advanced tab.

Step 4

Choose an option from the IPv4 Inbound ACL drop-down list.

Step 5

Choose an option from the IPv4 Outbound ACL drop-down list.

Step 6

Choose an option from the IPv6 Inbound ACL drop-down list.

Step 7

Choose an option from the IPv6 Outbound ACL drop-down list.

Step 8

Enter an IP address in the IPv4 Helper Address field.

Step 9

Set the status to Enabled if you want to enable the Relay Information Option setting.

Step 10

Enter the Subscriber ID.

Step 11

Set the status to Enabled if you want to enable the Server ID Override setting.

Step 12

Set the status to Enabled if you want to enable the Option Insert setting.

Step 13

Choose an option from the Source-Interface Vlan drop-down list.

Step 14

Click Update & Apply to Device.

Configuring DHCP Option 82 Globally Through Different SVIs (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

ip dhcp-relay source-interface vlan vlan-id

Example:

Device(config)# ip dhcp-relay source-interface vlan 74

Sets global source interface for relayed messages.

Configuring DHCP Option 82 Format

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy policy-name

Example:

Device(config)# wireless profile policy pp3

Enables configuration for the specified profile policy.

Step 3

shutdown

Example:

Device(config-wireless-policy)# shutdown

Shuts down the profile policy.

Step 4

vlan vlan-name

Example:

Device(config-wireless-policy)# vlan 72

Assigns the profile policy to a VLAN.

Step 5

session-timeout value-btwn-20-86400

Example:

Device(config-wireless-policy)# session-timeout 300

(Optional) Sets the session timeout value in seconds. The range is between 20-86400.

Step 6

idle-timeout value-btwn-15-100000

Example:

Device(config-wireless-policy)# idle-timeout 15

(Optional) Sets the idle timeout value in seconds. The range is between 15-100000.

Step 7

central switching

Example:

Device(config-wireless-policy)# central switching

Enables central switching.

Step 8

ipv4 dhcp opt82

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82

Enables DHCP Option 82 for the wireless clients.

Step 9

ipv4 dhcp opt82 ascii

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 ascii

(Optional) Enables ASCII on the DHCP Option 82 feature.

Step 10

ipv4 dhcp opt82 rid

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 rid

(Optional) Supports the addition of Cisco 2 byte Remote ID (RID) for the DHCP Option 82 feature.

Step 11

ipv4 dhcp opt82 format { ap_ethmac| ap_location| apmac| apname| policy_tag| ssid| vlan_id}

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 format apmac

Enables DHCP Option 82 on the corresponding AP.

For information on the various options available with the command, see Cisco Catalyst 9800 Series Wireless Controller Command Reference.

Step 12

no shutdown

Example:

Device(config-wireless-policy)# no shutdown

Enables the profile policy.

Configuring DHCP Option82 Through a VLAN Interface

Configuring DHCP Option 82 Through Option-Insert Command (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

interface vlan vlan-id

Example:

Device(config)# interface vlan 72

Configures a VLAN ID.

Step 3

ip dhcp relay information option-insert

Example:

Device(config-if)# ip dhcp relay information option-insert

Inserts relay information in BOOTREQUEST.

Step 4

ip address ip-address

Example:

Device(config-if)# ip address 9.3.72.38 255.255.255.0

Configures the IP address for the interface.

Step 5

ip helper-address ip-address

Example:

Device(config-if)# ip helper-address 9.3.72.1

Configures the destination address for UDP broadcasts.

Step 6

[no] mop enabled

Example:

Device(config-if)# no mop enabled

Disables the MOP for an interface.

Step 7

[no] mop sysid

Example:

Device(config-apgroup)# [no] mop sysid

Disables the task of sending MOP periodic system ID messages.

Configuring DHCP Option 82 Through the server-ID-override Command (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

ip dhcp compatibility suboption server-override cisco

Example:

Device(config)# ip dhcp compatibility suboption server-override cisco

Configures the server-id override suboption to an RFC or Cisco specific value.

Step 3

ip dhcp compatibility suboption link-selection cisco

Example:

Device(config)# ip dhcp compatibility suboption link-selection cisco

Configures the link-selection suboption to an RFC or Cisco specific value.

Step 4

interface vlan vlan-id

Example:

Device(config)# interface vlan 72

Configures a VLAN ID.

Step 5

ip dhcp relay information option server-id-override

Example:

Device(config-if)# ip dhcp relay information option server-id-override

Inserts the server id override and link selection suboptions.

Step 6

ip address ip-address

Example:

Device(config-if)# ip address 9.3.72.38 255.255.255.0

Configures the IP address for the interface.

Step 7

ip helper-address ip-address

Example:

Device(config-if)# ip helper-address 9.3.72.1

Configures the destination address for UDP broadcasts.

Step 8

[no] mop enabled

Example:

Device(config-if)# no mop enabled

Disables MOP for an interface.

Step 9

[no] mop sysid

Example:

Device(config-if)# [no] mop sysid

Disables the task of sending MOP periodic system ID messages.

Configuring DHCP Option 82 Through a Subscriber-ID (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

interface vlan vlan-id

Example:

Device(config)# interface vlan 72

Configures a VLAN ID.

Step 3

ip dhcp relay information option subscriber-id subscriber-id

Example:

Device(config-if)# ip dhcp relay information option subscriber-id test10

Inserts the subscriber identifier suboption.

Step 4

ip address ip-address

Example:

Device(config-if)# ip address 9.3.72.38 255.255.255.0

Configures the IP address for the interface.

Step 5

ip helper-address ip-address

Example:

Device(config-if)# ip helper-address 9.3.72.1

Configures the destination address for UDP broadcasts.

Step 6

[no] mop enabled

Example:

Device(config-if)# no mop enabled

Disables MOP for an interface.

Step 7

[no] mop sysid

Example:

Device(config-apgroup)# [no] mop sysid

Disables the task of sending MOP periodic system ID messages.

Configuring DHCP Option 82 Through server-ID-override and subscriber-ID Commands (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

interface vlan vlan-id

Example:

Device(config)# interface vlan 72

Configures a VLAN ID.

Step 3

ip dhcp relay information option server-id-override

Example:

Device(config-if)# ip dhcp relay information option server-id-override

Inserts server ID override and link selection suboptions.

Step 4

ip dhcp relay information option subscriber-id subscriber-id

Example:

Device(config-if)# ip dhcp relay information option subscriber-id test10

Inserts the subscriber identifier suboption.

Step 5

ip address ip-address

Example:

Device(config-if)# ip address 9.3.72.38 255.255.255.0

Configures the IP address for the interface.

Step 6

ip helper-address ip-address

Example:

Device(config-if)# ip helper-address 9.3.72.1

Configures the destination address for UDP broadcasts.

Step 7

[no] mop enabled

Example:

Device(config-if)# no mop enabled

Disables the MOP for an interface.

Step 8

[no] mop sysid

Example:

Device(config-apgroup)# [no] mop sysid

Disables the task of sending MOP periodic system ID messages.

Configuring DHCP Option 82 Through Different SVIs (CLI)

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:


Device# configure terminal

Enters global configuration mode.

Step 2

interface vlan vlan-id

Example:

Device(config)# interface vlan 72

Configures a VLAN ID.

Step 3

ip dhcp relay source-interface vlan vlan-id

Example:

Device(config-if)# ip dhcp relay source-interface vlan 74

Configures a source interface for relayed messages on a VLAN ID.

Step 4

ip address ip-address

Example:

Device(config-if)# ip address 9.3.72.38 255.255.255.0

Configures the IP address for the interface.

Step 5

ip helper-address ip-address

Example:

Device(config-if)# ip helper-address 9.3.72.1

Configure the destination address for UDP broadcasts.

Step 6

[no] mop enabled

Example:

Device(config-if)# no mop enabled

Disables the MOP for an interface.

Step 7

[no] mop sysid

Example:

Device(config-apgroup)# [no] mop sysid

Disables the task of sending MOP periodic system ID messages.

Information About AP DHCP Option 82 Support on FlexConnect Local Switching Mode

The DHCP Option 82 provides additional information on the physical attachment of the client. It enhances security while using DHCP for network address allocation.

The AP DHCP Option82 Support on FlexConnect Local Switching Mode feature enables the AP to act as a DHCP relay agent to prevent DHCP client requests from unreliable sources. As a DHCP relay agent, the AP can add DHCP Option 82 information such as AP MAC, AP Name, and SSID to DHCP requests from clients before forwarding the requests to the DHCP server. Afterward, the DHCP servers can allocate IP addresses to wireless clients based on the data contained within DHCP Option 82.

This feature is supported only in FlexConnect Local Switching mode.

Configuring AP DHCP Option82 Support

Procedure

  Command or Action Purpose

Step 1

configure terminal

Example:

Device# configure terminal

Enters global configuration mode.

Step 2

wireless profile policy policy-name

Example:

Device(config)# wireless profile policy policy-ap

Enables configuration for the specified profile policy.

Step 3

shutdown

Example:

Device(config-wireless-policy)# shutdown

Shuts down the profile policy.

Step 4

ipv4 dhcp opt82 format { apmac| apname}

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 format apmac

Configures the AP MAC address or the AP name format to be added to DHCP requests from clients before forwarding them to the DHCP server.

You can use either apmac or apname , but not both.

Step 5

ipv4 dhcp opt82 format ssid

Example:

Device(config-wireless-policy)# ipv4 dhcp opt82 format ssid

Configures the unique SSID format to be added to DHCP requests from clients before forwarding them to the DHCP server.

Step 6

no shutdown

Example:

Device(config-wireless-policy)# no shutdown

Enables the profile policy.

Verifying AP DHCP Option82 Support

To verify the configured parameters for DHCP Option82, use the following command on the AP console:


Note

You can fetch information about the WLAN and WLAN ID using the show flexconnect wlan command. 

Device# show flexconnect dhcp option-82 wlan 1

DHCP OPTION 82 CONFIG FOR WLAN:
VAP ID      :0
Format      :Binary
Delimiter   :":"
Circuit-ID  :
Remote-ID   :
    AP Name
    SSID-Name

To verify whether DHCP Option82 is enabled on the controller, use the following command:

Device# show wireless profile policy detailed

Opt82
  SSID                     : ENABLED
  AP_ETHMAC                : DISABLED
  APNAME                   : ENABLED