Meraki

RVilhelmsen · ‎Sep 5 2018

Hi,

Is it possible to trust a port for dhcp responses, like in the cisco world, ip dhcp snooping trust, instead of trusting mac addresses?

/Robert

Adam · ‎Sep 5 2018

Just curious why you'd want to trust a port instead of a Mac? Worried about spoofing?

Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful click the Kudo button below
If my reply solved your issue, please mark it as a solution.

RVilhelmsen · ‎Sep 5 2018

Because from time to time, we create new vlans, and the dhcp server then have a new mac address for this vlan - and instead of maintaining mac addresses, it´s more easy to trust a single port.

Adam · ‎Sep 5 2018

If it is the same DHCP server that is providing DHCP for the additional VLAN then it shouldn't be an additional Mac address. It should be the same one. But to answer the question you are asking, it is not possible to trust a DHCP server by port. The only currently supported mechanism is via mac.

Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful click the Kudo button below
If my reply solved your issue, please mark it as a solution.

RVilhelmsen · ‎Sep 5 2018

sometimes it is a new dhcp server. and with 45 locations it would be easy (via template) to only allow dhcp servers on certain ports.

Adam · ‎Sep 5 2018

Sorry if I'm playing devil's advocate. But if it is a new DHCP server you'd have to add that port anyway which would be pretty much the same exact work as adding the mac address right?

Adam R MS | CISSP, CISM, VCP, MCITP, CCNP, ITILv3, CMNO
If this was helpful click the Kudo button below
If my reply solved your issue, please mark it as a solution.

jdsilva · ‎Sep 5 2018

Actually, I think you both might be correct here.

If I'm following correctly, @RVilhelmsen you're talking about multiple locations and therefore using a helper-address to forward DHCP requests upstream somewhere. In this scenario the ports that require trust aren't going to change at a given site even if you change the DHCP server, or change its location.

But if that's the case then even if you change the DHCP server, the MAC that you need to trust isn't going to change anyway. The local gateway will be doing the DHCP forwarding, so the switches at a given location will always see the MAC of the gateway as the DHCP server regardless of where the gateway is configured for helper-address. So in this case you still set the MAC once, and then just change the helper-address as required.

This breaks down at the "HQ" site where the actual DHCP servers reside though, and for that LAN you'd have to modify the MAC allowed under DHCP snooping.

*Edit, sorry I have DNS on the brain from another issue today. Edited this to read DHCP.

http://blog.brokennetwork.ca |

@jdsilva