DHCP issue

[khitan]

Ive been using VLAN tagging for some time now. I use Adtran 1335 POE routers and 1234/8 switches. I put all DHCP pools on the 1335. This is data and voice.

The reason is that when I put the data pool on MS server 2003 and the voice on the 1335 I end up stacking the data pool with BAD_ADDRESS . One phone will load up a 100 ip range on the windows server. It doesnt matter if I move the voice to the windows server or leave it on the adtran this happens.

It appears that the windows dhcp server cant handle the layer2tagging part of option 156. If I leave the data and voice on seperate LAN's then there is no issue with putting the pools on the windows server.

Ive looked and looked and have been unable to find any documentation on this 'feature' in the windows server. Has anyone else had an issue with invoking layer2tagging in the 156 option on a windows dhcp server?

[Miersk]

ok, windows option 156 is fine. I suspect the phone is having trouble with 1335. Either try lowering the VLAN and see if the phone comes up, or wireshark the phone.

[cburgy]

Bad Address is indicative of you having your switch port configured as a trunk with your data vlan untagged and the voice vlan tagged.

The windows DHCP server MUST be configured as an access port on whatever vlan is in the subnet you specify for your IP helper address in the switch (i.e. the main data vlan).

[khitan]

Chris,
thanks man, once I changed TRUNK mode to ACCESS and gave ACCESS VLAN 1(data) it came up just fine. I've been fighting this one for about 8 or 9 months... I owe you one.

K

[cburgy]

Glad to be of help!

[sschnei]

OMG!! I have fought with this same issue (different switch vendor) for over 2 years!! I have send packet traces to ShoreTel and Switch vendor - I have research issue on Internet and Microsoft site and have never found this tidbit of information. I have even opened and paid for a Microsoft ticket. My workaround hase been to create a DHCP server on a sperate VLAN from the Data and VoIP networks and then everything works great. Of course with that senario the port is just an access port.
Thank you so much!!

[cburgy]

Yikes, that's a long time.

I have to boast for a brief minute. I think this highlights the value that a strong Shoretel partner with a data heritage brings. We do a lot of network projects outside of Shoretel and involving other mission-critical technologies (virtualization and storage via iSCSI). When you deal with networks a lot, you pick up the tricks of the trade (much to the same effect with Shoretel).

[chrisknight]

I think this may be the same issue I'm having on 2 different networks.
The data DHCP scope is filling with BAD_ADDRESS and a weird "MAC address" that looks like: 4E00A8C0. Converted to decimal, this is a valid IP address inverted. I'll check this out. Thanks!

Update:
Confirmed that switch port has no tagging on data VLAN and tagging on Voice VLAN.
This solved the problem. DHCP server switch port is on default (data) VLAN with no tagging now and works great!

THANK YOU!!!

[chrisknight]

I think this may be the same issue I'm having on 2 different networks.
The data DHCP scope is filling with BAD_ADDRESS and a weird "MAC address" that looks like: 4E00A8C0. Converted to decimal, this is a valid IP address inverted. I'll check this out. Thanks!

Update:
Confirmed that switch port has no tagging on data VLAN and tagging on Voice VLAN.
This solved the problem. DHCP server switch port is on default (data) VLAN with no tagging now and works great!

THANK YOU!!!

Dang, Spoke too soon. Same thing at 3 different sites. 1 site has no VLANS and no managed switches. If we put DHCP on the router(s) then its all good. Could there be a funky MS patch or something? ...Same thing exactly at 3 sites. DHCP scope filling up with BAD_ADDRESS with weird physical addresses in hex that is the IP address in decimal backwards...

[eazeaz]

Bad Address

I think that may be how microsoft DHCP shows addresses that fail conflict detection.

If you have conflict detection turned on, and the server finds that address is already active, it will be listed as a bad address. This can happen if the dhcp server is rebooted, all the clients still have valid leases which the server doesnt know about. In that scenario, almost all of your addresses will show "BAD", until the leases are renewed.

I am not 100% sure on all this, but it does sound similar to something like this.

[ShoreTel_Dave]

@chrisknight Where is the DHCP server in the multi site scenario. Assuming it is not the router and it is a windows server, is there a central one over the WAN or one at each site?

Make sure you have just one scope for each site.
Don't use superscopes.
Assuming a central DHCP server, and you have some sort of IP helper on the default gateway at the remote site: Make sure the DHCP server can ping the Default gateway at each site. Make sure the scope for each site has the same ip range and subnet mask as the router at the remote site.

[chrisknight]

I think that may be how microsoft DHCP shows addresses that fail conflict detection.

If you have conflict detection turned on, and the server finds that address is already active, it will be listed as a bad address. This can happen if the dhcp server is rebooted, all the clients still have valid leases which the server doesnt know about. In that scenario, almost all of your addresses will show "BAD", until the leases are renewed.

I am not 100% sure on all this, but it does sound similar to something like this.

Hmmm... I know that conflict detection is turned on at 1 site. It seems like the network is just fine until we add the phones. We have tried to bring everything down, even phones. Power up servers first, then power on phones. Its only a matter of time before no phones can get an IP address because the scope is full. On a network with no VLANs then no PC or Phones can get a lease. We have evened shortened the lease time and waited. Weird.

@chrisknight Where is the DHCP server in the multi site scenario. Assuming it is not the router and it is a windows server, is there a central one over the WAN or one at each site?

Make sure you have just one scope for each site.
Don't use superscopes.
Assuming a central DHCP server, and you have some sort of IP helper on the default gateway at the remote site: Make sure the DHCP server can ping the Default gateway at each site. Make sure the scope for each site has the same ip range and subnet mask as the router at the remote site.

I should have specified that these 3 sites are unrelated, and different companies. Each site is a single building with 1 main DHCP server.

I guess I need to better understand DHCP in this situation.
Lets say I have a voice VLAN 2.
A phone cold boots, grabs an IP address on the default VLAN, gets option 156 and reboots with the command to come up on VLAN 2.
Then the phone boots up and grabs an IP address in the voice VLAN and everything is happy.

Now, What happens to the 1st, default VLAN IP address/lease that the phone had for all of 10 seconds before rebooting with VLAN 2 info?

Does it just hang open until the lease expires? Does a command get sent back the the DHCP server to release it back into the pool?