Examkin

Question

Difficulty: HardTroubleshooting IP Addressing and DHCP Services

A network administrator is troubleshooting an issue where new Linux servers in VLAN 105 (192.168.105.0/24192.168.105.0/24) fail to acquire dynamic IP addresses from a central DHCP server (10.10.1.5010.10.1.50) located across a Layer 3 boundary. The router subinterface for VLAN 105 (`Gi0/0.105`) is configured with `ip helper-address 10.10.1.50`. However, packet captures show that client DHCP DISCOVER requests sent to 255.255.255.255255.255.255.255 are received on `Gi0/0.105`, but no unicast DHCP messages are ever transmitted from the router toward 10.10.1.5010.10.1.50, and client systems eventually assign themselves APIPA addresses. Upon reviewing the router interface configuration and DHCP server status, which TWO conditions would explain this behavior?

  1. An inbound Access Control List (ACL) applied to interface `Gi0/0.105` explicitly blocks incoming UDP port 67 traffic, preventing the router relay process from intercepting client requests.Answer
  2. The central DHCP server lacks an active scope matching the gateway IP address (`giaddr`) of 192.168.105.1192.168.105.1 inserted by the relay agent.Answer
  3. C
    The `ip helper-address` directive was misconfigured because it must be placed on the central DHCP server's local switch port rather than the client gateway router interface.
  4. D
    Clients fall back to APIPA addresses (169.254.x.x169.254.x.x) primarily because the subinterface `Gi0/0.105` IP address resides on a different IP subnet than the central DHCP server.

Answer

The two conditions explaining the lease failure are that an inbound ACL on the subinterface is blocking incoming UDP port 67 broadcast traffic, and that the central DHCP server lacks an active scope corresponding to the relay agent's gateway IP address (giaddr).
DHCP relay agents must receive client broadcast traffic on UDP port 67 to process and encapsulate requests into unicast packets directed to the DHCP server. If an inbound Access Control List blocks UDP port 67 on the client subinterface, relaying fails immediately. Additionally, when relayed packets arrive at the DHCP server, the server inspects the `giaddr` field (set to the router's subinterface IP) to select an appropriate pool; if no matching scope exists for that subnet on the server, no lease offer can be generated.

Step-by-Step Solution

1
Analyze the DHCP Relay mechanism on Layer 3 interfaces.
DHCP clients send local broadcast packets (destination UDP 67). The router interface with `ip helper-address` must intercept these incoming broadcasts before relaying them as unicast UDP packets (destination 10.10.1.5010.10.1.50, UDP port 67).
If an inbound ACL filters UDP port 67 on the subinterface, the router drops the broadcast frame before it reaches the CPU/relay process.
2
Evaluate the relay agent packet fields and server scope matching.
The relay agent populates the `giaddr` field with its subinterface IP (192.168.105.1192.168.105.1). The DHCP server uses `giaddr` to select the appropriate scope.
If the central DHCP server does not have an active scope defined for 192.168.105.0/24192.168.105.0/24, it cannot assign an address, causing the DORA process to fail and clients to generate APIPA (169.254.x.x169.254.x.x) addresses.

Key Concept

DHCP Relay Operation, ACL Traffic Filtering, and GIADDR Scope Selection
Rate this question

Topics

Troubleshooting IP Addressing and DHCP Services

More questions from this topic