Examkin

Question

Difficulty: HardDHCP Architecture and Relay Services

An enterprise network administrator configures a Layer 3 access switch as a DHCP relay agent for VLAN 55 (10.55.0.0/2410.55.0.0/24), designating a remote server at 192.168.1.100192.168.1.100 via an `ip helper-address` command on SVI 55. Downstream Layer 2 edge switches append DHCP Option 82 (Relay Agent Information) metadata to client requests before forwarding them to the Layer 3 switch. However, client hosts on VLAN 55 fail to obtain IP addresses, and packet drops are logged on the Layer 3 switch for incoming DHCPDISCOVER packets containing Option 82 with a gateway IP address (`giaddr`) of 0.0.0.00.0.0.0. Which configuration change on the Layer 3 switch will resolve this issue?

  1. Enable DHCP Option 82 trust on the relay agent to allow untrusted ingress packets containing Option 82 dataAnswer
  2. B
    Move the `ip helper-address` configuration from SVI 55 to the routed uplink interface connected to the DHCP server
  3. C
    Reconfigure the helper address mechanism to encapsulate forwarded client requests in TCP port 67 instead of UDP port 67
  4. D
    Configure a static route on the switch to forward VLAN 55 Layer 2 broadcast traffic directly across subnets to the DHCP server

Answer

The correct action is to enable DHCP Option 82 trust on the Layer 3 relay switch so it accepts and processes incoming client requests pre-tagged with Option 82 information.
When downstream Layer 2 switches append Option 82 information to a client DHCP request before it reaches the Layer 3 relay agent, the request arrives on an untrusted port with a gateway IP address (`giaddr`) of 0.0.0.00.0.0.0. By default security design, many relay agents discard such packets to prevent Option 82 injection attacks. Enabling Option 82 trust allows the Layer 3 switch to accept these packets, insert its SVI IP into `giaddr`, and forward the unicast packet to the DHCP server.

Step-by-Step Solution

1
Analyze the reported symptom and packet behavior
Client broadcast packets contain DHCP Option 82 inserted by downstream Layer 2 switches, but arrive at the Layer 3 relay agent with `giaddr = 0.0.0.0`.
The Layer 2 edge switch appends Option 82 metadata without modifying IP header fields such as `giaddr`.
2
Identify default security rules for DHCP relay agents
Standard DHCP relay security policy dictates dropping packets containing Option 82 if received on untrusted interfaces when `giaddr` is set to 0.0.0.00.0.0.0.
This behavior prevents Option 82 spoofing attacks from untrusted edge ports.
3
Determine the necessary configuration fix
Configuring `ip dhcp relay information trust-all` or enabling interface-level Option 82 trust instructs the relay switch to process pre-existing Option 82 fields and forward the unicast request to 192.168.1.100192.168.1.100.
Explicitly trusting edge Option 82 insertion enables valid cross-VLAN relay functionality in tiered switch architectures.

Key Concept

DHCP Option 82 Untrusted Ingress Processing & Relay Agent Trust Policies
Rate this question

Topics

DHCP Architecture and Relay Services

More questions from this topic