DHCP issue with IP phone

[Christoph24]

Hi, we are facing a problem with our Yealink IP phones when connected to a 6450 switch:
with LLDP configured for a separate voice VLAN, the phone doesn't get an IP via DHCP ("obtaining IP Address" forever). It works without LLDP in the default VLAN.

Config:

vlan 104 enable name "VoIP-Clients"
vlan 104 mobile-tag enable
vlan port mobile 1/12
vlan 104 ip 10.20.24.0 255.255.252.0

qos phones priority 7
policy condition from_voip_vlan source vlan 104
policy action set_dscp dscp 46
policy rule prio_voip condition from_voip_vlan action set_dscp

ip helper per-vlan only
ip helper address 10.1.5.180 vlan 104

lldp network-policy 1 application voice vlan 104 l2-priority 5 dscp 46
lldp chassis notification enable
lldp 1 tlv dot1 vlan-name enable port-vlan enable
lldp 1/12 med network-policy 1


Status:

show vlan port
1 1/12 default forwarding
104 1/12 mobile forwarding

So the phone seems to be in the voip VLAN.
I can see the DHCP Discover from the phone in Wireshark (PC behind phone, port 1/12), but no response.

But shouldn't I see some helper stats then?

show ip helper stats

Global Statistics :
Reception From Client :
Total Count = 0, Delta = 0,
Forw Delay Violation :
Total Count = 0, Delta = 0,
Max Hops Violation :
Total Count = 0, Delta = 0,
Agent Info Violation :
Total Count = 0, Delta = 0,
Invalid Gateway IP :
Total Count = 0, Delta = 0,
Invalid Agent Info From Server :
Total Count = 0, Delta = 0,
Server Specific Statistics :
Server 10.1.5.180
Tx Server :
Total Count = 0, Delta = 0

Our switch firmware version:
Description: Alcatel-Lucent OS6450-48 6.6.4.221.R01 Service Release, December 19, 2013.

Any thoughts?

[silvio]

Have your switch ip interfaces in both the vlans (phone-vlan and dhcp-server-vlan)?
with "show mac-address-table 1/12" you can check that the phones mac is realy in vlan 104.
Are you sure that the dhcp discover packets from the phone are taged within vlan 104? It is possible to check if the phone "knows" about the via lldp learnt vlan (maybe in the phone menue)?
regards
silvio

[Christoph24]

Hi Silvio,
I guess I joined your workshop for Alcatel Switches in Nov. 2016, do you remember me ? (Christoph, the developer ) Finally we started with VoIP...

The Mac-Table:

Vlan Mac Address Type Protocol Operation Interface
------+-------------------+--------------+-----------+------------+-----------
1 34:17:eb:9d:fc:28 learned 806 bridging 1/12
504 00:15:65:b6:13:05 learned 800 bridging 1/12

The DHCP server (MS Server 2016) is in the standard VLAN 1 and has a scope for VLAN 104. Our 6450s are connected to a double 6900 core, which has IP interfaces in all VLANs. Or do the 6450s need these interfaces, too?
The phone menue is very restricted by the VoIP provider...

Can I check this if I do port mirroring for the phone?
The firmware is new enough, because I saw several DHCP issues fixed by newer versions?

[Christoph24]

Now I managed to get my Intel NIC to not strip the VLAN tags. I can see now that the DHCP Discover packets from the phone are tagged with VLAN 104...

[silvio]

Hi Christoph,
nice to know you
But now I think I haven't explained it correctly (or not enough careful) to you during the workshop..... Your Router=L3-Device is the switch with the ip interfaces in all your vlans. So in your case this is the 6900. All other switches (f.e. your 6450) are "only" L2-switches (with ip-interface only for management etc.).
Ip-Helper needs to configure at the L3-device (6900): the dhcp-discover packets (orign broadcast - so flooded within the vlan 105) has to be routed (=L3) to the dhcp-server.


some improvements for your config:

vlan 104 ip 10.20.24.0 255.255.252.0: this vlan rule isn't necessary if you use lldp. The phones learns by lldp the correct vlan by itself. But if you have static configured phones within this ip-range than you can use this command.
please use "qos no phones" (your qos phone-config is not necessary because this works only for alcatel phones).

regards
Silvio

[Christoph24]

Hi Silvio,
thank you, that helped me a lot, but there is still something do do:
The IP helper is running now on the core, and I can see in the ip helper statistics: From Vlan 104 to Server 10.1.5.180 (the DHCP)
Tx Server : Total Count = 17166, Delta = 9433, InvAgentInfoFromServer: Total Count = 0

So this looks good. But the phone still doesn't get an IP.

I configured a port monitoring on the 6450 switch where the DHCP server is connected, and this is what I see in Wireshark:
871 3.099690000 10.1.20.10 10.1.5.180 BOOTP 64 [Malformed Packet] (VLAN ID 1)
873 3.099690000 10.1.5.180 10.20.24.1 BOOTP 64 Boot Reply[Malformed Packet] (VLAN ID 1)

Unfortunately, the 6450 monitoring truncates the packets to 64 bits so there is no more information for the packets, e.g. the type and the giaddr of the BOOTP packet.
I'm not quite sure if these packets really belong to the phone's request, but the IP 10.20.24.1 is the VoIP VLAN's gateway address, and there is only my phone in the VoIP VLAN...
But is this expected: 10.1.20.10 is the gateway address of VLAN 1? And both packets tagged with VLAN 1?
I could configure a port mirroring on the DHCP switch, and try to capture the full traffic...

[silvio]

Hi Christoph,
I wonder about the answer from DHCP server in packet 873.....
I assume your ip interface in vlan 1 at the core is 10.1.20.10/16 (is it correct?). Also I assume the packet 871 is the discover and 873 the offer?
In my knowledge the destination of the dhcp offer has to sent in your case to the vlan-1 interface of Core (10.1.20.10). But the destination is 10.20.24.1 (other than the source of the discover). Is the 10.20.24.1 the vlan-104-address of the core or of the 6450? Have you deactivated ip helper at all other switches beside core?
Did you see in the offer the client mac, client ip and especially the relay agent addresses?
For better troubleshooting you can use mirror port (instead of monitor) - there is no limit of packet size.
But also with port monitoring you can increase the filesize with the keyword "filesize" (with 10 f.e to 640k).
Hope you next answer will be a successful one
regards
Silvio

[Christoph24]

Hi Silvio,
I had some other work to do, now back to the dhcp problem...
I set up port mirroring on the switch where the dhcp server is connected to. This is what I see:
The dhcp offer is sent to the vlan-104 interface (10.20.24.1) of the Core, which is correct from all that I find on the internet. It seems also correct that this packet has vlan tag 1. I can see now the client macs and relay agent address, and everything seems to be ok...
But then, the core sends this packet to our internet gateway (because of core's static-route 0.0.0.0/0 gateway ...?), and not to the access switch where the ip phone is connected.
I see two fixes for our firmware (7.3.3.384.R01 GA) related to dhcp:

PR 190182 Build: 7.3.3.396.R01 Summary: DHCP relay is not working in OS6900 Explanation: Changes done to check if next hop is configured for client vlan instead of vlan id

PR 195626 Build: 7.3.3.484.R01 Summary: DHCP-Relay issue on OS6900. Explanation: Changing DHCP offer packet as Broadcast(L2).

Would it be worth a try with a newer firmware, and how do I get a newer 7.3 release?

Many thanks, Christoph

[silvio]

Hi Christoph,
not sure if the update solved your problem. But your used release is "very" old. So I think you should scedule a maintanance window to make an update to the newest R8-release. If the issue is still there after the update we can do more troubleshooting.....
You should get the actual release from the supplier of your hardware.
regards
Silvio

[Christoph24]

Hi Silvio,
updating to version 8.4.1 R03 has solved the problem! Now the DHCP Relay works as expected...
Many thanks for your help!

Regards,
Christoph