Subject: RE: Relayed lease extension

From: Bernie Volz <[email-masked]>
Date: Fri, 28 Apr 2000 08:50:55 -0400

I think that perhaps the model of the relay agent means you don't have
to have a DHCP "filter" in place.

Since the big box is acting as a router, it would otherwise need to have
code in it to filter off the DHCP packets to prevent them from being
sent to the active client.

But, I likely should let the original requestor answer that question.

- Bernie

From: "Bernard Aboba" <[email-masked]>
To: DHCPv4 discussion list <[email-masked]>
Subject: RE: Relayed lease extension
Date: Fri, 28 Apr 2000 05:39:43 -0700
Message-ID: <[email-masked]>

>The idea behind this is a client/relay agent in one big box,
>asking for leases on behalf of PPP users. In this case, lease extensions
>should not be sent back to the PPP user, but to the relay agent.

In most implementations that I've seen it is the big box that
obtains the leases in the first place. So in effect it is not
acting as a relay agent, but as a DHCP client. In that case,
why forge a DHCPREQUEST on behalf of the PPP user?

---

From: Wim Janssen <[email-masked]>
Date: Fri, 28 Apr 2000 17:03:09 +0000

> why forge a DHCPREQUEST on behalf of the PPP user?

The big box is both a client and relay agent, which means that 
all packets are unicasted between client/relay agent and server.
The PPP user comes in, asks for an IP address, which initiates
DHCP. Once DHCP is finished, the obtained IP address is given to
the PPP user. So, DHCPREQUESTs to extend the lease originate 
on the box, but are 'relayed' to the server.

> to have a DHCP "filter" in place.

Right.

> sent to the active client.

Indeed, it's not a really good thing to filter such packets on a big box.
It's not only about performance, but as a general rule, filtering
on these packets is a BAD thing for a big box, especially when it 
can be prevented in the first place.

And there's my original problem: I don't want to snoop for the DHCPACKs
that are unicasted to the 'real' client, when the lease is being extended. 

Apparently, there may be some misunderstanding on what a server 
should do, when 'giaddr' is filled in. 

There may be servers that just ignore it, and send the DHCPACK back 
to 'ciaddr'. :-( 
Others send it to 'giaddr'. :-)
Maybe others don't allow 'giaddr' to be filled in? :-((

So, what is the server supposed to do?

Wim

---

From: "Bernard Aboba" <[email-masked]>
Date: Fri, 28 Apr 2000 10:57:51 -0700

>to have a DHCP "filter" in place.

The only reason you'd need a DHCP filter is if you didn't want to allow
customers to request more addresses. An example would be where you
charge customers more if they are attaching LANs and therefore may
want extra addresses from your DHCP server.

In this case, the first address is requested
by the big box as a DHCP client and given to
the customer gateway via PPP IPCP. Subsequent
addresses are requested by customer hosts
behind the customer gateway via DHCP.

Here the customer gateway acts as a bridge (not a
relay agent), forwarding received DHCPDISCOVER
broadcasts down the link. The big box acts as both
a DHCP client (for the initial set of addresses) and
a DHCP relay (for subsequent addresses).

In this case there is no need for the big box
to prevent DHCPOFFERs from going back to the client. The big
box just needs to plumb static routes for the addresses
that it is relaying to, so that it can know which
interface to forward packets on.

>sent to the active client.

Since the big box acts as a DHCP client for the initial set of addresses
(which it typically manages out of a pool), DHCPREQUESTS relating to those
addresses always originate at the big box IP address and so are not in
danger of being sent to the active client, since the include the big box
chaddr. For the relayed DHCP traffic, the big box needs to keep track
of customer host chaddrs and interfaces.

The issue of DHCP filtering and relay agent behavior therefore seem
orthogonal to me.

---

From: Wim Janssen <[email-masked]>
Date: Fri, 28 Apr 2000 13:53:54 -0700

> want extra addresses from your DHCP server.

When I said client/relay agent, I was talking about a relay agent
that relays the client packets issued on the box itself. It is not
supposed to relay packets coming from behind a customer gateway.

The PPP user is just using PPP over AAL5 (or over whatever).
He's not allowed to have DHCP clients asking
for multiple addresses (that's may be another issue, if
somebody would want this).

                       BigBox
                    +----------+
            |-------|DHCP      |            
DHCPd ------|       |client/   |             
                    |relay    P|---------PPP
                    |         P|--------PPP
                    |         P|
                    |         d|-----------PPP
                    +----------+

> chaddr. 

Don't know if I understand this correctly.
My point is that DHCPREQUESTs indeed originate on the big box by the client,
are relayed to the server, and sent back to ...(?)

Note that a static route is set for the IP address that was retrieved by 
the DHCP client in the box, pointing to the PPP user. A DHCPACK coming from
the server towards the client, will be forwarded to the PPP user, unless the 
server specifically targets 'giaddr'.

Wim