Cisco Catalyst — C1000, 2960 and 9200

Configuration example for preparing a factory-default Cisco Catalyst switch so that it works with PrivateLAN. Register the switch in PrivateLAN with type Cisco-IOS.

This guide covers the three families PrivateLAN's Cisco driver is built and tested against:

Run show version first and check which of the three you have — a number of commands below differ per family, and each one says so where it matters.

Everything in this guide is entered once, on a factory-default switch, before you add it to PrivateLAN. Individual switch port configuration is not part of it: PrivateLAN programs access ports itself from the device group templates, and anything you configure on a port by hand is overwritten the next time that port is programmed.

Values used in this guide

Replace these with your own before pasting anything. The same values are used consistently in every block below, so you can follow one scenario from start to finish.

The appliance only accepts syslog, RADIUS and time (NTP) traffic on eth0, and only from RFC 1918 addresses (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). A switch with a public management address cannot reach those services, whatever you configure on the switch itself.

1. Console access and host name

Connect to the console port at 9600 8N1, no flow control. On a factory-default switch, answer no to the initial configuration dialog to get a plain CLI.

enable
configure terminal
!
hostname SW-FLOOR1-01
ip domain name example.local
no ip domain lookup
!
line con 0
 exec-timeout 15 0
 logging synchronous
 login local
exit

On a C1000 or 2960 (IOS 15) the two domain commands have a hyphen, which is also how its configuration shows them:

ip domain-name example.local
no ip domain-lookup

A Catalyst 9200 on IOS-XE 17 refuses that older form with % Invalid input detected, and without the domain name it then also refuses the SSH key of section 3.

no ip domain lookup stops the switch from trying to DNS-resolve a mistyped command, which otherwise blocks the console for seconds at a time. logging synchronous keeps log messages from scrambling the line you are typing.

Leave the console speed at its default of 9600. PrivateLAN never uses the console, and a non-default speed only makes recovery harder.

2. Local account, enable secret and privilege level

This is the step that most often goes wrong, so read the warning before you configure it.

username privatelan privilege 1 secret ExampleSwitchPassword
enable secret ExampleEnablePassword

Give the PrivateLAN account privilege level 1, not 15. PrivateLAN's Cisco driver always issues enable immediately after logging in and then waits for the Password: prompt. An account that is already at privilege 15 lands straight back at the # prompt, the password prompt never appears, and the connection fails with a timeout — the switch looks unreachable even though SSH itself is working perfectly. Privilege 1 plus an enable secret is also the better practice: the login account on its own can do nothing.

Fill in the account password as the switch's password in PrivateLAN, and the enable secret in the Enable password field on the same page.

On images that support it, store both as SHA-256 instead of the older MD5 hash:

username privatelan privilege 1 algorithm-type sha256 secret ExampleSwitchPassword
enable algorithm-type sha256 secret ExampleEnablePassword

If the switch rejects algorithm-type, your image is too old for it — use the plain secret form above, which is still a hash and still safe to keep in the configuration.

Finally, remove any account the vendor or a previous owner left behind:

no username admin
no username cisco

3. SSH

PrivateLAN connects over SSH only. Telnet is never used and should stay off.

crypto key generate rsa modulus 2048
!
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line vty 0 15
 login local
 transport input ssh
 transport output none
 exec-timeout 10 0
exit

crypto key generate rsa needs the host name and domain name from step 1 to be set already. Use modulus 2048 as a minimum; 4096 is fine on the 9200 but noticeably slow to generate on a C1000 or 2960.

You do not need to set terminal length or length 0 on the vty lines. The driver sends terminal length 0 and terminal width 0 itself on every session, and also recovers if a --More-- prompt slips through anyway.

4. SSH with a key instead of a password

Optional. PrivateLAN can authenticate to a switch with an SSH private key instead of a password — you paste the private key on the switch's page, and PrivateLAN shows you the matching public key to install here.

Use an RSA key for Cisco. ip ssh pubkey-chain accepts RSA public keys; ECDSA and Ed25519 keys are supported by PrivateLAN but not by this part of the IOS SSH server on most images.

Take the public key PrivateLAN shows after saving, strip the leading ssh-rsa and the trailing comment, and paste what remains — the Base64 block — in lines of at most 254 characters:

ip ssh pubkey-chain
 username privatelan
  key-string
   AAAAB3NzaC1yc2EAAAADAQABAAABgQC7vbqajDhA8mBOEDgHkC0PfP1a1QeR2xF9YbZ
   3n1sGQKz0Xp9Yc2MZgTn4rC1qJ8dLPzR6oVaHt5uW0eKxMbN7iAj2FyDsE3vXlUpQr
   ...
   exit
 exit
exit

Leave the local password configured as well. It stays available on the console, which is the only way back in if the key is ever removed or the account is locked out.

5. Management VLAN and IP address

PrivateLAN reaches the switch on this address, and this is also the address you register as a RADIUS client.

vlan 10
 name MGMT
exit
!
interface Vlan10
 description Management
 ip address 192.168.10.21 255.255.255.0
 no shutdown
exit
!
ip default-gateway 192.168.10.1

ip default-gateway only works while ip routing is disabled. The moment you enable routing (see section 13) the switch ignores it and you need a real default route instead: ip route 0.0.0.0 0.0.0.0 192.168.10.1. A switch that becomes unreachable right after routing was enabled is almost always this.

Whichever uplink carries the management VLAN has to allow it:

interface GigabitEthernet1/0/48
 description UPLINK
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 lldp transmit
 lldp receive
exit

lldp transmit and lldp receive are the default on every port; they are written out here because a port that was a device port before keeps the no lldp transmit of its template. On a link between two switches LLDP has to run in both directions: Reports > Interconnects draws the links between your switches from the LLDP neighbours of the ports tagged [TRUNK].

PrivateLAN never removes the management VLAN from a switch. Programming VLANs removes the VLANs on the switch that its switch group does not list, but it keeps VLAN 1, the VLAN the switch's own management address is on, and every VLAN marked as Management VLAN in PrivateLAN. Add the management VLAN in PrivateLAN and mark it, so it is also kept on a switch whose configuration PrivateLAN has not read yet. Assign it to the switch group only if PrivateLAN should program it like any other VLAN, for example add it to new [TRUNK] ports.

More than 1005 VLANs: the extended range

Cisco splits VLAN ids into two ranges, and the second one is not usable until you enable it:

A factory-default switch is in VTP server mode, version 1, and in VTP versions 1 and 2 a server or client refuses to create an extended-range VLAN at all. So on a switch you have not touched, vlan 2000 fails. Switch VTP to transparent mode before you let PrivateLAN program anything above 1005:

vtp mode transparent

This one fails silently through PrivateLAN. The appliance programs a VLAN by issuing vlan <id>, and the driver cannot tell a rejection from a normal prompt. On a switch still in VTP server mode, every VLAN above 1005 is refused while the programming run reports success — the VLAN exists in PrivateLAN and does not exist on the switch. Inspection > Compliance is where that shows up.

Transparent mode is the right choice here regardless of how many VLANs you have. PrivateLAN programs each switch in a switch group individually over SSH, so VTP propagation is redundant at best; at worst a VTP server elsewhere in the network overwrites the VLAN database PrivateLAN just wrote. VTP version 3 also allows extended-range VLANs in server mode, but it solves a problem PrivateLAN does not have.

After enabling transparent mode, save. Extended-range VLANs live in the running configuration rather than in vlan.dat, so without a write memory they are gone after a reload:

end
write memory

Enabling the range does not raise the platform limit, which is a separate number and often lower than 4094:

The C9200L is the cheaper and far more commonly ordered half of the 9200 range, and it caps at 1024 VLAN ids — no VTP setting changes that. If you need more than a thousand VLANs, the model matters more than the configuration does.

The universal check, on any model in this guide, is show vtp status. It reports both the VTP mode and the line "Maximum VLANs supported locally", which is the real ceiling for that switch and image.

6. Protecting passwords in the running configuration

Three separate mechanisms, and only the last one really protects anything:

service password-encryption

This turns plaintext passwords into type 7 strings. Type 7 is obfuscation, not encryption — it is trivially reversible and should never be treated as a secret. Enable it anyway so that nothing sits in the clear, but do not rely on it.

enable secret and username ... secret (section 2) store a one-way hash and are genuinely safe. Use secret, never password, for anything that authenticates a person or a system.

The RADIUS shared secret is the interesting case, because it has to remain readable to the switch and would otherwise be type 7. On images that support AES password encryption, store it as type 6:

key config-key password-encrypt ExampleMasterKey
password encryption aes

The master key is not stored in the configuration and cannot be recovered. If you lose it, every type 6 secret on the switch has to be entered again. Record it wherever you keep the rest of your infrastructure credentials before you continue.

Type 6 is available on IOS-XE and on later 15.x images. If password encryption aes is rejected, leave service password-encryption on and accept that the RADIUS key is type 7 — the shared secret is only worth as much as the management network it can be read from, which is the argument for locking down section 15 properly.

When a switch configuration leaves the appliance — for example through a QR Support report — PrivateLAN strips radius-server key, snmp-server community and key 7 lines before it is encoded, so those never travel with the report regardless of how they are stored here.

7. Time and time zone

Log timestamps only line up with the appliance's own if both agree on the time.

clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
!
ntp server 192.168.10.5
!
service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone

Point the switch at the appliance's own address. The PrivateLAN appliance passes on the time it gets from the time server under System > Networking (an NTP relay), so the switch needs neither internet nor DNS, and its log times line up with the appliance's. The appliance answers only on eth0, only to RFC 1918 addresses, and limits how often one address may ask; a switch asks far less often than that. An appliance that has no time itself says so, and the switch waits instead of taking a wrong time.

Give the switch an address, never a name: section 1 turns DNS lookups off, and a switch that cannot look a name up keeps the name in its configuration and never syncs. Another time server in your own network (the router, a firewall, a domain controller) works too, by its IP address. A pool name such as nl.pool.ntp.org changes address all the time, so do not copy one of its addresses into a switch.

PrivateLAN's Inspection > Compliance page checks this line and accepts either the appliance's own addresses or the time server the appliance is configured with. It compares them as written: a switch that has another server's address while System > Networking has its name shows as different.

Only if you have to use a name, the switch needs a name server and the DNS lookups that section 1 turns off:

ip name-server 192.168.10.1
ip domain lookup

On a C1000 or 2960 (IOS 15) the second line is ip domain-lookup.

8. Sending syslog to the appliance

logging host 192.168.10.5
logging trap informational
logging source-interface Vlan10
logging buffered 32768 informational
no logging console

logging source-interface matters: without it the switch may send from whichever interface the route happens to pick, and the appliance's syslog view then shows an address you do not recognise. no logging console stops log messages from flooding a console session — they are still kept in the buffer and still sent to the appliance.

The appliance rate-limits syslog per sending device: more than roughly 200 UDP messages per second from one source are dropped, so a switch in a logging loop cannot drown out the rest of the fleet. If a switch shows up under the dashboard's syslog flood protection tile, lower logging trap to warnings rather than raising anything.

With the SOC license option, syslog also makes the port alarms of the SOC live view faster. When the switch logs a port event — %LINK-3-UPDOWN, %LINEPROTO-5-UPDOWN, %PM-4-ERR_DISABLE or %PORT_SECURITY-2-PSECURE_VIOLATION — the appliance reads the switch again straight away, so an uplink that goes down or a port the switch shuts down itself shows up as an alarm within about two minutes instead of at the next five-minute poll. The log line itself never raises an alarm; the fresh reading of the switch does. logging trap warnings stops the %LINEPROTO-5-UPDOWN messages, but %LINK-3-UPDOWN, %PM-4-ERR_DISABLE and the port-security messages are at warning level or more severe and are still sent, so the fast alarms keep working at that level.

Inspection > Compliance reports this line as Logging host, and only counts it as a match when it points at this appliance.

9. RADIUS and 802.1x

This is what makes MAB, PEAP and EAP-TLS devices work. The switch has to be registered as a RADIUS client in PrivateLAN as well, under 802.1x / RADIUS, with the same management IP address and the same shared secret.

Enable aaa new-model and its login lines in one go. aaa new-model immediately changes how the vty and console lines authenticate. Entering it on its own, without the two aaa authentication lines below, locks you out at the next login. Paste the whole block.

aaa new-model
aaa authentication login default local
aaa authentication enable default enable
!
radius server PRIVATELAN
 address ipv4 192.168.10.5 auth-port 1812 acct-port 1813
 timeout 5
 retransmit 3
 key ExampleSharedSecret
exit
!
aaa group server radius PRIVATELAN-GROUP
 server name PRIVATELAN
exit
!
aaa authentication dot1x default group PRIVATELAN-GROUP
aaa authorization network default group PRIVATELAN-GROUP
aaa accounting dot1x default start-stop group PRIVATELAN-GROUP
!
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send authentication
radius-server vsa send accounting
!
ip radius source-interface Vlan10
!
dot1x system-auth-control

aaa authorization network default group PRIVATELAN-GROUP is not optional. PrivateLAN returns the device's VLAN in the RADIUS reply (Tunnel-Private-Group-ID), and without network authorization the switch discards it — the device authenticates successfully and then lands in the wrong VLAN.

On older 2960 images that do not have the radius server block, use the single-line form instead:

radius-server host 192.168.10.5 auth-port 1812 acct-port 1813 key ExampleSharedSecret
radius-server timeout 5
radius-server retransmit 3

MAC address format for MAB

PrivateLAN stores a MAB device's RADIUS username and password as the MAC address in twelve lowercase hexadecimal characters with no separators — 00155d5a6500. The RADIUS server matches that string exactly, so a switch that sends 0015.5D5A.6500 or 00-15-5D-5A-65-00 is rejected even though the device is registered correctly.

Cisco's default is twelve characters without separators, but the case differs per image. Check what actually arrives under 802.1x / RADIUS on the appliance, where recent authentication events show the user name the switch sent. If it arrives in upper case, force it:

mab request format attribute 1 groupsize 12 separator - lowercase

The exact keywords accepted by mab request format attribute 1 vary per image — use ? on your switch to see which ones it offers.

Port configuration is pushed by PrivateLAN

You do not configure dot1x, mab or switchport port-security on individual ports. PrivateLAN writes those when it programs a device onto a port, from the templates under Devices > Device groups. A MAB port ends up looking like this:

interface GigabitEthernet1/0/12
 description PRINTER-01
 switchport access vlan 20
 switchport mode access
 switchport nonegotiate
 authentication port-control auto
 dot1x pae authenticator
 authentication event fail action next-method
 authentication host-mode single-host
 mab
 no cdp enable
 no keepalive
 no lldp transmit
 spanning-tree bpduguard enable
 spanning-tree portfast

There is deliberately no fallback VLAN, such as authentication event no-response action authorize vlan. When such a line points at the device's own VLAN, a device whose authentication fails still ends up in that VLAN. Without it, the port stays closed until authentication succeeds. If you do want one, point it at a separate, empty VLAN with access to nothing.

Catalyst 9200 only. Those templates use the classic authentication ... syntax. IOS-XE also has the newer IBNS 2.0 access-session syntax, and a switch that has been permanently converted with authentication convert-to new-style rejects every one of the lines above. The programming result lists them under The switch refused, and the port never authenticates anything. If your switch has been converted, either rebuild the templates in the new syntax or start from a switch that has not been converted. authentication display legacy restores the legacy display mode on a switch that has not yet been permanently converted.

After programming a device, Inspection > Compliance shows what PrivateLAN intended against what the switch actually has. The programming result also lists every command the switch refused, with the switch's own message, under The switch refused. Compliance remains the check for what that list cannot show: a setting the switch accepted but stored differently, or a refusal worded in a way PrivateLAN does not recognise.

One device or several per port: the host mode

The host mode decides how many devices may use one port, and whether each of them has to authenticate itself. It is part of the device group's templates under Devices > Device groups, so it applies to every port that group programs.

Access points. When an access point puts the traffic of its wireless devices on the port itself, all their MAC addresses appear on that port. With single-host each of them is a violation, and with multi-auth every phone and laptop has to be registered in PrivateLAN itself. Cisco uses multi-host for this: the access point authenticates, after which the devices behind it may use the port. The switch then no longer checks those devices, so let the access point do that itself (WPA2/WPA3-Enterprise) and give it a device group of its own. In that group's PEAP or EAP-TLS template, set authentication host-mode multi-host and take out switchport port-security, which otherwise allows only one MAC address on the port.

The MAB template writes authentication host-mode single-host explicitly. The PEAP and EAP-TLS templates leave it out: single-host is the switch's default, and the default does not appear in the running configuration.

For a port that must carry several devices, change two lines in the device group's template, not one. The PEAP and EAP-TLS templates also enable switchport port-security, whose default maximum is one MAC address, so with multi-auth alone the second device is still blocked by port security:

authentication host-mode multi-auth
switchport port-security maximum #max-mac#

#max-mac# is filled in per port with the number of MAC addresses of the device and its virtual devices. Inspection > Compliance compares the host mode with the template, so a port that still has the old mode shows up there.

10. The NOIPV6 access list

PrivateLAN's shipped EAP-TLS and PEAP device templates apply an IPv6 access list named NOIPV6 to the port. That list is not created by PrivateLAN — it has to exist on the switch, or the line is rejected and the port is left without the protection it was meant to have.

ipv6 access-list NOIPV6
 deny ipv6 any any
exit

The explicit deny ipv6 any any also overrides IOS's implicit neighbour-discovery permits, which is the intent: the list exists to keep IPv6 off a port entirely.

On Catalyst 2960 platforms an IPv6 access list needs a template change and a reboot before it can be applied at all: sdm prefer dual-ipv4-and-ipv6 default, then reload. On LAN Lite images IPv6 access lists are not available at all. If your switch cannot support this, remove the ipv6 traffic-filter NOIPV6 in line from the EAP-TLS and PEAP templates under Devices > Device groups rather than leaving a line in the template that silently fails on every port.

11. Spanning tree

spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree loopguard default
!
errdisable recovery cause bpduguard
errdisable recovery cause link-flap
errdisable recovery interval 300

Set the root bridge deliberately, on the switch that should be root — not on all of them:

spanning-tree vlan 1-4094 priority 24576

PrivateLAN's port templates apply spanning-tree bpduguard enable per port. When a BPDU arrives on a device port, because someone connects a switch to it or a cable makes a loop, the switch shuts down only that port (err-disabled), and PrivateLAN reports it. With errdisable recovery cause bpduguard above, the port comes back by itself after five minutes, and goes down again for as long as the switch behind it stays connected. You may add spanning-tree portfast bpduguard default globally: it does the same for every PortFast port, including ports PrivateLAN does not program. Do not put spanning-tree bpdufilter enable on a port. According to Cisco that is the same as turning spanning tree off on the port, and BPDU guard then no longer acts there either.

12. LLDP and CDP

lldp run
lldp timer 30
lldp holdtime 120

lldp run is required. PrivateLAN reads show lldp neighbors per interface to fill the LLDP neighbour column on the interface overview, and without it globally enabled that column stays empty on every port.

The port templates set no lldp transmit on device ports, so the switch still learns what is connected but does not advertise itself to end devices. Uplinks and trunks keep transmitting normally.

CDP can stay enabled for uplinks between Cisco devices; the templates disable it per device port with no cdp enable. If you have no Cisco neighbours at all, no cdp run is one fewer thing advertising the switch's identity.

13. Layer 3 — routing, SVIs, VRRP and HSRP

PrivateLAN's VLAN routing mode is an appliance-wide setting under VLANs, with three options:

PrivateLAN writes all of that itself when you program a VLAN — including ip routing, no ip redirects, no ip unreachables and no proxy-arp on each routed SVI. What you have to make sure of here is only that the platform can do it:

Catalyst 9000 series: Network Essentials or Network Advantage

Every Catalyst 9000 switch ships with one of two perpetual licence tiers, and the split runs straight through the middle of what PrivateLAN offers. This is not specific to the 9200 — the same two-tier model applies across the family (9200, 9300, 9400, 9500, 9600), and the -E part numbers are Network Essentials while the -A part numbers are Network Advantage. On the 9200 both the modular C9200 and the fixed C9200L are sold in each tier.

On Network Essentials, choose VRRP — HSRP is not available. PrivateLAN's routing mode is a single appliance-wide setting, not a per-switch one, so one Network Essentials switch anywhere in the fleet decides it for everything. Selecting HSRP in that situation does not produce a clear error: the switch rejects the standby commands, and the driver cannot tell a rejection from a normal prompt, so the VLAN is programmed with an SVI and no gateway. VRRP is available on both tiers, is vendor-neutral, and is what PrivateLAN defaults to.

The VRRP and HSRP rows above hold for the whole Catalyst 9000 family, which is the part that decides your PrivateLAN routing mode. What Network Advantage adds on top grows as you go up the family: a 9300, for example, also gets BGP, PIM-BIDIR, MPLS and stateful switchover from it, none of which the 9200 supports in either tier — the 9200 does not run BGP at all, whatever the licence says.

Check which tier a switch has with show license summary on IOS-XE 17.x, or show version on 16.x. The table above follows Table 10, "Network Essentials and Advantage Package Features", of Cisco's own Catalyst 9200 Series data sheet, cross-checked against the equivalent table in the 9300 data sheet; second-hand summaries of these circulate widely and several of them are wrong, so check the data sheet for your own model rather than a blog if you need to be certain for a purchase.

Do not configure fhrp version vrrp v3 on a 9200 you manage with PrivateLAN. VRRPv3 is not enabled by default, and PrivateLAN programs the classic VRRPv2 interface syntax (vrrp <group> ip <address>). The two are mutually exclusive: once VRRPv3 is enabled, VRRPv2 is unavailable and every VRRP line PrivateLAN writes is rejected — silently, for the same reason as above. Leave the default alone and VRRP works out of the box.

On a 2960-X that needs to route:

sdm prefer lanbase-routing
end
write memory
reload

After the reload:

configure terminal
 ip routing
 ip route 0.0.0.0 0.0.0.0 192.168.10.1
end

On a layer 2 only switch, leave ip routing off, keep ip default-gateway, set the appliance's routing mode to SVI, and let your core switch or router do the inter-VLAN routing. The management SVI from section 5 works on every family — a management IP address is not routing.

14. Third-party transceivers

Cisco switches disable an SFP they do not recognise. If you use third-party or coloured optics:

service unsupported-transceiver
no errdisable detect cause gbic-invalid

service unsupported-transceiver is a hidden command: it does not appear in ? and the switch answers with a warranty warning when you enter it. It is accepted anyway, except on the Catalyst 1000: it does not have the command and answers % Invalid input detected. There, enter only no errdisable detect cause gbic-invalid. Save the configuration afterwards, and on some platforms the transceiver only comes up after the port is bounced or the switch is reloaded.

end
write memory

15. Turning off the web interface and unused services

PrivateLAN manages the switch entirely over SSH. Nothing else needs to be reachable.

no ip http server
no ip http secure-server
!
no ip bootp server
no service pad
no service config
no ip source-route

The Catalyst 1000 has no bootp server: it answers no ip bootp server with % Invalid input detected, so leave that line out there.

On the Catalyst 2960, also disable Smart Install. It listens on TCP 4786 by default, needs no authentication, and is the single most commonly abused service on this hardware:

no vstack

Verify with show vstack config — the client should be disabled. The command does not exist on the Catalyst 1000 and the Catalyst 9200, which have no Smart Install client.

If you use SNMP for anything else in your network, give it a v3 user rather than a community string. PrivateLAN itself does not use SNMP and needs nothing configured here.

16. Save and register in PrivateLAN

end
write memory

Then, in the appliance:

• Switches > Add — host name, management IP address 192.168.10.21, SSH port 22, type Cisco-IOS, user name privatelan, the switch password, and the enable password. Choose the switch group and enter the interface ranges.
• 802.1x / RADIUS > Clients — add the same switch with IP address 192.168.10.21, its netmask, and the shared secret ExampleSharedSecret.
• Inspection > Compliance — run it once the first poll has completed, and confirm the logging host and time server rows both come back as a match.

DHCP snooping (optional)

PrivateLAN reads the switch's DHCP snooping table to find out the address of any device you registered with a Dynamic address instead of a fixed one, and to find the address of wireless clients behind an access point. Without snooping those devices simply report that no address is known — nothing else stops working, so enable it only if you use that.

ip dhcp snooping
ip dhcp snooping vlan 10,20,30
no ip dhcp snooping information option
!
interface GigabitEthernet1/0/48
 description Uplink
 ip dhcp snooping trust

no ip dhcp snooping information option is in the block on purpose: option 82 is added by default, and many DHCP servers drop a request carrying it that did not come from a relay.

Two things decide whether this works at all:

• Every port towards your DHCP server must be trusted. That is the uplink, and any port towards another switch on the way to the server. A port left untrusted drops the server's replies and the devices behind it stop getting addresses — so set the trusted ports in the same change that enables snooping, not afterwards.
• Snooping must be enabled on the VLANs the devices are in. A VLAN it is not enabled on produces no bindings, so those devices keep reporting that no address is known.

Check the result on the switch itself:

show ip dhcp snooping
show ip dhcp snooping binding

The binding table does not survive a restart of the switch unless you tell the switch to save it. Without that, PrivateLAN reports that no address is known for a dynamic device until each lease is renewed:

ip dhcp snooping database flash:dhcp-snooping.db
ip dhcp snooping database write-delay 60

Complete example configuration

Everything above in one block, for a Catalyst 9200 acting as a layer 2 access switch. Adjust the sections marked in the guide for a C1000 or 2960, and change every value from the table at the top.

configure terminal
!
hostname SW-FLOOR1-01
ip domain name example.local
no ip domain lookup
!
username privatelan privilege 1 secret ExampleSwitchPassword
enable secret ExampleEnablePassword
service password-encryption
!
crypto key generate rsa modulus 2048
ip ssh version 2
ip ssh time-out 60
ip ssh authentication-retries 3
!
line con 0
 exec-timeout 15 0
 logging synchronous
 login local
exit
line vty 0 15
 login local
 transport input ssh
 transport output none
 exec-timeout 10 0
exit
!
vtp mode transparent
!
vlan 10
 name MGMT
exit
vlan 20
 name DATA
exit
!
interface Vlan10
 description Management
 ip address 192.168.10.21 255.255.255.0
 no shutdown
exit
ip default-gateway 192.168.10.1
!
interface GigabitEthernet1/0/48
 description UPLINK
 switchport mode trunk
 switchport trunk allowed vlan 10,20
 lldp transmit
 lldp receive
exit
!
clock timezone CET 1 0
clock summer-time CEST recurring last Sun Mar 2:00 last Sun Oct 3:00
ntp server 192.168.10.5
service timestamps log datetime msec localtime show-timezone
service timestamps debug datetime msec localtime show-timezone
!
logging host 192.168.10.5
logging trap informational
logging source-interface Vlan10
logging buffered 32768 informational
no logging console
!
aaa new-model
aaa authentication login default local
aaa authentication enable default enable
!
radius server PRIVATELAN
 address ipv4 192.168.10.5 auth-port 1812 acct-port 1813
 timeout 5
 retransmit 3
 key ExampleSharedSecret
exit
aaa group server radius PRIVATELAN-GROUP
 server name PRIVATELAN
exit
aaa authentication dot1x default group PRIVATELAN-GROUP
aaa authorization network default group PRIVATELAN-GROUP
aaa accounting dot1x default start-stop group PRIVATELAN-GROUP
radius-server attribute 6 on-for-login-auth
radius-server attribute 8 include-in-access-req
radius-server attribute 25 access-request include
radius-server vsa send authentication
radius-server vsa send accounting
ip radius source-interface Vlan10
dot1x system-auth-control
!
ipv6 access-list NOIPV6
 deny ipv6 any any
exit
!
spanning-tree mode rapid-pvst
spanning-tree extend system-id
spanning-tree loopguard default
errdisable recovery cause bpduguard
errdisable recovery cause link-flap
errdisable recovery interval 300
!
lldp run
lldp timer 30
lldp holdtime 120
!
service unsupported-transceiver
no errdisable detect cause gbic-invalid
!
no ip http server
no ip http secure-server
no ip bootp server
no service pad
no service config
no ip source-route
!
end
write memory

Troubleshooting

Related documentation

• Switch Management — registering the switch, groups, interface tags and stacks
• 802.1x / RADIUS — RADIUS clients and certificates
• VLANs — creating VLANs and choosing the routing mode
• Device Deployment — how ports are programmed from device group templates