DHCP Relay and Option-82 in Cisco SD-Access

300-420 By islever Editorial Last updated

Describe SD-Access Architecture (underlay, overlay, control and data plane, automation, wireless, and security) Describe cloud-based services model in private, public, and hybrid deployments (Saas, PaaS, IaaS)

Short answer

D DHCP Option-82 must be enabled to provide the unique circuit identifier necessary to map the DHCP request to the specific fabric edge node originating it, overcoming the ambiguity of the shared anycast gateway IP.

Question

Which consideration must be taken into account when using the DHCP relay feature in a Cisco SD-Access Architecture?
  1. DHCP-relay must be enabled on fabric edge nodes to provide the correct mapping of DHCP scope to the local anycast gateway.
  2. A DHCP server must be enabled on the border nodes to allow subnets to span multiple fabric edges.
  3. DHCP servers must support Cisco SD-Access extensions to correctly assign IPs to endpoints in an SD-Access fabric with anycast gateway.
  4. DHCP Option-82 must be enabled to map the circuit IP option to the access fabric node where the DHCP discover originated. Correct Answer

Key Takeaways

The primary trap is assuming the anycast gateway IP alone suffices for DHCP scoping; Option-82 is required to disambiguate the origin point.

In Cisco SD-Access, DHCP Option-82 is essential for mapping requests to the correct fabric edge node due to the use of anycast gateways. Correct answer: D.

Common mistake: Candidates often choose A, believing the relay agent automatically handles scope mapping via the anycast gateway. However, without Option-82, the server cannot distinguish between edge nodes sharing the same gateway IP, leading to potential misassignment.

Expert Analysis

The core challenge in Cisco SD-Access DHCP operations stems from the use of Anycast Gateways. In an SD-Access fabric, every Fabric Edge node shares the same IP and MAC address for default gateways. When a client sends a DHCP Discover, the local Edge node relays it to the DHCP server. Crucially, the giaddr (Gateway IP Address) field in the DHCP relay agent options is set to this shared Anycast IP.

Because the giaddr is identical across all edge nodes, a traditional DHCP server cannot distinguish which specific physical or logical segment the request originated from based on the gateway IP alone. If the server simply assigned an IP from the scope associated with that Anycast IP, it might assign an address from a different subnet or fail to map the client correctly to its intended Virtual Network (VN).

To solve this, DHCP Option-82 (Relay Agent Information) is mandatory. Option-82 allows the relay agent to insert sub-options that uniquely identify the circuit. In SD-Access, these sub-options typically include the RLOC (Routing Locator) or other identifiers that pinpoint the exact Fabric Edge node where the client attached. This enables the DHCP server (or an integrated policy engine like DNA Center) to map the request to the correct scope and apply the appropriate policies for that specific endpoint location.

Let's evaluate the options: Option A suggests the relay maps the scope to the anycast gateway. While the relay is enabled on Edge nodes, the mapping logic* relies on distinguishing the source beyond just the anycast IP. The statement implies the anycast gateway itself provides the mapping, which is incorrect; the anycast IP creates the ambiguity that Option-82 resolves.

  • Option B is incorrect because DHCP servers are not required on border nodes, and subnets do not span multiple fabric edges in a way that requires local servers for basic function.
  • Option C claims DHCP servers must support "Cisco SD-Access extensions." While true that the server needs to understand the Option-82 data, this is vague compared to the specific mechanism required.
  • Option D correctly identifies that Option-82 must be enabled to map the circuit information back to the originating access fabric node. Without Option-82, the unique identifier needed to resolve the Anycast Gateway ambiguity is missing. Community comments heavily favor D, citing Cisco documentation that highlights Option-82 as critical for DHCP in the fabric to handle the Anycast scenario.

Official Reference

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/tech_notes/sda_dhcp/b_cisco_sda_dhcp.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When analyzing SD-Access networking questions, always check if Anycast Gateways are involved. If they are, look for solutions involving identification mechanisms like Option-82, RLOCs, or VTEP addresses that can distinguish between identical gateway IPs. Generic routing assumptions usually fail in overlay architectures.

Frequently Asked Questions

Why can't DHCP work with just the anycast gateway IP in SD-Access?

The anycast gateway IP is shared by all Fabric Edge nodes. Without additional identifiers, the DHCP server cannot determine which specific node the client is connected to, making scope assignment ambiguous.

What does DHCP Option-82 provide in an SD-Access fabric?

It inserts sub-options (like RLOC) into the DHCP packet that uniquely identify the originating Fabric Edge node, allowing the server to map the request to the correct virtual network and scope.

More 300-420 FAQ →

Community Votes

D
67%
C
22%
A
11%

67% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 15 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 15

  1. roganjosh 👍 4 Answered D
    Answer is D, adding for a vote
  2. kakito 👍 3
    I think "A" is corret, Is true that OPTION 82 is used, however its a feature that is and should be automatically added by the FENs. Therefore the Relay-agent has to be the FEN Fabric Edge Node.
  3. Xavi07 👍 3
    I think A is the correct.
  4. minon_bob 👍 2 Answered D
    The ip Anycast is the problem with DHCP and SDA. So the ip relay information option has to be set, it is by DNAC automagically, for DHCP to work in the fabric. https://community.cisco.com/t5/networking-knowledge-base/dhcp-in-the-fabric/ta-p/3918003
  5. Kamran202034 👍 2 Answered A
    There is not such a thing as "access fabric node" in SD-Access and unless there is typo, there is not such a thing as "circuit IP"; It is circuit ID! so if answer wording in the exam is as exactly as mentioned here I will go with A
Show 10 more comments
  1. Hope66 👍 2
    The answer could be A: https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/tech_notes/sda_dhcp/b_cisco_sda_dhcp.html Paragraf : Host DHCP Onboarding Process
  2. Kevinbob 👍 2
    ANSWER D https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/tech_notes/sda_dhcp/b_cisco_sda_dhcp.html
  3. J2J2J2J 👍 2 Answered D
    https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center/tech_notes/sda_dhcp/b_cisco_sda_dhcp.html
  4. iSDA69 👍 1 Answered C
    I'm adding a different POV after asking Google AI that I hope could help the reasoning: A: "This statement is factually true, but it is not the most critical consideration for the overall architecture to function". Anyway, to be precise, the DHCP relay function does not provide "the correct mapping of DHCP scope to the local anycast gateway". B: is totally wrong. C: It says the right answer is C because "the most important consideration is that the DHCP server understand the SD-ACCESS extensions to lease the ip address correctly...as it would not be able to differentiate between DHCP requests originating from different edge nodes...". The DHCP extensions in general are a real thing. D: "This statement is also factually true, and it is a crucial component of the DHCP relay process in SD-Access. However, the statement is slightly misleading by referring to a "circuit IP option"". This "circuit IP option" actually does not exists, and the option-82 does not contain the info of the user who sent the DHCP discover.
  5. G_Singh12 👍 1 Answered C
    • Anycast Gateway & GIADDR Challenge: In a Cisco SD-Access architecture, the same Anycast Gateway (IP and MAC address) is present across all Fabric Edge nodes. Because of this, the Gateway IP Address (giaddr) field in the relayed DHCP packet is identical regardless of which Fabric Edge switch the client is attached to. • The Role of Option 82 Extensions: To distinguish between different virtual environments and fabric locations, the Fabric Edge injects specific metadata into DHCP Option 82 (sub-options containing the Layer 3 Virtual Network ID [VN-ID] and the Routing Locator [RLOC] IP address). The external DHCP server must be capable of recognizing and processing these sub-option extensions to accurately map the endpoint to the correct IP address scope and return the response properly through the fabric.
  6. iLikeHamburgers 👍 1 Answered D
    Answer A is partially correct, because there is a need to have a the DHCP Discover packet relayed to the DHCP server, however the mapping of the client to the correct DHCP scope is not done with the anycast gateway, it is done within the DHCP Option82 sub options.This is needed because every edge device in the fabric has the same anycast gateway. There would be no way for the DHCP server to get the request back to the originating requestor with out the sub options from Option 82, specifically the source RLOC. Look under “Fabric DHCP Packet Flow” in the link below https://www.cisco.com/c/en/us/td/docs/solutions/CVD/Campus/cisco-sda-design-guide.html
  7. simcos 👍 1 Answered D
    Regarding answer A, yes the feature is enabled on the edge nodes, but the rest of the sentence doesn't make sense. The option 82 is used to map the DHCP request to the Edge device where it was originated (via RLOC). https://community.cisco.com/t5/networking-knowledge-base/dhcp-in-the-fabric/ta-p/3918003#toc-hId--1229221529
  8. cwoolie 👍 1
    I have answer as D
  9. cwoolie 👍 1
    Answer is D
  10. Eards 👍 1 Answered D
    Answer D

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

POV Report Builds the Customer Platform During Discovery

S-grade

VPLS design for sites sharing one IP subnet

S-grade

Inter-VN Communication in Cisco SD-WAN Architecture

S-grade

Advertising a Default Route from Core to Aggregation to Hide Instability

S-grade

Practice All 300-420 Questions

Access 150 questions with complete answers and detailed explanations.

View Full 300-420 Practice Test →

← Back to 300-420 Study Guide