H3C S12500 Unauthorized DHCP Server Detection Configuration Examples

Transcription

1 H3C S12500 Unauthorized DHCP Server Detection Configuration Examples Copyright 2013 Hangzhou H3C Technologies Co., Ltd. All rights reserved. No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. The information in this document is subject to change without notice.

2 Contents Introduction 1 Prerequisites 1 Example: Configuring unauthorized DHCP server detection 1 Network requirements 1 Software version used 2 Configuration restrictions and guidelines 2 Configuration procedures 2 Configuring Switch A 2 Configuring Switch B 3 Verifying the configuration 3 Configuration files 4 Related documentation 5 i

3 Introduction This document provides unauthorized DHCP server detection configuration examples. DHCP server detection logs the IP address of the DHCP server that assigned an IP address to the DHCP client and the receiving interface when it receives a DHCP request with Option 54 (Server Identifier Option). The administrator can use this log information to check out any unauthorized DHCP servers. Prerequisites The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network. This document assumes that you have basic knowledge of DHCP. Example: Configuring unauthorized DHCP server detection Network requirements As shown in Figure 1: Configure DHCP relay agent on Switch A so that DHCP clients can obtain IP addresses belonging to subnet /16 and configuration parameters from Switch B on another subnet. Configure unauthorized DHCP server detection on Switch A and Switch B so that the network administrator can locate unauthorized DHCP servers (for example, Switch C). Figure 1 Network diagram 1

4 Software version used This configuration example was created and verified on S12500-CMW520-R1825P01. Configuration restrictions and guidelines When you configure unauthorized DHCP server detection, follow these restrictions and guidelines: With unauthorized DHCP server detection enabled on Switch A and Switch B, the devices record all DHCP servers that assign IP addresses, including the authorized ones. The administrator must manually locate unauthorized DHCP servers from the log information. With unauthorized DHCP server detection enabled on Switch A and Switch B, the devices log each DHCP server once. After the log for a DHCP server is cleared, the devices re-record the server information by the detection mechanism. Configuration procedures Configuring Switch A Enable DHCP. <SwitchA> system-view [SwitchA] dhcp enable Specify DHCP server for DHCP server group 1 on the relay agent. [SwitchA] dhcp relay server-group 1 ip Specify /16 as the IP address of VLAN-interface 3, and assign GigabitEthernet 3/0/2 to VLAN 3. [SwitchA] vlan 3 [SwitchA-vlan3] port GigabitEthernet 3/0/2 [SwitchA-vlan3] quit [SwitchA] interface Vlan-interface 3 [SwitchA-Vlan-interface3] ip address [SwitchA-Vlan-interface3] undo shutdown [SwitchA-Vlan-interface3] quit [SwitchA] interface GigabitEthernet 3/0/2 [SwitchA-GigabitEthernet3/0/2] undo shutdown [SwitchA-GigabitEthernet3/0/2] quit Enable the DHCP relay agent on VLAN-interface 3. [SwitchA] interface Vlan-interface 3 [SwitchA-Vlan-interface3] dhcp select relay Correlate VLAN-interface 3 to DHCP server group 1. [SwitchA-Vlan-interface3] dhcp relay server-select 1 [SwitchA-Vlan-interface3] quit Specify /24 as the IP address of VLAN-interface 2, and assign GigabitEthernet 3/0/1 to VLAN 2. [SwitchA] vlan 2 2

5 [SwitchA-vlan2] port GigabitEthernet 3/0/1 [SwitchA-vlan2] quit [SwitchA] interface Vlan-interface 2 [SwitchA-Vlan-interface2] ip address [SwitchA-Vlan-interface2] undo shutdown [SwitchA-Vlan-interface2] quit [SwitchA] interface GigabitEthernet 3/0/1 [SwitchA-GigabitEthernet3/0/1] undo shutdown [SwitchA-GigabitEthernet3/0/1] quit Enable unauthorized DHCP server detection. [SwitchA] dhcp relay server-detect Configuring Switch B Enable DHCP. <SwitchB> system-view [SwitchB] dhcp enable Configure the DHCP address pool 0. [SwitchB] dhcp server ip-pool 0 [SwitchB-dhcp-pool-0] network mask [SwitchB-dhcp-pool-0] quit Enable unauthorized DHCP server detection. [SwitchB] dhcp server detect Specify /24 as the IP address of VLAN-interface 2 and assign GigabitEthernet 3/0/1 to VLAN 2. [SwitchB] vlan 2 [SwitchB-vlan2] port GigabitEthernet 3/0/1 [SwitchB-vlan2] quit [SwitchB] interface Vlan-interface 2 [SwitchB-Vlan-interface2] ip address [SwitchB-Vlan-interface2] undo shutdown [SwitchB-Vlan-interface2] quit [SwitchB] interface GigabitEthernet 3/0/1 [SwitchB-GigabitEthernet3/0/1] undo shutdown [SwitchB-GigabitEthernet3/0/1] quit Verifying the configuration This example assumes that the unauthorized DHCP server (Switch C) has assigned IP addresses to DHCP clients. Locate the unauthorized DHCP server from the following records on Switch B: Local DHCP server information: Server IP (detected by DHCP server) = , DHCP server interface = Vlan-interface2 Local DHCP server information: Server IP (detected by DHCP server) = 3

6 , DHCP server interface = Vlan-interface2 The IP address of the authorized DHCP server is , so the DHCP server at is unauthorized. Locate the unauthorized DHCP server from the following records on Switch A: DHCP Relay information:dhcp Relay interface = Vlan-interface3, Server IP (detected by DHCP Relay) = DHCP Relay information:dhcp Relay interface = Vlan-interface2, Server IP (detected by DHCP Relay) = The IP address of the authorized DHCP server is , so the DHCP server at is unauthorized. Configuration files Switch A: vlan 2 to 3 dhcp relay server-group 1 ip dhcp relay server-detect interface Vlan-interface2 ip address interface Vlan-interface3 ip address dhcp select relay dhcp relay server-select 1 interface GigabitEthernet3/0/1 port link-mode bridge port access vlan 2 interface GigabitEthernet3/0/2 port link-mode bridge port access vlan 3 dhcp enable Switch B: vlan 2 dhcp server ip-pool 0 4

7 network mask interface Vlan-interface2 ip address interface GigabitEthernet3/0/1 port link-mode bridge port access vlan 2 dhcp server detect dhcp enable Related documentation H3C S12500 Routing Switch Series Layer 3 IP Services Configuration Guide H3C S12500 Routing Switch Series Layer 3 IP Services Command Reference 5