Operation Manual DHCP. Table of Contents

Transcription

1 Table of Contents Table of Contents Chapter 1 DHCP Overview DHCP Principles BOOTP Relay Agent DHCP and BOOTP Relay Agent General DHCP Configuration Enabling/Disabling DHCP Configuring Processing Method of DHCP Packets Enabling/Disabling Unauthorized DHCP Server Detection Chapter 2 DHCP Server Configuration Configuring the DHCP Server Creating a Global DHCP IP Address Pool Configuring the IP Address Assignment Mode Excluding Specified IP Addresses from Assignment Configuring a Lease Time for a DHCP Address Pool Configuring a Domain Name for DHCP Clients Configuring DNS Servers for DHCP Clients Configuring NetBIOS Server Addresses for DHCP Clients Configuring a NetBIOS Node Type for DHCP Clients Configuring Custom DHCP Options Configuring Gateways for DHCP Clients Configuring Parameters for DHCP Server to Send Ping Packets Displaying and Debugging the DHCP Server DHCP Server Configuration Example Chapter 3 DHCP Relay Agent Configuration Configuring the DHCP Relay Agent Introduction to DHCP Relay Agent Configuring the DHCP Relay Agent Displaying and Maintaining the DHCP Relay Agent DHCP Relay Agent Configuration Example DHCP Option 82 Configuration Introduction to Option 82 Support on DHCP Relay Agent Configuring Option 82 Support on DHCP Relay Agent Option 82 Support on DHCP Relay Agent Configuration Example Chapter 4 DHCP Snooping Configuration DHCP Snooping Overview Introduction DHCP Snooping and ACL i

2 Table of Contents DHCP Snooping Support for Option DHCP Snooping Configuration Configuration Guidelines Displaying and Maintaining DHCP Snooping DHCP Snooping Configuration Example Wrong DHCP Snooping Networking Examples ii

3 Chapter 1 DHCP Overview Chapter 1 DHCP Overview 1.1 DHCP Principles The fast expansion and growing complexity of networks result in scarce IP addresses assignable to hosts. Meanwhile, with the wide application of wireless networks, the frequent movements of laptops across networks require that the IP addresses be changed accordingly. Therefore, related configurations on hosts become more complex. Dynamic Host Configuration Protocol (DHCP) was introduced to solve these problems. DHCP is built on a client-server model, in which the client sends a configuration request and then the server returns a reply to send configuration parameters such as an IP address to the client. A typical DHCP implementation comprises a DHCP server and multiple DHCP clients (PCs or laptops). Figure 1-1 illustrates a network that employs DHCP. DHCP client DHCP client DHCP server DHCP client DHCP client Figure 1-1 Network diagram for DHCP I. IP address assignment 1) IP address assignment policy Different types of clients have different requirements for IP addresses. Servers usually require long-term fixed IP addresses, some hosts may require automatically assigned long-term fixed IP addresses, and some hosts may only require dynamically assigned temporary IP addresses. A DHCP server provides three policies to meet these requirements. Manual IP address assignment. The administrator assigns fixed IP addresses to special DHCP clients, such as a WWW server. 1-1

4 Chapter 1 DHCP Overview Automatic IP address assignment. The DHCP server automatically assigns fixed IP addresses to DHCP clients when they are connected to the network for the first time. After that, the IP addresses are always occupied by the DHCP clients. Dynamic IP address assignment. The DHCP server leases IP addresses to DHCP clients for a specified period of time and reclaims them at the expiration of the period. In this case, a DHCP client must reapply for an IP address regularly. This is the common case for normal users. 2) IP address assignment order The DHCP server assigns IP addresses except the forbidden ones to clients in the following orders. IP addresses in the address pool of the DHCP server that are statically bound to the MAC addresses of the DHCP clients. IP addresses that are reclaimed by the DHCP server. That is, those in the Requested IP Addr Option field of DHCP Discover packets sent by DHCP clients. The first available IP address in the address pool the DHCP server finds. The first expired or once conflicted IP address it finds. A DHCP server returns an error if it cannot find any available IP address from all these types of IP addresses when assigning an IP address. 3) Types of address pools of DHCP server Global address pool, valid for the entire switch. An address pool of this type is created using the dhcp server ip-pool command in system view. VLAN interface address pool, valid for a specific VLAN interface. An address pool of this type is created when the VLAN interface is configured with a legal unicast IP address and with the dhcp select interface command. The range of the address pool is the network segment where the VLAN interface resides. II. Communications between DHCP clients and DHCP server To obtain valid dynamic IP addresses, the DHCP clients exchange different information with the DHCP server in different phases. Usually, three phases are involved: 1) First round registration A DHCP client goes through the following four steps when it accesses the network for the first time: Discovery. The DHCP client tries to find a DHCP server by broadcasting a DHCP_Discover packet in the network. (Only DHCP servers respond to this type of packet.) Provision. Each DHCP server that receives the DHCP_Discover packet selects an available IP address from an address pool and sends a DHCP_Offer packet that carries the selected IP address and other configuration information to the DHCP client. Selection. The DHCP client only accepts the first arriving DHCP_Offer packet if there are DHCP_Offer packets from several DHCP servers. Then, it broadcasts a 1-2

5 Chapter 1 DHCP Overview DHCP_Request packet. The packet contains the IP address carried in the accepted DHCP_Offer packet. Acknowledgement. Upon receiving the DHCP_Request packet, the DHCP server that owns the IP address the DHCP_Request packet carries sends a DHCP_ACK packet to the DHCP client. And then the DHCP client binds TCP/IP protocol components to its network adapter. IP addresses offered by other DHCP servers (if any) in DHCP_Offer packets but not selected by the DHCP client are still available for other clients. 2) Second round registration A second round registration goes through the following steps: After going through the first round registration successfully and logging out, when the DHCP client logs on to the network again, it directly broadcasts a DHCP_Request packet that contains the IP address assigned to it in the first round registration instead of a DHCP_Discover packet. Upon receiving the DHCP_Request packet, if the IP address carried in the packet is still available, the DHCP server owning the IP address answers with a DHCP_ACK packet to enable the DHCP client to use the IP address again. If the IP address is not available (for example, it is occupied by another DHCP client), the DHCP server answers with a DHCP_NAK packet, which enables the DHCP client to go through steps in the first round registration. 3) Prolonging the lease time of the IP address An IP address assigned dynamically is valid for a specified lease time and will be reclaimed by the DHCP server when the time expires. So the DHCP client must update the lease to prolong the lease time if it is to use the IP address for a longer time. By default, a DHCP client updates its IP address lease automatically by sending a DHCP_Request packet to the DHCP server when half the lease time elapses. The DHCP server, in turn, answers with a DHCP_ACK packet to notify the DHCP client of the new lease BOOTP Relay Agent The Bootstrap protocol (BOOTP) relay agent is an Internet host or router that forwards DHCP messages between the DHCP server and DHCP clients. BOOTP is designed for remote boot, mainly to notify the connected client about the location of the boot file. DHCP is an extension of the BOOTP mechanism. This feature enables an existing BOOTP client to interoperate with the DHCP server without changing the installed software. RFC 1542 describes in detail the interactions among BOOTP, DHCP client and DHCP server. 1-3

6 Chapter 1 DHCP Overview DHCP and BOOTP Relay Agent Like BOOTP, DHCP also works in the Client/Server mode. A DHCP client can obtain the configuration information dynamically from a DHCP server, including important parameters such as an IP address and mask. DHCP provides a framework about how to set a host on a TCP/IP network. DHCP is derived from BOOTP, and provides more functions such as automatic allocation of reusable network addresses and additional configuration options. DHCP can act as a BOOTP relay agent, so a DHCP user and a BOOTP user can interact with each other. The message format of DHCP is based on the message format of BOOTP, so that it can work as a relay agent and allow the interoperability between existing BOOTP clients and the DHCP server. The use of a BOOTP relay agent avoids employing a DHCP server for every physical network segment. DHCP differs from BOOTP in that: DHCP defines a mechanism through which a client can be allocated with a network address valid for a fixed lease period. In addition, it allows for continuous reallocation of network addresses to different clients. DHCP provides a mechanism through which a client is allowed to obtain all IP configuration parameter for subsequent operations. 1.2 General DHCP Configuration General DHCP configuration refers to those that are applicable to both DHCP server and DHCP relay agent. The following sections describe the general DHCP configuration tasks: Enabling/Disabling DHCP Configuring Processing Method of DHCP Packets Enabling/Disabling Unauthorized DHCP Server Detection Enabling/Disabling DHCP For both DHCP server and DHCP relay agent, you need to enable DHCP before performing other DHCP configurations. The other related DHCP configurations take effect only after DHCP is enabled. Perform the following configuration in system view to enable/disable DHCP: Enable DHCP Disable DHCP dhcp enable undo dhcp enable DHCP is disabled by default. 1-4

7 Chapter 1 DHCP Overview Configuring Processing Method of DHCP Packets You can perform the configurations listed in the following tables on your switch. After these configurations, the switch processes the DHCP packets it receives from DHCP clients in the methods you have configured. Perform the following configuration in VLAN interface view to configure the processing method for the current VLAN interface: Specify to forward DHCP packets to local DHCP server and let the local server assign IP addresses in global address pools to DHCP clients Specify to forward DHCP packets to local DHCP server and let the local server assign IP addresses in VLAN interface address pool to DHCP clients Specify to forward DHCP packets to remote DHCP servers. In this case, the current switch operates as a DHCP relay agent, and IP addresses are assigned by DHCP servers located in other networks Restore the default dhcp select global dhcp select interface dhcp select relay undo dhcp select Caution: The dhcp select interface command cannot be used together with the ip relay address or dhcp relay security address-check enable command. Perform the following configurations in system view to configure the processing method for multiple VLAN interfaces: Specify to forward DHCP packets to local DHCP server and let the local server assign IP addresses in global address pools to DHCP clients Specify to forward DHCP packets to local DHCP server and let the local server assign IP addresses in VLAN interface address pool to DHCP clients Specify to forward DHCP packets to remote DHCP servers. In this case, the current switch operates as a DHCP relay agent, and IP addresses are assigned by DHCP servers located in other networks dhcp select global { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } dhcp select interface { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } dhcp select relay { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } 1-5

8 Chapter 1 DHCP Overview Restore the default undo dhcp select { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } By default, DHCP packets are processed in global method. That is, DHCP packets are forwarded to the local DHCP server and IP addresses in global address pools are assigned Enabling/Disabling Unauthorized DHCP Server Detection If an unauthorized DHCP server exists in a network, it may assign incorrect IP addresses to DHCP clients, and thus the users cannot access networks. With unauthorized DHCP server detection enabled, the switch can record information (such as the IP addresses) about the DHCP servers. This helps the administrator to detect unauthorized DHCP servers in time and take proper measures. Perform the following configuration in system view to enable/disable unauthorized DHCP server detection: Enable unauthorized DHCP server detection Disable unauthorized DHCP server detection dhcp server detect undo dhcp server detect By default, unauthorized DHCP server detection is disabled. 1-6

9 Chapter 2 DHCP Server Configuration Chapter 2 DHCP Server Configuration When configuring the DHCP server, go to these sections for information you are interested in: Configuring the DHCP Server Displaying and Debugging the DHCP Server DHCP Server Configuration Example 2.1 Configuring the DHCP Server The following sections describe the DHCP server configuration tasks: Creating a Global DHCP IP Address Pool Configuring the IP Address Assignment Mode Excluding Specified IP Addresses from Assignment Configuring a Lease Time for a DHCP Address Pool Configuring a Domain Name for DHCP Clients Configuring DNS Servers for DHCP Clients Configuring NetBIOS Server Addresses for DHCP Clients Configuring a NetBIOS Node Type for DHCP Clients Configuring Custom DHCP Options Configuring Gateways for DHCP Clients Configuring Parameters for DHCP Server to Send Ping Packets Note: Some of the above DHCP configurations can be performed for global IP address pools, IP address pool of the current VLAN interface, or IP address pools of multiple specified VLAN interfaces respectively, including: Configuring the lease time for a DHCP address pool Configuring DHCP client domain names Configuring DNS server addresses for DHCP clients Configuring a NetBIOS server address for DHCP clients Configuring a NetBIOS node type for DHCP clients Configuring DHCP custom options 2-1

10 Chapter 2 DHCP Server Configuration Note: In a VRRP network, A global address pool is recommended. You are recommended to configure the virtual IP address of the VRRP group as either the gateway in the global address pool or a reserved address, because some DHCP clients (for example, Linux devices serving as clients) do not perform address collision detection after obtaining addresses through DHCP. In such cases, the virtual VRRP address may be assigned to a DHCP client, thereby causing communication failures Creating a Global DHCP IP Address Pool An IP address pool contains IP addresses that can be assigned to DHCP clients. In response to a DHCP request sent by a DHCP client, the DHCP server selects an appropriate IP address pool based on your configuration, choose an available IP address from the pool, and sends the IP address and other parameters (such as the lease time of the IP address) to the DHCP client. At present, you can configure up to 128 global DHCP address pools for a DHCP server. The address pools of a DHCP server are hierarchically grouped like a tree. The root holds the IP address of the network segment, the branches hold the subnet IP addresses, and finally, the leaves hold the IP addresses of DHCP clients, which are manually bound to the corresponding network adapters. Such a structure enables configurations to be inherited. That is, configurations of the network segment can be inherited by its subnets, whose configurations in turn can be inherited by their clients. So, you can configure the parameters (such as domain name) that are common to all levels in the address pool structure or some subnets only for the network segment or for corresponding subnets. The display dhcp server tree command displays the tree-like structure of address pools, and address pools on the same level are sorted by the time they are created. The dhcp server ip-pool command can be used to create a global DHCP address pool and enter the corresponding address pool view. If the address pool already exists, this command brings you to the address pool view directly. Perform the following configuration in system view to create a global DHCP address pool: Create a DHCP address pool and enter the corresponding DHCP address pool view dhcp server ip-pool pool-name 2-2

11 Remove a DHCP address pool Chapter 2 DHCP Server Configuration undo dhcp server ip-pool pool-name By default, no global DHCP address pool is created. Note that a VLAN interface address pool is created by the system after you assign a legal unicast IP address to the VLAN interface and configure the dhcp select interface command in VLAN interface view Configuring the IP Address Assignment Mode IP addresses can be assigned in two modes: static binding and dynamic assignment. You can statically bind an IP address in an address pool to the MAC address of a client or configure a address range to allow the DHCP server to dynamic allocate the addresses in the range to DHCP clients. The two modes cannot coexist in a global DHCP address pool, but they can coexist in a VLAN interface address pool (dynamically assigned addresses are on the same network segment as the IP address of the VLAN interface). For the dynamic assignment mode, you must specify the range of the addresses to be dynamically assigned. A global DHCP address pool whose IP addresses are statically bound to DHCP clients is actually a special kind of DHCP address pool. I. Configuring a static address binding for a global DHCP address pool You can bind an IP address to the MAC address of a DHCP client who needs fixed IP address. After that, when the client requests an IP address, the DHCP server finds (according to the MAC address) and assigns the fixed IP address to the client. At present, only one MAC-IP static binding is supported in a global DHCP address pool. Perform the following configuration in DHCP address pool view to configure a static binding for a global DHCP address pool: Specify the IP address to be statically bound Delete the statically bound IP address Specify the MAC address to be statically bound Delete the statically bound MAC address static-bind ip-address ip-address [ { mask netmask } mask-length ] undo static-bind ip-address static-bind mac-address mac-address undo static-bind mac-address No static IP-MAC binding is configured in a global address pool. 2-3

12 Chapter 2 DHCP Server Configuration Note: The static-bind ip-address command and the static-bind mac-address command must be used together to configure a static binding. The new configuration overwrites the previous one. II. Configuring a static address binding for a VLAN interface address pool At present, a VLAN interface DHCP address pool supports multiple MAC-IP address bindings. Perform the following configuration in VLAN interface view to configure a static address binding for a VLAN interface address pool: Configure a static IP-MAC binding for the current VLAN interface address pool Remove a static binding dhcp server static-bind ip-address ip-address mac-address mac-address undo dhcp server static-bind { ip-address ip-address mac-address mac-address } No static IP-MAC binding is configured in an interface address pool. Caution: A binding in a VLAN interface address pool cannot be overwritten directly. If an IP-to-MAC address binding entry is configured and you want to modify it, you must remove it and redefine a new one. III. Configuring dynamic IP address assignment To assign IP addresses dynamically, that is, IP addresses are leased permanently or temporarily, you need to configure an address range. Perform the following configuration in DHCP address pool view to configure an address range for dynamic IP address assignment: Configure an address range for dynamic IP address assignment network ip-address [ mask netmask mask-length ] 2-4

13 Remove an dynamic assignment address range Chapter 2 DHCP Server Configuration undo network By default, no IP address range is configured for dynamic IP address assignment. Each DHCP address pool can be configured with only one address range. If you execute the network command multiple times, then only the last configured address range works. Caution: When addresses are obtained through a DHCP relay agent, the involved address pool, global address pool with a static binding and the Relay agent s address must have the same subnet mask. Otherwise, the binding will fail, or the addresses assigned to clients will not be in the same network segment as the Relay agent Excluding Specified IP Addresses from Assignment You can use the following command to prevent the DHCP server from assigning IP addresses that are already occupied by such network devices as gateways and file transfer protocol (FTP) servers to other DHCP clients to avoid IP address conflicts. Perform the following configuration in system view to exclude specified IP addresses from assignment: Exclude specified IP addresses from assignment Cancel the forbiddance dhcp server forbidden-ip low-ip-address [ high-ip-address ] undo dhcp server forbidden-ip low-ip-address [ high-ip-address ] All IP addresses in a DHCP address pool can be automatically assigned by default. You can set multiple IP address ranges that cannot be assigned automatically by executing the dhcp server forbidden-ip command multiple times Configuring a Lease Time for a DHCP Address Pool You can configure different lease times for different DHCP address pools. But you can configure only one lease time for one DHCP address pool and all the address in the same pool will have the same lease time. 2-5

14 Chapter 2 DHCP Server Configuration I. Configuring a lease time for a global DHCP address pool Perform the following configuration in DHCP address pool view to configure a lease time for a global DHCP address pool: Configure a lease time for a global DHCP address pool Restore the default expired { day day [ hour hour [ minute minute ] ] unlimited } undo expired II. Configuring a lease time for a VLAN interface address pool Perform the following configuration in VLAN interface view to configure a lease time for the current VLAN interface: Configure a lease time for the current VLAN interface DHCP address pool Restore the default dhcp server expired { day day [ hour hour [ minute minute ] ] unlimited } undo dhcp server expired III. Configuring a lease time for multiple VLAN interface address pools Perform the following configuration in system view to configure a lease time for multiple VLAN interface address pools: Configure a lease time for DHCP address pools of multiple VLAN interfaces Restore the default dhcp server expired { day day [ hour hour [ minute minute ] ] unlimited } { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } undo dhcp server expired { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } The default lease times for global address pools and VLAN interface address pools are all one day Configuring a Domain Name for DHCP Clients You can configure a domain name used by DHCP clients for each address pool on a DHCP server. I. Configuring a domain name in a global DHCP address pool Perform the following configuration in DHCP address pool view to configure a DHCP client domain name for a global DHCP address pool: 2-6

15 Chapter 2 DHCP Server Configuration Configure a DHCP client domain name for the global DHCP address pool Remove the DHCP client domain name from the global DHCP address pool domain-name domain-name undo domain-name II. Configuring a DHCP client domain name for a VLAN interface address pool Perform the following configuration in VLAN interface view to configure a DHCP client domain name for the VLAN interface address pool: Configure a DHCP client domain name for the DHCP address pool of the current VLAN interface Remove the DHCP client domain name from the VLAN interface address pool dhcp server domain-name domain-name undo dhcp server domain-name III. Configuring a DHCP client domain name for multiple VLAN interface address pools Perform the following configuration in system view to configure a DHCP client domain name for multiple VLAN interface address pools: Configure a DHCP client domain name for DHCP address pools of multiple VLAN interfaces Remove the DHCP client domain name from DHCP address pools of multiple VLAN interfaces dhcp server domain-name domain-name { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } undo dhcp server domain-name domain-name { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } By default, global address pools and VLAN interface address pools are not configured with any DHCP client domain name. If you execute the dhcp server domain-name command multiple times, the newly configured DHCP client domain name overwrites the existing one Configuring DNS Servers for DHCP Clients When a host uses a domain name to access the Internet, the domain name must be translated into an IP address. Domain name system (DNS) is responsible for the translation. Therefore, when a DHCP server assigns an IP address to a DHCP client, it 2-7

16 Chapter 2 DHCP Server Configuration must also send a DNS server address to the client. At present, you can configure up to eight DNS server addresses for one DHCP address pool. I. Configuring DNS server addresses for a global DHCP address pool Perform the following configuration in DHCP address pool view to configure DNS server addresses for a global DHCP address pool: Configure one or more DNS server addresses for the global DHCP address pool Remove one or all DNS server addresses from the global DHCP address pool dns-list ip-address [ ip-address ] Undo dns-list { ip-address all } II. Configuring DNS server addresses for a VLAN interface address pool Perform the following configuration in VLAN interface view to configure DNS server addresses for the VLAN interface address pool: Configure one or more DNS server addresses for the DHCP address pool of the current VLAN interface Remove one or all DNS server addresses from the DHCP address pool of the current VLAN interface dhcp server dns-list ip-address [ ip-address ] undo dhcp server dns-list { ip-address all } III. Configuring DNS server addresses for multiple VLAN interface address pools Perform the following configuration in system view to configure DNS server addresses for multiple VLAN interface address pools: Configure one or more DNS server addresses for the DHCP address pools of multiple VLAN interfaces Remove one or all DNS server addresses from the DHCP address pools of multiple VLAN interfaces dhcp server dns-list ip-address [ ip-address ] { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } undo dhcp server dns-list { ip-address all } { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } By default, no DNS server address is configured for global and VLAN interface address pools. If you execute the dhcp server dns-list command multiple times, the newly configured IP addresses overwrite the existing ones. 2-8

17 Chapter 2 DHCP Server Configuration Configuring NetBIOS Server Addresses for DHCP Clients For clients running a Windows operating system and communicating through the NetBIOS protocol, the translation between host name and IP address are carried out by Windows Internet Naming Service (WINS) servers. So you need to perform configurations concerning WINS for these clients. At present, you can configure up to eight NetBIOS server addresses for a DHCP address pool. I. Configuring NetBIOS server addresses for a global DHCP address pool Perform the following configuration in DHCP address pool view to configure NetBIOS server addresses for a global DHCP address pool: Configure one or more NetBIOS server addresses for a global DHCP address pool Remove one or all NetBIOS server addresses from a global DHCP address pool nbns-list ip-address [ ip-address ] undo nbns-list { ip-address all } II. Configuring NetBIOS server addresses for a VLAN interface address pool Perform the following configuration in VLAN interface view to configure NetBIOS server addresses for the VLAN interface address pool: Configure one or more NetBIOS server addresses for the DHCP address pool of the current VLAN interface Remove one or all NetBIOS server addresses from the DHCP address pool of the current VLAN interface dhcp server nbns-list ip-address [ ip-address ] undo dhcp server nbns-list { ip-address all } III. Configuring NetBIOS server addresses for multiple VLAN interface address pools Perform the following configuration in system view to configure NetBIOS server addresses for multiple VLAN interface address pools: Configure one or more NetBIOS server addresses for the DHCP address pools of multiple VLAN interfaces dhcp server nbns-list ip-address [ ip-address ] { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } 2-9

18 Remove one or all NetBIOS server addresses from specified DHCP address pools of multiple VLAN interfaces Chapter 2 DHCP Server Configuration undo dhcp server nbns-list { ip-address all } { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } By default, no NetBIOS server address is configured for global and VLAN interface address pools. If you execute the dhcp server nbns-list command multiple times, the new configuration overwrites the previous one Configuring a NetBIOS Node Type for DHCP Clients For DHCP clients communicating in a wide area network (WAN) through NetBIOS protocol, the mappings between their host names and IP addresses must be established. According to the ways they establish their mappings, NetBIOS nodes fall into the following four types: b (broadcast)-node: The b-node client sends the destination name in a broadcast message. The destination returns its IP address to the client after receiving the message. p (peer-to-peer)-node: The p-node client sends the destination name in a unicast message to the WINS server, and the WINS server returns the destination IP address. m (mixed)-node: A combination of broadcast and peer-to-peer. The m-node client broadcasts the destination name, upon no response, then unicasts the destination name to the WINS server to get the destination IP address. h (hybrid)-node: A combination of peer-to-peer and broadcast. The h-node client unicasts the destination name to the WINS server, upon no response, then broadcasts it to get the destination IP address. I. Configuring a NetBIOS node type in a global DHCP address pool Perform the following configuration in DHCP address pool view to configure a NetBIOS node type for a global DHCP address pool: Configure a NetBIOS node type for a global DHCP address pool Remove the configuration netbios-type { b-node h-node m-node p-node } undo netbios-type 2-10

19 Chapter 2 DHCP Server Configuration II. Configuring a NetBIOS node type in a VLAN interface address pool Perform the following configuration in VLAN interface view to configure a NetBIOS node type in the VLAN interface address pool: Configure a NetBIOS node type in the current VLAN interface DHCP address pool Remove the configuration dhcp server netbios-type { b-node h-node m-node p-node } undo dhcp server netbios-type III. Configuring a NetBIOS node type for multiple VLAN interface address pools Perform the following configuration in system view to configure a NetBIOS node type for multiple VLAN interface address pools: Configure a NetBIOS node type in multiple VLAN interface DHCP address pools Remove the NetBIOS node type from multiple VLAN interface DHCP address pools dhcp server netbios-type { b-node h-node m-node p-node } { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } undo dhcp server netbios-type { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } By default, the DHCP clients of global and VLAN interface address pools are all of h-node type Configuring Custom DHCP Options With the evolvement of DHCP, new options come forth continuously. To utilize these options, you can manually add them to the attribute list of a DHCP server. I. Configuring a custom DHCP option in a global DHCP address pool Perform the following configuration in DHCP address pool view to configure a custom DHCP option in the global DHCP address pool: Configure a custom DHCP option in the global DHCP address pool Remove the custom DHCP option from the global DHCP address pool option code { ascii ascii-string hex hex-string ip-address ip-address [ ip-address ] } undo option code 2-11

20 Chapter 2 DHCP Server Configuration II. Configuring a custom DHCP option in a VLAN interface address pool Perform the following configuration in VLAN interface view to configure a custom DHCP option in the VLAN interface address pool: Configure a custom DHCP option in the DHCP address pool of the current VLAN interface Remove a custom DHCP option from the DHCP address pool of the current VLAN interface dhcp server option code { ascii ascii-string hex hex-string ip-address ip-address [ ip-address ] } undo dhcp server option code III. Configuring a custom DHCP option in multiple VLAN interface address pools Perform the following configuration in system view to configure a custom DHCP option in multiple VLAN interface address pools: Configure a custom DHCP option for DHCP address pools of multiple VLAN interfaces Remove a custom DHCP option from DHCP address pools of multiple VLAN interfaces dhcp server option code { ascii ascii-string hex hex-string ip-address ip-address [ ip-address ] } { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } undo dhcp server option code { interface vlan-interface vlan-id [ to vlan-interface vlan-id ] all } If you execute the dhcp server option command multiple times, the newly configured option overwrites the existing one Configuring Gateways for DHCP Clients An outbound gateway enables DHCP clients to access external network devices. At present, you can configure up to eight IP addresses of outbound gateways in a DHCP global address pool. Perform the following configuration in DHCP address pool view to configure outbound gateway addresses for DHCP clients: Configure one or more outbound gateway addresses for DHCP clients gateway-list ip-address [ ip-address ] 2-12

21 Remove one or all outbound gateway addresses Chapter 2 DHCP Server Configuration undo gateway-list { ip-address all } By default, no outbound gateway address is configured for DHCP clients. If you execute the gateway-list command multiple times, the newly configured IP addresses overwrite the existing ones Configuring Parameters for DHCP Server to Send Ping Packets To avoid address conflicts caused by assigning in-use IP addresses, before assigning an IP address to a DHCP client, the DHCP server pings the IP address to ensure the IP address is not occupied. The DHCP server determines whether an IP address is reachable by sending specified number of ping packets. It waits for a response for a specified period after sending each of these packets. If the DHCP server receives no response after sending all these packets, it considers the IP address is not used by other devices in this network and assigns the IP address to this DHCP client. Otherwise, it does not assign the IP address. Perform the following configuration in system view to configure parameters for DHCP server to send ping packets: Set the maximum number of ping packets to be sent at a time Restore the default Set the maximum duration for the DHCP server to wait for a response to a ping packet Restore the default maximum duration dhcp server ping packets number undo dhcp server ping packets dhcp server ping timeout milliseconds undo dhcp server ping timeout By default, the DHCP server sends up to 2 ping packets to test an IP address and waits for a response for up to 500 milliseconds. Note that the DHCP server detects address conflicts through ping packets, whereas a DHCP client does this through ARP. 2-13

22 Chapter 2 DHCP Server Configuration 2.2 Displaying and Debugging the DHCP Server Displaying the DHCP server: Remarks Display the statistics about IP address conflicts Display information about lease-expired addresses in DHCP address pool(s). The lease-expired IP addresses in an address pool are assigned to other DHCP clients as needed if the address pool runs out of its available IP addresses Display the ranges of available (unassigned) IP addresses in DHCP address pools Display the forbidden IP addresses in the DHCP address pools Display the information about IP address bindings in DHCP address pool(s) Display the statistics about the DHCP server Display information about the tree-like structure of DHCP address pool(s) display dhcp server conflict { all ip ip-address } display dhcp server expired { ip ip-address pool [ pool-name ] interface [ vlan-interface vlan-id ] all } display dhcp server free-ip display dhcp server forbidden-ip display dhcp server ip-in-use { ip ip-address pool [ pool-name ] interface [ vlan-interface vlan-id ] all } display dhcp server statistics display dhcp server tree { pool [ pool-name ] interface [ vlan-interface vlan-id ] all } Available in any view Available in any view Note: The information of some dynamic entries may be lost due to frequent switchovers between the active and standby cards in the Switch, which however will cause no influence on network performance. 2-14

23 Chapter 2 DHCP Server Configuration Debugging the DHCP server: Remarks Disable debugging for the DHCP server Enable debugging for the DHCP server undo debugging dhcp server { all error event packet } debugging dhcp server { all error event packet } Available in user view Clearing the specified information of the DHCP server: Remarks Clear the statistics about DHCP address conflicts Clear the information about dynamically bound addresses Clear the statistics about the DHCP server reset dhcp server conflict { ip ip-address all } reset dhcp server ip-in-use{ all interface [ vlan-interface vlan-id ] ip ip-address pool [ pool-name ] } reset dhcp server statistics Available in user view 2.3 DHCP Server Configuration Example I. Network requirements As shown in Figure 2-1, two DHCP clients on the same network segment ( ) are connected to the switch through a port in VLAN2. The switch, acting as a DHCP server, is supposed to assign IP addresses to the two DHCP clients without the help of any DHCP relay agent. II. Network diagram DHCP client DHCP client Ethernet Switch ( DHCP Server) Figure 2-1 Network diagram for DHCP server III. Configuration procedure # Enter system view. <H3C> system-view 2-15

24 Chapter 2 DHCP Server Configuration # Create VLAN2. [H3C] vlan 2 # Enter VLAN interface view. [H3C] interface Vlan-interface 2 # Assign an IP address to Vlan-interface 2. [H3C-Vlan-interface2] ip address # Specify to assign IP addresses in the interface address pool to DHCP clients. [H3C-Vlan-interface2] dhcp select interface # Specify to assign IP addresses in global address pool to DHCP clients (it is also the default configuration). [H3C-Vlan-interface2] dhcp select global Or execute the following command to restore the default. [H3C-Vlan-interface2] undo dhcp select # Configure a global address pool. [H3C] dhcp server ip-pool 1 [H3C-dhcp-1] network mask [H3C-dhcp-1] gateway-list

25 Chapter 3 DHCP Relay Agent Configuration Chapter 3 DHCP Relay Agent Configuration When configuring the DHCP relay agent, go to these sections for information you are interested in: Configuring the DHCP Relay Agent DHCP Option 82 Configuration 3.1 Configuring the DHCP Relay Agent Introduction to DHCP Relay Agent DHCP adopts a client/server model, where DHCP clients send requests to the DHCP server dynamically and the DHCP server in turn returns corresponding configuration information according to the policies configured for it. Early implementations of DHCP only work when the DHCP clients and DHCP server are in the same subnet. That is, they cannot work across networks. So, to implement dynamic host configuration, you must deploy at least one DHCP server in each subnet, and this is obviously uneconomical. DHCP relay agent is designed to resolve this problem. Through a DHCP relay agent, DHCP clients in a LAN can communicate with DHCP servers in other subnets to acquire IP addresses. This enables DHCP clients of multiple networks to share a common DHCP server and thus enables you to save your cost and perform centralized administration. Figure 3-1 illustrates a typical DHCP relay application. DHCP client DHCP client IP network DHCP relay DHCP client DHCP client DHCP server Figure 3-1 Network diagram for DHCP Relay The dynamic host configuration procedure with the DHCP relay agent is as follows: A DHCP client broadcasts a DHCP request packet in the local network when it starts up and initializes the configuration. 3-1

26 Chapter 3 DHCP Relay Agent Configuration If a DHCP server exists in the network, it processes the request packet directly without the help of a DHCP relay agent. If no DHCP server exists in the network, the network device serving as a DHCP relay agent in the network appropriately processes the request packet and forwards it to a specified DHCP server located in another network. After receiving the packet, the DHCP server generates configuration information accordingly and sends a reply to the DHCP client through the DHCP relay agent to complete the dynamic configuration of the DHCP client. Note that the actual configuration procedure goes through more steps. Note: When forwarding BOOTP messages, the DHCP relay agent neither record user address entries, nor support Option Configuring the DHCP Relay Agent The DHCP relay agent configuration includes the following: Configuring a DHCP server for a VLAN interface Configuring client address entries for a DHCP relay agent Releasing the IP address of a client through the DHCP relay agent Releasing the IP address of a client through the DHCP relay agent in system view Releasing the IP address of a client through DHCP relay agent in interface view Enable address check on a DHCP relay agent enabled interface Enabling refreshing of dynamic user address entries and specifying the refreshing interval I. Configuring a DHCP server for a VLAN interface You can execute the ip relay address command to configure the DHCP packet processing mode as relay and a corresponding DHCP server for a VLAN interface. Perform the following configuration in VLAN interface view to configure a corresponding DHCP server for a VLAN interface: Configure a DHCP server for the current VLAN interface ip relay address ip-address Remove one or all DHCP servers undo ip relay address { ip-address all } No DHCP server is configured for a VLAN interface by default. 3-2

27 Chapter 3 DHCP Relay Agent Configuration Note that when configuring a new DHCP server for a VLAN interface, the newly configured one does not overwrite the existing ones. Both the new and the old ones are valid. You can configure up to 20 DHCP server addresses for a VLAN interface. Caution: The IP address of a specified DHCP server cannot be the IP address of the VLAN interface where the DHCP relay agent resides. II. Configuring client address entries for a DHCP relay agent In a VLAN that has DHCP Relay agent configured, to enable a DHCP client using a legal fixed IP address to pass the address checking of the DHCP relay agent security feature, you must add a static address entry for the DHCP client. A static address entry is a binding between a fixed IP address and a MAC address. Perform the following configuration in system or VLAN interface view to configure an IP-MAC entry of a client on the DHCP relay agent: Add a user address entry for DHCP relay Remove a user address entry for DHCP relay dhcp relay security ip-address mac-address static undo dhcp relay security ip-address 3-3

28 Chapter 3 DHCP Relay Agent Configuration Note: The DHCP client applies for an IP address through the DHCP relay agent. When the packet from the DHCP client arrives at the DHCP relay agent, the DHCP relay agent adds its primary IP address in the packet and forwards the packet to the DHCP server. Upon receiving the packet, the DHCP server allocates an IP address in the same segment as the IP address added by the DHCP relay agent. If there is a local DHCP server, when the DHCP client applies for an IP address, it can be assigned with only the address which is in the same network segment with the primary IP address rather than a secondary IP address of the receiving interface of the server. If there is no local DHCP server, when a DHCP client applies for an IP address through the relay agent, the DHCP client can be assigned with only an address which is in the same network segment with the primary IP address rather than a secondary IP address of the relay agent. III. Releasing the IP address of a client through the DHCP relay agent In some cases, you may have to manually release the IP address assigned to a client through the DHCP relay agent. After this function is enabled, the DHCP relay agent will actively send a release packet to the specified DHCP server. Upon receiving the packet, the DHCP server will release the lease of the specified IP address. IV. Releasing the IP address of a client through the DHCP relay agent in system view When configuring this function in system view: If you specify no DHCP server, the DHCP relay agent will send a release packet to all DHCP servers in the DHCP server groups corresponding to all the interfaces in the DHCP relay agent mode. If you specify a DHCP server, the DHCP relay agent will send a release packet to the DHCP server. Follow these steps to release the IP address of a client through the DHCP relay agent in system view: Remarks Enter system view system-view Request the DHCP server to release the IP address assigned to a client dhcp relay release client-ip client-mac [ server-ip ] Required 3-4

29 Chapter 3 DHCP Relay Agent Configuration V. Releasing the IP address of a client through DHCP relay agent in interface view When you configure this function in interface view: If you do not specify a DHCP server, the DHCP relay agent will send a release packet to all the DHCP servers in the DHCP server group associated with this interface. If you specify a DHCP server, the DHCP relay agent will send a release packet to the specified DHCP server. Follow these steps to release the IP address of a client through the DHCP relay agent in interface view: Remarks Enter system view system-view Enter VLAN interface view Request the DHCP server to release the IP address assigned to a client interface interface-type interface-number dhcp relay release client-ip client-mac [ server-ip ] Required VI. Enable address check on a DHCP relay agent enabled interface When a client obtains an IP address from a DHCP server through a DHCP relay agent, the DHCP relay agent will record the MAC-IP mapping for the client. You can also configure static entries for clients. The DHCP relay agent security feature is designed to prevent unauthorized users from configuring static IP addresses and accessing other networks. If you enable this feature on a VLAN interface serving as a relay agent, the switch will check the validity of the user addresses on the interface. The DHCP relay agent inhibits a user from accessing external networks if the IP address and the MAC address of the user do not match any entries (including the dynamically recorded and manually configured entries) in the user address table maintained by the DHCP relay agent. Perform the following configuration in VLAN interface view to enable/disable DHCP address check on the VLAN interface: Enable address check on the VLAN interface Disable address check on the VLAN interface dhcp relay security address-check enable dhcp relay security address-check disable 3-5

30 Chapter 3 DHCP Relay Agent Configuration The address check is disabled on a relay agent-enabled VLAN interface by default. Caution: After the address check feature is enabled on a DHCP relay agent enabled VLAN interface, the client that has already obtained an IP address will lose its access right and has to apply for an IP address again. Therefore, it is recommended that the administrator should conduct this configuration before any user obtains an IP address. VII. Enabling refreshing of dynamic user address entries and specifying the refreshing interval When a DHCP client wants to release its IP address, it sends a DHCP-RELEASE unicast to the DHCP server through the DHCP relay agent. The DHCP relay agent simply conveys the message to the server without removing the entry of the client from the client entry table. To solve this problem, the system supports refreshing dynamic user address entries at a configurable interval. With this feature enabled, the DHCP relay agent sends DHCP-REQUEST packets periodically to the DHCP server using the recorded IP addresses and its own MAC address. A DHCP-ACK packet returned by the DHCP server indicates that the corresponding IP address is available for being assigned and therefore the DHCP relay agent ages out the corresponding entry in the user address table. A DHCP-NAK packet returned by the DHCP server indicates that the lease of the corresponding IP address has not expired, and therefore the DHCP relay agent does not age out the corresponding entry. The maximum times for a DHCP relay agent to send a DHCP-REQUEST packet to the DHCP server is three. If no response from the server is received after sending a handshake packet three times, the DHCP relay agent considers the IP address is available and ages out the corresponding entry in the user address table. If DHCP relay handshake is disabled, the DHCP relay agent does not send DHCP-REQUEST packets to the DHCP server periodically and the entries in the user address table do not age. As a result, the expired entries are unable to be removed in time. So, you can disable DHCP relay handshake only when absolutely needed. Follow these steps to configure the function of refreshing dynamic user address entries and the refreshing interval: 3-6