DHCP Technology White Paper

Transcription

1 DHCP Technology White Paper Keywords: DHCP, DHCP server, DHCP relay agent, DHCP client, BOOTP client. Abstract: This document describes DHCP basic concepts and applications, as well as the main functions and operation of H3C low-end Ethernet switches acting as the DHCP clients, DHCP servers, and DHCP relay agents, which are developed by H3C Technology Co., Ltd (hereinafter referred to as H3C). Acronyms: Acronym Full spelling DHCP BOOTP ARP Dynamic Host Configuration Protocol Bootstrap Protocol Address Resolution Protocol Hangzhou H3C Technologies Co., Ltd. 1/20

2 Table of Contents 1 Overview Background Benefits Application Environment Restrictions Terminology Protocols and Standards Operation of DHCP DHCP Message Format DHCP Message Types DHCP Message Exchange Process H3C DHCP Devices DHCP Client Operation DHCP Server Operation DHCP Relay Agent Operation H3C DHCP Technical Characteristics Application Scenarios Summary and Prospects References Appendix Hangzhou H3C Technologies Co., Ltd. 2/20

3 1 Overview As defined in RFC 1521, the Dynamic Host Configuration Protocol (DHCP) is used to assign reusable IP addresses and configuration information to hosts. See Figure 1 for the position of DHCP in the TCP/IP protocol suite. Figure 1 Position of DHCP in the TCP/IP protocol suite DHCP is built on a client/server model. That is, a designated host (called a DHCP server) assigns network addresses and configuration parameters to networking devices or hosts (called DHCP clients). Figure 2 DHCP networking diagram In addition, the DHCP relay agent feature allows a DHCP server to assign configuration information to the DHCP clients that are located on different subnets. This document mainly describes the operation of DHCP and working process of H3C Hangzhou H3C Technologies Co., Ltd. 3/20

4 low-end Ethernet switches acting as DHCP clients, DHCP servers and DHCP relay agents. For detailed configurations and commands, refer to the operation and command manuals of your products; for information about DHCP snooping and DHCP security functions, refer to DHCP Security Features Technology White Paper. 1.1 Background Bootstrap Protocol (BOOTP) was development for the clients to obtain specific information through the communication with the remote server. It is mainly used for diskless clients to obtain such information as IP address, server IP address, startup image filename, and gateway IP address from a BOOTP server. However, BOOTP is used in a comparatively static environment, where each host gets a permanent network connection. The administrator needs to configure a BOOTP configuration file that contains specific parameters for each BOOTP client. This static allocation mechanism is applicable if the location of hosts keeps unchanged and the administrator has enough IP addresses to assign for each host. The fast expansion and growing complexity of networks, and the need for people to take laptops across networks result in scarce IP addresses assignable to hosts, and BOOTP used for static hosts fails to meet various requirements. To provide convenient network access and save IP address resources, DHCP was introduced by IETF to provide a mechanism for assigning IP addresses automatically. DHCP enhances BOOTP in the following two aspects: Using DHCP, a host can exchange messages with a DHCP server to obtain all requested configuration information, such as IP address, subnet mask, default gateway, WINS server IP address, and DNS server IP address. DHCP provides fast and dynamic IP address allocation. To implement dynamic address allocation, the administrator needs to configure a DHCP server to provide a group of IP addresses (called an address pool). Once a host is connected to the network, it communicates with the DHCP server to apply for an IP address. The DHCP server then selects an IP address from the address pool and assigns it to the host. Hangzhou H3C Technologies Co., Ltd. 4/20

5 1.2 Benefits DHCP has the following advantages: The network administrator can verify IP addresses and other configuration parameters without checking each host. An assigned IP address will not be allocated to another host. The network administrator can assign specific IP addresses to specific hosts. Multiple options can be configured in one DHCP address pool. You do not need to change a host s IP address when moving it across subnets. 1.3 Application Environment DHCP can implement dynamic allocation of network resources, and it mainly applies to the following cases: A large network needs centralized and simplified management. The hosts are more than the assignable IP addresses and it is impossible to assign a fixed IP address to each host, so lots of hosts need to acquire IP addresses dynamically through DHCP. Mobile devices on a network require convenient access and automatic configuration management. A few hosts need fixed IP addresses. You want to implement security management based on DHCP for access devices by simple configuration. 1.4 Restrictions If there are multiple DHCP servers, a DHCP server cannot judge whether an IP address has been assigned by other DHCP servers. A DHCP server cannot communicate with a host through a router, unless the router can forward DHCP messages. 1.5 Terminology DHCP server: A DHCP server assigns IP addresses and other configuration information to DHCP clients. Hangzhou H3C Technologies Co., Ltd. 5/20

6 DHCP client: A DHCP client dynamically obtains an IP address through DHCP. DHCP relay agent: A DHCP relay agent forwards DHCP messages between a DHCP server and a DHCP client that are located on different subnets. 1.6 Protocols and Standards RFC 951: Bootstrap Protocol (BOOTP) RFC 1497: BOOTP Vendor Information Extensions RFC 1542: Clarifications and Extensions for the Bootstrap Protocol RFC 2131: Dynamic Host Configuration Protocol RFC 2132: DHCP Options and BOOTP Vendor Extensions RFC 3046: DHCP Relay Agent Information Option 1.7 Operation of DHCP DHCP Message Format A DHCP client needs to exchange DHCP messages with a DHCP server to obtain an IP address and other configuration information. Figure 3 gives the DHCP message format. Figure 3 DHCP message format op: Message type defined in option field. 1 = REQUEST, 2 = REPLY. Htype, hlen: Hardware address type and length. Hangzhou H3C Technologies Co., Ltd. 6/20

7 hops: Number of relay agents a request message traveled. The value is incremented by one upon traveling through one DHCP relay agent. xid: Transaction ID, a random number chosen by the client to identify an IP address allocation. secs: Number of seconds elapsed since the client sent a DHCP request. flags: The leftmost bit is defined as the BROADCAST (B) flag. If this flag is set to 0, the DHCP server sent a reply back by unicast; if this flag is set to 1, the DHCP server sent a reply back by broadcast. The remaining bits of the flags field are reserved for future use. ciaddr: Client IP address. yiaddr: 'your' (client) IP address, assigned by the server. siaddr: Server IP address, from which the clients obtained configuration parameters. giaddr: The first relay agent IP address a request message traveled. chaddr: Client hardware address. sname: The server host name, from which the client obtained configuration parameters. file: Bootfile name and routing information, defined by the server to the client. options: Optional parameters field that is variable in length, which includes the message type, lease, DNS IP address, WINS IP address and so forth DHCP Message Types There are eight types of DHCP messages, as described in Table 1. Table 1 DHCP message types Message type DHCP-DISCOVER DHCP-OFFER DHCP-REQUEST DHCP-ACK DHCP-NAK Main functions Broadcast by a DHCP client to search for an available DHCP server on the network. Sent by a DHCP server as a reply to the DHCP-DISCOVER message, containing parameters requested by the client. Broadcast by a DHCP client to a DHCP server for requesting configuration parameters or extending the lease duration. Sent by a DHCP server to notify a client that the assigned IP address and configuration parameters can be used. Sent by a DHCP server to notify a client that the requested IP address is incorrect or the address lease has expired. Hangzhou H3C Technologies Co., Ltd. 7/20

8 Message type DHCP-RELEASE DHCP-DECLINE DHCP-INFORM Main functions Sent by a DHCP client to notify a DHCP server that it will not use the assigned IP address. Sent by a DHCP client to notify a DHCP server that the assigned IP address cannot be used due to an address conflict or other reasons. Sent by a DHCP client to request configuration parameters other than an IP address from a DHCP server DHCP Message Exchange Process To dynamically obtain a valid IP address, a DHCP client exchanges different messages at different phases with a DHCP server. Figure 4 shows how a client that is connected to a network for the first time obtains an IP address from a DHCP server. Figure 4 Dynamic IP address allocation process (1) The DHCP client broadcasts a DHCP-DISCOVER message to locate a DHCP server. All the hosts running TCP/IP receive the broadcast, but only DHCP servers send replies to the client. (2) Each DHCP server that received the DHCP-DISCOVER message offers an appropriate IP address and other configuration parameters to the client in a DHCP-OFFER message. Hangzhou H3C Technologies Co., Ltd. 8/20

9 (3) If several DHCP servers send DHCP-OFFER messages to the client, the client accepts the first received offer, and broadcasts a DHCP-REQUEST message to notify all the DHCP servers that it will use the IP address offered by the DHCP server. (4) Upon receiving the DHCP-REQUEST message from the DHCP client, the DHCP server returns a DHCP-ACK message, confirming that the IP address has been allocated to the client. And then, the DHCP client binds the obtained IP address to its network card. Except the server that the client selects, other DHCP servers reclaim the IP addresses offered to the client. 1.8 H3C DHCP Devices H3C devices support such DHCP features as BOOTP client, DHCP client, DHCP server, DHCP relay agent, and DHCP snooping. This document does not describe the DHCP snooping feature. For information about DHCP snooping, refer to DHCP Security Features Technology White Paper DHCP Client Operation A DHCP client obtains an IP address and other network parameters from a DHCP server. It is the initiator of a DHCP address allocation. As a DHCP client, the H3C low-end Ethernet switch works as follows: 1. Obtaining an IP address for the first time To obtain an IP address, the DHCP client does the following: Broadcasts a DHCP-DISCOVER message, Receives a DHCP-OFFER message, Broadcasts a DHCP-REQUEST message, Receives a DHCP-ACK message Checks the validity of the assigned IP address; if usable, the client uses this IP address; if not, (possibly due to an address conflict), it will request another IP address. For details, refer to DHCP Message Exchange Process. Hangzhou H3C Technologies Co., Ltd. 9/20

10 2. Updating an address lease A DHCP server assigns an IP address with a lease to a client. When the lease expires, the server reclaims the IP address. To extend the lease duration, a DHCP client needs to update the address lease. See Figure 5 for the lease update process of a client. Figure 5 Lease extension (1) After the half lease time elapses, the DHCP client will unicast a DHCP- REQUEST message to the DHCP server to extend the lease duration. Upon availability of the IP address, the DHCP server returns a DHCP-ACK message confirming that the client s lease duration has been extended, or a DHCP-NAK unicast denying the request. (2) If the client fails to extend the lease, it will broadcast another DHCP-REQUEST message at 87.5% of the lease time. The DHCP server will handle the request as above mentioned. 3. Obtaining the IP address after reboot After reboot, the DHCP client does not send a DHCP-DISCOVER message to the DHCP server; instead, it sends a DHCP-REQUEST message to obtain the previous IP address (which is filled in the Requested IP address field). If the DHCP server considers that this IP address is assignable, it replies with a DHCP-ACK message; if not, the DHCP server replies with a DHCP-NAK message. Upon receiving a DHCP- NAK message, the client sends a DHCP-DISCOVER message to obtain a new IP address, and the Requested IP address field is null. Hangzhou H3C Technologies Co., Ltd. 10/20

11 After the DHCP client obtains the IP address after reboot, it will extend the lease duration as described above DHCP Server Operation A DHCP server assigns IP addresses and other configuration parameters to DHCP clients from specific address pools. As a DHCP server, the H3C low-end Ethernet switch works as follows: 1. Creating and maintaining address pools DHCP address pools are created on a DHCP server by a network administrator. Upon receiving a DHCP request, the DHCP server selects an idle IP address and other parameters from an address pool and assigns them to the client. A DHCP server can have one or more DHCP address pools. DHCP address pools are classified into global address pools and interface address pools. A global address pool provides IP addresses for all the qualified clients, while an interface address pool only assigns IP addresses to directly connected clients. If both the global and interface address pools are configured, the DHCP server selects the interface address pool to assign an IP address to clients directly connected to the interface. DHCP address pools can also be classified into static address pools and dynamic address pools. A dynamic address pool contains a group of addresses, while a static address pool contains only one address. Note that: A DHCP global address pool can be either static or dynamic, but not both. That is, if it is configured as a dynamic address pool, you cannot statically bind any IP address to it. 2. Assigning an IP address to a client A DHCP server selects an IP address for a client in the following sequence: The IP address manually bound to the client s MAC address or ID The IP address that was ever assigned to the client The first assignable IP address found in a proper DHCP address pool The IP address that has passed its lease duration The IP address that was a conflict. Hangzhou H3C Technologies Co., Ltd. 11/20

12 If no IP address is available, the client will be prompted that no IP address is assignable. 3. Providing network configuration information To access the Internet, a DHCP client needs some other configuration parameters besides an IP address. For example, if a host wants to use domain names to access the Internet, it needs to know the IP address of the DNS server; if it wants to access a server or networking device on another network segment, it needs to know the IP address of the gateway. Therefore, you need to configure parameters such as domain name suffix, DNS server IP address, WINS server IP address, NetBIOS node type in DHCP address pools on a DHCP server. Then, when a client requests for a domain name suffix or a DNS server IP address, the DHCP server will reply with such information configured in an address pool. For information about DHCP options, refer to 6 Appendix in this document. 4. Handling DHCP client messages A DHCP server can receive five types of DHCP messages, DHCP-DISCOVER, DHCP-REQUEST, DHCP-DECLINE, DHCP-RELEASE, and DHCP-INFORM. It processes these messages as follows: (1) DHCP-DISCOVER Upon receiving a DHCP-DISCOVER message, a DHCP server first checks if there is an assignable IP address in the address pool. If yes, it selects a proper IP address, a lease, and other requested parameters and sends them in a DHCP-OFFER message to the client (these parameters have been configured on the DHCP server). If no, the DHCP server does not respond to the client, and sends a report to the system administrator. (2) DHCP-REQUEST A DHCP-REQUEST message can be generated in the following cases: A client responds to a DHCP-OFFER message from a DHCP server. A client requests again an IP address once assigned to it. A client extends the lease duration of a network address. Hangzhou H3C Technologies Co., Ltd. 12/20

13 If a DHCP-REQUEST message contains Option 54 (server identifier option), the message is a reply to a DHCP-OFFER message; otherwise, it is used for the other two cases. A DHCP server processes different DHCP-REQUEST messages in different ways. It returns a DHCP-ACK message to confirm a valid IP address. (3) DHCP-DECLINE If the assigned IP address is conflicting or not usable due to some other reason, a client sends a DHCP-DECLINE message. After the DHCP server receives this message, it marks the IP address as not available. (4) DHCP-RELEASE If a client wants to relinquish the assigned IP address, it sends a DHCP-RELEASE message to the DHCP server. Upon receiving this message, the DHCP server marks this IP address as not available, and maintains the initial parameters of the client for future use. (5) DHCP-INFORM A client sends a DHCP-INFORM message to request for network configuration information other than an IP address, such as DNS server IP address and gateway IP address. 5. Handling request for lease extension When half the lease time expires, the DHCP client sends a request to the DHCP server to extend the lease. If the requested IP address is usable, the DHCP server returns a DHCP-ACK message to the client and updates the lease timer of the IP address. 6. Setting or releasing reserved IP addresses Some IP addresses in a DHCP address pool can be reserved from allocation. 7. Detecting IP Address Conflicts Before assigning an IP address to a DHCP client, a DHCP server checks whether the address to be assigned is in use via sending ping packets. The DHCP server pings the IP address to be assigned. If the server gets no response Hangzhou H3C Technologies Co., Ltd. 13/20

14 within the specified period (500ms by default), the server will ping the IP address once again until the specified number of ping packets (twice by default) are sent. If still no response is received, the server will assign the IP address to the requesting client; otherwise, the system will report an error to the administrator. Detecting an IP address does not affect the responses of the DHCP server to other clients. 8. Configuring network parameters for the DHCP clients A DHCP server can have the following network parameters configured for clients: Gateway IP address DNS server Domain name of the client s network WINS server IP address NetBIOS node type DHCP Relay Agent Operation The DHCP clients on different subnets can obtain IP addresses from the same server via a DHCP relay agent for cost reduction and centralized management. See Figure 6 for the DHCP relay agent operation. Figure 6 DHCP relay agent operation A DHCP relay agent can mainly implement the following functions: 1. Correlating with a DHCP server group To improve network reliability, you can correlate a group of DHCP servers with a relay agent s interface. When the interface receives requests from clients, the relay agent will forward them to all the DHCP servers of the group. Hangzhou H3C Technologies Co., Ltd. 14/20

15 2. Handling DHCP messages Upon receiving a DHCP message, the DHCP relay agent will do the following: If the destination UDP port number is 67 and the op field is BOOTREQUEST(1), the message is a request sent by a DHCP client. Then the DHCP relay agent checks the giaddr field. If the field is , it pads this field with the IP address of the receiving interface, and then forwards the message to all the DHCP servers of the designated DHCP server group. If the destination UDP port number is 67 and the op field is BOOTREPLY(2), the message is a reply from a DHCP server. Then, the DHCP relay agent forwards the reply through the interface specified in the giaddr field. 3. Providing DHCP relay agent security feature A DHCP relay agent with security feature enabled can record IP-to-MAC bindings of DHCP clients (including dynamic or manual client entry addition, manual client entry deletion and query) and works together with the ARP module to block the unauthorized clients from accessing external networks. (1) Managing DHCP client address table All the valid clients are recorded in the DHCP relay agent s client address table. The IP addresses that are obtained through DHCP can be dynamically added into the table, while valid fixed IP addresses can be manually added. You can also delete and query the client address entries. (2) Blocking unauthorized clients from network access This function works together with the ARP module. Upon receiving an ARP request, the DHCP relay agent checks whether the source IP and MAC addresses match an entry in the client address table. If no match is found, the ARP packet is discarded. (3) DHCP client address entry aging When a DHCP client sends a DHCP-RELEASE unicast to a DHCP server to relinquish its IP address, the DHCP relay agent cannot refresh the DHCP client address table. To solve this problem, you can enable the DHCP relay agent handshake function and specify the dynamic client address entry update interval. Hangzhou H3C Technologies Co., Ltd. 15/20

16 With the handshake function, the DHCP relay agent uses the IP address of a client and the MAC address of the DHCP relay interface to regularly send a DHCP-REQUEST message to the DHCP server. Upon receiving the request, the DHCP server checks whether the requested IP address is assignable. If it is assignable, the DHCP server returns a DHCP-ACK message; otherwise, it returns a DHCP-NAK message. If a DHCP-ACK message is received, it indicates the IP address has been released. Then, the corresponding client entry is deleted; if a DHCP-NAK message is received, it indicates the IP address has not been released, and the DHCP relay agent keeps the corresponding client entry. 2 H3C DHCP Technical Characteristics The H3C DHCP implementation has the following characteristics: Full range of functionality, including DHCP client, DHCP relay agent, and DHCP server functions. Good serviceability and flexible networking schemes. Excellent availability and configurability. Interoperability with devices of mainstream vendors, such as Windows or Linux servers. Easy management, economical deployment and low cost. Hangzhou H3C Technologies Co., Ltd. 16/20

17 3 Application Scenarios Internet IP network DHCP client area 2 DHCP relay DHCP server group DHCP client area 1 Figure 7 DHCP comprehensive configuration example As shown in Figure 7, DHCP clients are located in different subnets. To improve reliability, configure a group of DHCP servers to assign IP addresses to DHCP clients. Moreover, configure security functions on the DHCP relay agent to prevent unauthorized clients from accessing external networks. Note that: Since a DHCP relay agent resides between clients and servers, you can only configure global address pools on the DHCP servers; otherwise, the clients cannot get IP addresses. If a VLAN interface has the DHCP client enabled, you cannot configure any secondary IP address on the interface. The IP address of the relay agent s interface that is directly connected to the DHCP clients must be on the same network segment as the DHCP server address pool, especially when multiple DHCP relay agents are deployed. Hangzhou H3C Technologies Co., Ltd. 17/20

18 4 Summary and Prospects The DHCP features of H3C are implemented based on RFC 2131 and RFC 2132, including DHCP client/bootp client, DHCP relay agent, and DHCP server. As the fast expansion and growing complexity of networks, DHCP will be used in various network environments. H3C has a series of products supporting DHCP features, providing complete, flexible and convenient networking schemes for customers. In addition, the DHCP snooping feature is also supported to provide Layer 2 security (refer to DHCP Security Features Technology White Paper for details). 5 References RFC 951: BOOTSTRAP PROTOCOL (BOOTP) RFC 1497: BOOTP Vendor Information Extensions RFC 2131: Dynamic Host Configuration Protocol (DHCP) RFC 2132: DHCP Options and BOOTP Vendor Extensions RFC 3046: DHCP Relay Agent Information Option H3C Low-end Ethernet Switches Configuration Examples: 1 DHCP Configuration Examples 6 Appendix Refer to Table 2 for the DHCP options supported by H3C low-end Ethernet switches. Table 2 DHCP Options supported by H3C low-end Ethernet switches Tag Name Description 0 Pad The pad option can be used to cause subsequent fields to align on word boundaries. 1 Subnet mask Specifies a subnet mask for the client 3 Gateways 6 Domain Name servers A list of routers, in preferential order, for the client to use. A list of Domain Name servers in preferential order. A Domain Name server enables the client to locate other computers on the network by name. Hangzhou H3C Technologies Co., Ltd. 18/20

19 Tag Name Description 12 Host name The host name of the client. 15 Domain name The domain name the client should use when resolving hostnames via the Domain Name System. 22 Max Datagram Size Reassembly The maximum size datagram that the client should be prepared to reassemble. 28 Broadcast Address 36 Ethernet Encapsulation 43 Vendor Specific Information 44 NBT Name servers 46 NBT Node Type 50 Requested IP Address 51 DHCP Address Lease Time 52 Option Overload 53 DHCP Message Type 54 Server Identifier 55 Parameter Request List 56 Message 57 Maximum DHCP Message Size The broadcast address in use on the client's subnet. A boolean value indicating whether or not the client should use Ethernet Version 2 or IEEE encapsulation if the interface is an Ethernet. Used by clients and servers to exchange vendor-specific information. A list of IP addresses, in preferential order, specifying RFC 1001/1002 NetBIOS name servers (NBNS). Allows NetBIOS over TCP/IP clients which are configurable to be configured as described in RFC 1001/1002. The value is specified as a single octet which identifies the client type as follows: 1 = B-node, 2 = P- node, 4 = M-node, 8 = This option is used in a client request (DHCP- DISCOVER) to allow the client to request that a particular IP address be assigned. Used in a client request (DHCP-DISCOVER or DHCP-REQUEST) to allow the client to request a lease time for the IP address. In a server reply (DHCP-OFFER), a DHCP server uses this option to specify the lease time it is willing to offer. This option is used to indicate that the DHCP 'sname' or 'file' fields are being overloaded by using them to carry DHCP options. Used to convey the type of the DHCP message. Used in DHCP-OFFER and DHCP- REQUEST messages, and may optionally be included in the DHCP-ACK and DHCP-NAK messages. Used by a DHCP client to request values for specified configuration parameters. This option is used by a DHCP server to provide an error message to a DHCP client in a DHCP-NAK message in the event of a failure. This option specifies the maximum length DHCP message that it is willing to accept. Hangzhou H3C Technologies Co., Ltd. 19/20

20 Tag Name Description 58 DHCP Renewal Time 59 DHCP Rebinding Time 60 Class Identifier 61 Client Identifier 66 TFTP server name 67 Bootfile name 81 Client FQDN The time interval from address assignment until the client transitions to the RENEWING state. The time interval from address assignment until the client transitions to the REBINDING state. Used by DHCP clients to optionally identify the type and configuration of DHCP client. This option is used by DHCP clients to specify their unique identifier. This option is used to identify a TFTP server when the 'sname' field in the DHCP header has been used for DHCP options. This option is used to identify a bootfile when the 'file' field in the DHCP header has been used for DHCP options. Used to convey the client's Fully Qualified Domain Name (FQDN), as well as information regarding DNS updates. 82 DHCP Relay Agent Information Option The option is inserted by the DHCP relay agent when forwarding client-originated DHCP packets to a DHCP server, it include a "circuit ID" and a "remote ID ". 150 TFTP server IP sub-option 1 This option is used to identify a TFTP server ip address. NCP-IP (Network Call Processor IP Address) 184 sub-option 2 sub-option 3 sub-option 4 AS-IP (Alternate Server IP Address) Voice VLAN Configuration Fail-Over Call Routing 255 End Signifies the end of vendor options in a bootp or dhcp packet. Hangzhou H3C Technologies Co., Ltd. 20/20