H3C S12500R Ethernet Switch Router Series Config Examples-Release 36xx-6W100

HomeSupportSwitchesS12500R SeriesConfigure & DeployConfiguration ExamplesH3C S12500R Ethernet Switch Router Series Config Examples-Release 36xx-6W100
Table of Contents
Related Documents
09-DHCP Snooping Configuration Examples
Title Size Download
09-DHCP Snooping Configuration Examples 106.83 KB

 

H3C S12500R Switch Router Series

DHCP Snooping Configuration Examples

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Copyright © 2021 New H3C Technologies Co., Ltd. All rights reserved.

No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of New H3C Technologies Co., Ltd.

Except for the trademarks of New H3C Technologies Co., Ltd., any trademarks that may be mentioned in this document are the property of their respective owners.

The information in this document is subject to change without notice.

 



Introduction

This document provides DHCP snooping configuration examples.

Prerequisites

The configuration examples in this document were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

This document assumes that you have basic knowledge of DHCP.

Example: Configuring DHCP snooping

Network configuration

As shown in Figure 1, three groups of hosts are connected to the DHCP server through the DHCP snooping devices. Configure DHCP snooping and DHCP server to meet the following requirements:

·     Hosts in each group obtain IP addresses from the address range assigned to the group. Assign address ranges to the groups as follows:

¡     Address range 192.168.0.2 to 192.168.0.39 for Group 1.

¡     Address range 192.168.0.40 to 192.168.0.99 for Group 2.

¡     Address range 192.168.0.100 to 192.168.0.200 for Group 3.

·     The hosts can obtain IP addresses only from the authorized DHCP server.

·     The hosts cannot access the network through IP addresses that are manually configured.

Figure 1 Network diagram

 

Analysis

To meet the network requirements, you must perform the following tasks:

·     To make sure the hosts in each group obtain IP addresses from the address range assigned to the group, perform the following tasks:

¡     Configure Option 82 on the DHCP snooping devices.

¡     Create DHCP user classes for the groups and configure match rules based on Option 82 to match the groups on the DHCP server.

·     To make sure the hosts obtain addresses only from the authorized DHCP server, configure ports facing the server as trusted and other ports as untrusted, as shown in Figure 2.

·     To prevent illegal users from using manually configured IP addresses to access the network, perform the following tasks:

¡     Enable ARP detection in the VLANs where the groups reside to check user validity based on DHCP snooping entries.

¡     Enable recording of client information in DHCP snooping entries. To save system resources, you can enable only untrusted ports directly connected to hosts to record DHCP snooping entries, as shown in Figure 2.

Figure 2 Trusted and untrusted ports

 

Software versions used

This configuration example was created and verified on Release 3606.

Restrictions and guidelines

By default, interfaces on the device are disabled (in ADM or Administratively Down state). To have an interface operate, you must use the undo shutdown command to enable that interface.

To ensure correct DHCP address allocation by using Option 82, you must perform Option 82 configuration on the DHCP server and the DHCP snooping devices.

Procedures

Configuring Device A

# Enable DHCP snooping.

<DeviceA> system-view

[DeviceA] dhcp snooping enable

# Enable recording of client information in DHCP snooping entries on interface HundredGigE 1/0/1.

[DeviceA] interface hundredgige 1/0/1

[DeviceA-HundredGigE1/0/1] port link-mode bridge

[DeviceA-HundredGigE1/0/1] dhcp snooping binding record

# Enable DHCP snooping to support Option 82 on HundredGigE 1/0/1. Configure the padding content for the Circuit ID sub-option as group1.

[DeviceA-HundredGigE1/0/1] dhcp snooping information enable

[DeviceA-HundredGigE1/0/1] dhcp snooping information circuit-id string group1

[DeviceA-HundredGigE1/0/1] quit

# Configure HundredGigE 1/0/2 as a trusted port.

[DeviceA] interface hundredgige 1/0/2

[DeviceA-HundredGigE1/0/2] port link-mode bridge

[DeviceA-HundredGigE1/0/2] dhcp snooping trust

[DeviceA-HundredGigE1/0/2] quit

# Enable ARP attack detection for user validity check.

[DeviceA] vlan 1

[DeviceA-vlan1] arp detection enable

[DeviceA-vlan1] quit

# Configure HundredGigE1/0/2 as an ARP trusted port. By default, an interface is an ARP untrusted port.

[DeviceA] interface hundredgige 1/0/2

[DeviceA-HundredGigE1/0/2] arp detection trust

[DeviceA-HundredGigE1/0/2] quit

Configuring Device B

# Enable DHCP snooping.

<DeviceB> system-view

[DeviceB] dhcp snooping enable

# Enable recording of client information in DHCP snooping entries on HundredGigE 1/0/1.

[DeviceB] interface hundredgige 1/0/1

[DeviceB-HundredGigE1/0/1] port link-mode bridge

[DeviceB-HundredGigE1/0/1] dhcp snooping binding record

# Enable DHCP snooping to support Option 82 on interface HundredGigE 1/0/1. Configure the padding content for the Circuit ID sub-option as group2.

[DeviceB-HundredGigE1/0/1] dhcp snooping information enable

[DeviceB-HundredGigE1/0/1] dhcp snooping information circuit-id string group2

[DeviceB-HundredGigE1/0/1] quit

# Configure HundredGigE 1/0/2 as a trusted port.

[DeviceB] interface hundredgige 1/0/2

[DeviceB-HundredGigE1/0/2] port link-mode bridge

[DeviceB-HundredGigE1/0/2] dhcp snooping trust

[DeviceB-HundredGigE1/0/2] quit

# Enable recording of client information in DHCP snooping entries on HundredGigE1/0/3.

[DeviceB] interface hundredgige 1/0/3

[DeviceB-HundredGigE1/0/3] port link-mode bridge

[DeviceB-HundredGigE1/0/3] dhcp snooping binding record

# Enable DHCP snooping to support Option 82 on HundredGigE 1/0/3. Configure the padding content for the Circuit ID sub-option as group3.

[DeviceB-HundredGigE1/0/3] dhcp snooping information enable

[DeviceB-HundredGigE1/0/3] dhcp snooping information circuit-id string group3

[DeviceB-HundredGigE1/0/3] quit

# Enable ARP attack detection for user validity check.

[DeviceB] vlan 1

[DeviceB-vlan1] arp detection enable

[DeviceB-vlan1] quit

# Configure HundredGigE 1/0/2 as an ARP trusted port. By default, an interface is an ARP untrusted port.

[DeviceB] interface HundredGigE 1/0/2

[DeviceB-HundredGigE1/0/2] arp detection trust

[DeviceB-HundredGigE1/0/2] quit

Configuring Device C

# Enable DHCP snooping.

<DeviceC> system-view

[DeviceC] dhcp snooping enable

# Configure HundredGigE 1/0/2 as a trusted port.

[DeviceC] interface hundredgige 1/0/2

[DeviceC-HundredGigE1/0/2] port link-mode bridge

[DeviceC-HundredGigE1/0/2] dhcp snooping trust

[DeviceC-HundredGigE1/0/2] quit

Configuring Device D

# Assign an IP address to HundredGigE 1/0/1.

[DeviceD] interface hundredgige 1/0/1

[DeviceD-HundredGigE1/0/1] dhcp select server

[DeviceD-HundredGigE1/0/1] quit

# Enable DHCP.

[DeviceD] dhcp enable

# Enable DHCP server on HundredGigE 1/0/1.

[DeviceD] interface hundredgige 1/0/1

[DeviceD-HundredGigE1/0/1] dhcp select server

[DeviceD-HundredGigE1/0/1] quit

# Create DHCP user class group1 for hosts in Group 1. Configure a match rule to match DHCP requests in which the third to eighth bytes of Option 82 is 0x67726F757031. The string 0x67726F757031 indicates that the content of the Circuit ID sub-option is group1.

[DeviceD] dhcp class group1

[DeviceD-dhcp-class-group1] if-match option 82 hex 67726F757031 offset 2 length 6

[DeviceD-dhcp-class-group1] quit

# Create DHCP user class group2 for hosts in Group 2. Configure a match rule to match DHCP requests in which the third to eighth bytes of Option 82 is 0x67726F757032. The string 0x67726F757032 indicates that the content of the Circuit ID sub-option is group2.

[DeviceD] dhcp class group2

[DeviceD-dhcp-class-group2] if-match option 82 hex 67726F757032 offset 2 length 6

[DeviceD-dhcp-class-group2] quit

# Create DHCP user class group3 for hosts in Group 3. Configure a match rule to match DHCP requests in which the third to eighth bytes of Option 82 is 0x67726F757033. The string 0x67726F757033 indicates that the content of the Circuit ID sub-option is group3.

[DeviceD] dhcp class group3

[DeviceD-dhcp-class-group3] if-match option 82 hex 67726F757033 offset 2 length 6

[DeviceD-dhcp-class-group3] quit

# Create an IP address pool.

[DeviceD] ip pool 1

# Specify the subnet for dynamic address allocation.

[DeviceD-ip-pool-1] network 192.168.0.0 mask 255.255.255.0

# Specify address range 192.168.0.2 to 192.168.0.39 for DHCP user class group1.

[DeviceD-ip-pool-1] class group1 range 192.168.0.2 192.168.0.39

# Specify address range 192.168.0.40 to 192.168.0.99 for DHCP user class group2.

[DeviceD-ip-pool-1] class group2 range 192.168.0.40 192.168.0.99

# Specify address range 192.168.0.100 to 192.168.0.200 for DHCP user class group3.

[DeviceD-ip-pool-1] class group3 range 192.168.0.100 192.168.0.200

# Apply the IP address pool to HundredGigE 1/0/1.

[DeviceD] interface hundredgige 1/0/1

[DeviceD-HundredGigE1/0/1] dhcp server apply ip-pool 1

[DeviceD-HundredGigE1/0/1] quit

Verifying the configuration

# Verify that the hosts in each group can obtain IP addresses from the address range assigned to the group. This example uses a host in Group 2 to verify the configuration.

C:\Documents and Settings\Administrator>ipconfig

 

Windows IP Configuration

 

 

Ethernet adapter bb:

 

   Connection-specific DNS Suffix  . :

   IP Address. . . . . . . . . . . . : 192.168.0.44

   Subnet Mask . . . . . . . . . . . : 255.255.255.0

   Default Gateway . . . . . . . . . :

# Manually assign IP address 192.168.0.66 to a host in Group 2, and verify that it cannot access the external network. (Details not shown.)

Configuration files

·     Device A:

#

 dhcp snooping enable

#

vlan 1

 arp detection enable

#

interface HundredGigE1/0/1

 dhcp snooping binding record

 dhcp snooping information enable

 dhcp snooping information circuit-id string group1

 port link-mode bridge

#

interface HundredGigE1/0/2

 arp detection trust

 dhcp snooping trust

 port link-mode bridge

#

·     Device B:

#

 dhcp snooping enable

#

vlan 1

 arp detection enable

#

interface HundredGigE1/0/1

 dhcp snooping binding record

 dhcp snooping information enable

 dhcp snooping information circuit-id string group2

 port link-mode bridge

#

interface HundredGigE1/0/2

 arp detection trust

 dhcp snooping trust

 port link-mode bridge

#

interface HundredGigE1/0/3

 dhcp snooping binding record

 dhcp snooping information enable

 dhcp snooping information circuit-id string group3

 port link-mode bridge

#

·     Device C:

#

 dhcp snooping enable

#

interface HundredGigE1/0/2

 dhcp snooping trust

 port link-mode bridge

#

·     Device D:

#

 dhcp enable

#

dhcp class group1

 if-match option 82 hex 67726f757031 offset 2 length 6

#

dhcp class group2

 if-match option 82 hex 67726f757032 offset 2 length 6

#

dhcp class group3

 if-match option 82 hex 67726f757033 offset 2 length 6

#

ip pool 1

 network 192.168.0.0 mask 255.255.255.0

 class group1 range 192.168.0.2 192.168.0.39

 class group2 range 192.168.0.40 192.168.0.99

 class group3 range 192.168.0.100 192.168.0.200

#

interface HundredGigE1/0/1

 ip address 192.168.0.1 255.255.255.0

 dhcp server apply ip-pool 1

#

Related documentation

·     H3C S12500R Switch Router Series Layer 3—IP Services Configuration Guide-R3606

·     H3C S12500R Switch Router Series Layer 3—IP Services Command Reference-R3606

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网