05-Network Connectivity

HomeSupportConfigure & DeployConfiguration GuidesH3C Access Controllers Configuration Guides(R5447P04)-6W10005-Network Connectivity
17-DHCP configuration
Title Size Download
17-DHCP configuration 684.61 KB

Contents

Configuring the DHCP server 1

About DHCP server 1

DHCP address assignment mechanisms· 1

Principles for selecting an address pool 2

IP address allocation sequence· 3

DHCP server tasks at a glance· 3

Creating a DHCP user class· 4

Configuring an address pool on the DHCP server 4

DHCP address pool tasks at a glance· 4

Creating a DHCP address pool 5

Specifying a primary subnet and multiple address ranges in a DHCP address pool 5

Specifying a primary subnet and multiple secondary subnets in a DHCP address pool 6

Configuring a static binding in a DHCP address pool 7

Specifying gateways for DHCP clients· 8

Specifying a domain name suffix for DHCP clients· 9

Specifying DNS servers for DHCP clients· 9

Specifying WINS servers and NetBIOS node type for DHCP clients· 9

Specifying BIMS server for DHCP clients· 10

Specifying the configuration file for DHCP client automatic configuration· 10

Specifying a server for DHCP clients· 11

Customizing DHCP options· 12

Configuring the DHCP user class whitelist 13

Binding gateways to DHCP server's MAC address· 14

Advertising subnets that are assigned to clients· 14

Applying an address pool to an interface· 15

Configuring a DHCP policy for dynamic assignment 16

Enabling DHCP· 16

Enabling the DHCP server on an interface· 17

Configuring IP address conflict detection· 17

Enabling handling of Option 82· 18

Configuring DHCP server compatibility· 18

Configuring the DHCP server to always broadcast responses· 18

Configuring the DHCP server to ignore BOOTP requests· 19

Configuring the DHCP server to send BOOTP responses in RFC 1048 format 19

Disabling Option 60 encapsulation in DHCP replies· 19

Setting the DSCP value for DHCP packets sent by the DHCP server 20

Configuring DHCP binding auto backup· 20

Enabling client offline detection on the DHCP server 21

Configuring address pool usage alarming· 21

Enabling DHCP logging on the DHCP server 21

Display and maintenance commands for DHCP server 22

DHCP server configuration examples· 23

Example: Configuring dynamic IP address assignment 23

Example: Configuring DHCP user class· 25

Example: Configuring DHCP user class whitelist 27

Example: Configuring primary and secondary subnets· 28

Troubleshooting DHCP server configuration· 29

Failure to obtain a non-conflicting IP address· 29

Configuring the DHCP relay agent 30

About DHCP relay agent 30

DHCP relay agent operation· 30

DHCP relay agent support for Option 82· 31

DHCP relay agent tasks at a glance· 31

Enabling DHCP· 32

Enabling the DHCP relay agent on an interface· 32

Specifying DHCP servers· 32

Specifying DHCP servers on a relay agent 32

Specifying DHCP servers in a DHCP relay address pool 33

Specifying a DHCP relay address pool for DHCP clients· 34

Configuring the DHCP relay agent security features· 34

Enabling the DHCP relay agent to record relay entries· 34

Enabling periodic refresh of dynamic relay entries· 35

Enabling DHCP starvation attack protection· 35

Enabling DHCP server proxy on the DHCP relay agent 36

Enabling client offline detection on the DHCP relay agent 36

Configuring the DHCP relay agent to release an IP address· 37

Configuring DHCP relay agent support for Option 82· 37

Setting the DSCP value for DHCP packets sent by the DHCP relay agent 38

Specifying the DHCP relay agent address for the giaddr field· 39

Manually specifying the DHCP relay agent address for the giaddr field· 39

Configuring smart relay to specify the DHCP relay agent address for the giaddr field· 39

Specifying the source IP address for relayed DHCP requests· 40

Display and maintenance commands for DHCP relay agent 40

DHCP relay agent configuration examples· 41

Example: Configuring the DHCP relay agent 41

Troubleshooting DHCP relay agent configuration· 42

Failure of DHCP clients to obtain configuration parameters through the DHCP relay agent 42

Configuring the DHCP client 43

About DHCP client 43

Restrictions and guidelines: DHCP client configuration· 43

DHCP client tasks at a glance· 43

Enabling the DHCP client on an interface· 43

Configuring a DHCP client ID for an interface· 44

Enabling duplicated address detection· 44

Setting the DSCP value for DHCP packets sent by the DHCP client 45

Display and maintenance commands for DHCP client 45

Configuring DHCP snooping· 46

About DHCP snooping· 46

Application of trusted and untrusted ports· 46

DHCP snooping support for Option 82· 47

Restrictions and guidelines: DHCP snooping configuration· 48

DHCP snooping tasks at a glance· 48

Configuring basic DHCP snooping features· 48

Configuring DHCP snooping support for Option 82· 49

Configuring DHCP snooping entry auto backup· 50

Setting the maximum number of DHCP snooping entries· 51

Configuring DHCP packet rate limit 51

Configuring DHCP snooping security features· 52

Enabling DHCP starvation attack protection· 52

Enabling DHCP-REQUEST attack protection· 52

Configuring a DHCP packet blocking port 53

Enabling DHCP snooping logging· 53

Display and maintenance commands for DHCP snooping· 54

DHCP snooping configuration examples· 54

Example: Configuring basic DHCP snooping features· 54

Configuring the BOOTP client 56

About BOOTP client 56

BOOTP client application· 56

Obtaining an IP address dynamically· 56

Protocols and standards· 56

Configuring an interface to use BOOTP for IP address acquisition· 56

Display and maintenance commands for BOOTP client 57

 


Configuring the DHCP server

About DHCP server

A DHCP server manages a pool of IP addresses and client configuration parameters. It selects an IP address and configuration parameters from the address pool and allocates them to a requesting DHCP client.

DHCP address assignment mechanisms

Configure the following address assignment mechanisms as needed:

·     Static address allocation—Manually bind the MAC address or ID of a client to an IP address in a DHCP address pool. When the client requests an IP address, the DHCP server assigns the IP address in the static binding to the client.

·     Dynamic address allocation—Specify IP address ranges in a DHCP address pool. Upon receiving a DHCP request, the DHCP server dynamically selects an IP address from the matching IP address range in the address pool.

You can specify IP address ranges in an address pool by using either of the following methods:

·     Method 1A primary subnet being divided into multiple address ranges in an address pool

·     Method 2A primary subnet and multiple secondary subnets in an address pool

A primary subnet being divided into multiple address ranges in an address pool

An address range includes a common IP address range and IP address ranges for DHCP user classes.

Upon receiving a DHCP request, the DHCP server finds a user class matching the client and selects an IP address in the address range of the user class for the client. A user class can include multiple matching rules, and a client matches the user class as long as it matches any of the rules. In address pool view, you can specify different address ranges for different user classes.

The DHCP server selects an IP address for a client by performing the following steps:

1.     DHCP server compares the client against DHCP user classes in the order they are configured.

2.     If the client matches a user class, the DHCP server selects an IP address from the address range of the user class.

3.     If the matching user class has no assignable addresses, the DHCP server compares the client against the next user class. If all the matching user classes have no assignable addresses, the DHCP server selects an IP address from the common address range.

4.     If the DHCP client does not match any DHCP user class, the DHCP server selects an address in the IP address range specified by the address range command. If the address range has no assignable IP addresses or it is not configured, the address allocation fails.

 

 

NOTE:

All address ranges must belong to the primary subnet. If an address range does not reside on the primary subnet, DHCP cannot assign the addresses in the address range.

A primary subnet and multiple secondary subnets in an address pool

The DHCP server selects an IP address from the primary subnet first. If there is no assignable IP address on the primary subnet, the DHCP server selects an IP address from secondary subnets in the order they are configured.

Principles for selecting an address pool

The DHCP server observes the following principles to select an address pool for a client:

1.     If there is an address pool where an IP address is statically bound to the MAC address or ID of the client, the DHCP server selects this address pool and assigns the statically bound IP address and other configuration parameters to the client.

2.     If the receiving interface has a DHCP policy and the DHCP client matches a user class, the DHCP server selects the address pool that is bound to the matching user class. If no matching user class is found, the server assigns an IP address and other parameters from the default DHCP address pool. If no default address pool is specified or the default address pool does not have assignable IP addresses, the address assignment fails.

3.     If the receiving interface has an address pool applied, the DHCP server selects an IP address and other configuration parameters from this address pool.

4.     If the above conditions are not met, the DHCP server selects an address pool depending on the client location.

¡     Client on the same subnet as the server—The DHCP server compares the IP address of the receiving interface with the primary subnets of all address pools.

-     If a match is found, the server selects the address pool with the longest-matching primary subnet.

-     If no match is found, the DHCP server compares the IP address with the secondary subnets of all address pools. The server selects the address pool with the longest-matching secondary subnet.

¡     Client on a different subnet than the server—The DHCP server compares the IP address in the giaddr field of the DHCP request with the primary subnets of all address pools.

-     If a match is found, the server selects the address pool with the longest-matching primary subnet.

-     If no match is found, the DHCP server compares the IP address with the secondary subnets of all address pools. The server selects the address pool with the longest-matching secondary subnet.

For example, two address pools 1.1.1.0/24 and 1.1.1.0/25 are configured but not applied to any DHCP server's interfaces.

·     If the IP address of the receiving interface is 1.1.1.1/25, the DHCP server selects the address pool 1.1.1.0/25. If the address pool has no available IP addresses, the DHCP server will not select the other pool and the address allocation will fail.

·     If the IP address of the receiving interface is 1.1.1.130/25, the DHCP server selects the address pool 1.1.1.0/24.

To ensure correct address allocation, keep the IP addresses used for dynamic allocation on one of the subnets:

·     Clients on the same subnet as the server—Subnet where the DHCP server receiving interface resides.

·     Clients on a different subnet than the serverSubnet where the first DHCP relay interface that faces the clients resides.

 

 

NOTE:

As a best practice, configure a minimum of one matching primary subnet in your network. Otherwise, the DHCP server selects only the first matching secondary subnet for address allocation. If the network has more DHCP clients than the assignable IP addresses in the secondary subnet, not all DHCP clients can obtain IP addresses.

IP address allocation sequence

The DHCP server selects an IP address for a client in the following sequence:

1.     IP address statically bound to the client's MAC address or ID.

2.     IP address that was ever assigned to the client.

3.     IP address designated by the Option 50 field in the DHCP-DISCOVER message sent by the client.

Option 50 is the Requested IP Address option. The client uses this option to specify the wanted IP address in a DHCP-DISCOVER message. The content of Option 50 is user defined.

4.     First assignable IP address found in the way discussed in "DHCP address assignment mechanisms" and "Principles for selecting an address pool."

5.     IP address that was a conflict or passed its lease duration. If no IP address is assignable, the server does not respond.

 

 

NOTE:

·     If a client moves to another subnet, the DHCP server selects an IP address in the address pool matching the new subnet. It does not assign the IP address that was once assigned to the client.

·     Conflicted IP addresses can be assigned to other DHCP clients only after the addresses are in conflict for an hour.

DHCP server tasks at a glance

To configure the DHCP server, perform the following tasks:

1.     (Optional.) Creating a DHCP user class

2.     Configuring an address pool on the DHCP server

3.     (Optional.) Modifying the address pool selection method on the DHCP server

¡     Applying an address pool to an interface

¡     Configuring a DHCP policy for dynamic assignment

4.     Enabling DHCP

5.     Enabling the DHCP server on an interface

6.     (Optional.) Configuring advanced DHCP features

¡     Configuring IP address conflict detection

¡     Enabling handling of Option 82

¡     Configuring DHCP server compatibility

¡     Setting the DSCP value for DHCP packets sent by the DHCP server

¡     Configuring DHCP binding auto backup

¡     Enabling client offline detection on the DHCP server

7.     (Optional.) Configuring SNMP notification and logging

¡     Configuring address pool usage alarming

¡     Enabling DHCP logging on the DHCP server

Creating a DHCP user class

About this task

The DHCP server classifies DHCP users into different user classes according to the hardware address, option information, or the giaddr field in the received DHCP requests. The server allocates IP addresses and configuration parameters to DHCP clients in different user classes.

Procedure

1.     Enter system view.

system-view

2.     Create a DHCP user class and enter DHCP user class view.

dhcp class class-name

3.     Configure a match rule for the DHCP user class.

if-match rule rule-number { hardware-address hardware-address mask hardware-address-mask | option option-code [ ascii ascii-string [ offset offset | partial ] | hex hex-string [ mask mask | offset offset length length | partial ] ] | relay-agent gateway-address }

By default, no match rule is configured for a DHCP user class.

Configuring an address pool on the DHCP server

DHCP address pool tasks at a glance

To configure a DHCP address pool, perform the following tasks:

1.     Creating a DHCP address pool

2.     Specifying IP address ranges in a DHCP address pool

In one DHCP address pool, the two dynamic allocation methods cannot be both configured, but static and dynamic address allocations can be both implemented.

¡     Specifying a primary subnet and multiple address ranges in a DHCP address pool

¡     Specifying a primary subnet and multiple secondary subnets in a DHCP address pool

¡     Configuring a static binding in a DHCP address pool

3.     Specifying other configuration parameters to be assigned to DHCP clients

¡     Specifying gateways for DHCP clients

¡     Specifying a domain name suffix for DHCP clients

¡     Specifying DNS servers for DHCP clients

¡     Specifying WINS servers and NetBIOS node type for DHCP clients

¡     Specifying BIMS server for DHCP clients

¡     Specifying the configuration file for DHCP client automatic configuration

¡     Specifying a server for DHCP clients

¡     Customizing DHCP options

4.     (Optional.) Configuring the DHCP user class whitelist

5.     (Optional.) Binding gateways to DHCP server's MAC address

6.     (Optional.) Advertising subnets that are assigned to clients

Creating a DHCP address pool

1.     Enter system view.

system-view

2.     Create a DHCP address pool and enter its view.

dhcp server ip-pool pool-name

Specifying a primary subnet and multiple address ranges in a DHCP address pool

About this task

Some scenarios need to classify DHCP clients on the same subnet into different address groups. To meet this need, you can configure DHCP user classes and specify different address ranges for the classes. The clients matching a user class can then get the IP addresses of an address range. In addition, you can specify a common address range for the clients that do not match any user class. If no common address range is specified, such clients fail to obtain IP addresses.

If there is no need to classify clients, you do not need to configure DHCP user classes or their address ranges.

Restrictions and guidelines

When you configure DHCP address allocation, follow these restrictions and guidelines:

·     If you execute the network or address range command multiple times for the same address pool, the most recent configuration takes effect.

·     You can repeat the address range command to specify different address ranges for different user classes.

·     You can repeat the forbidden-ip command or the forbidden-ip-range command to exclude multiple addresses or address ranges from DHCP allocation.

·     The forbidden-ip and forbidden-ip-range commands take effect only on the IP pool for which the commands are executed. IP addresses specified by the dhcp server forbidden-ip command are not assignable in any address pool.

·     You can use class range to modify an existing address range, and the new address range can include IP addresses that are being used by clients. Upon receiving a lease extension request for such an IP address, the DHCP server allocates a new IP address to the requesting client. But the original lease continues aging in the address pool, and will be released when the lease duration is reached. To release such lease without waiting for its timeout, execute the reset dhcp server ip-in-use command.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify the primary subnet in the address pool.

network network-address [ mask-length | mask mask ]

By default, no primary subnet is specified.

4.     (Optional.) Specify the common address range.

address range start-ip-address end-ip-address

By default, no IP address range is specified.

5.     (Optional.) Specify an IP address range for a DHCP user class.

class class-name range start-ip-address end-ip-address

By default, no IP address range is specified for a user class.

The DHCP user class must already be created by using the dhcp class command.

6.     (Optional.) Set the address lease duration.

expired { day day [ hour hour [ minute minute [ second second ] ] ] | unlimited }

The default setting is 1 day.

7.     (Optional.) Exclude the specified IP addresses in the address pool from dynamic allocation.

forbidden-ip ip-address&<1-8>

By default, all IP addresses in the DHCP address pool are assignable.

8.     (Optional.) Exclude an IP range from dynamic allocation in the address pool.

forbidden-ip-range start-ip-address [ end-ip-address ]

By default, only the DHCP server IP address is not assignable in the address pool.

9.     (Optional.) Exclude the specified IP addresses from automatic allocation in system view.

a.     Return to system view.

quit

b.     Exclude the specified IP addresses from automatic allocation globally.

dhcp server forbidden-ip start-ip-address [ end-ip-address ]

By default, except for the IP address of the DHCP server interface, IP addresses in all address pools are assignable.

Specifying a primary subnet and multiple secondary subnets in a DHCP address pool

About this task

If an address pool has a primary subnet and multiple secondary subnets, the server assigns IP addresses on a secondary subnet when the primary subnet has no assignable IP addresses.

Restrictions and guidelines

IP addresses specified by the forbidden-ip command or the forbidden-ip-range command are not assignable in the current address pool, but are assignable in other address pools. IP addresses specified by the dhcp server forbidden-ip command are not assignable in any address pool.

Specifying a primary subnet and multiple secondary subnets

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify the primary subnet.

network network-address [ mask-length | mask mask ]

By default, no primary subnet is specified.

You can specify only one primary subnet in each address pool. If you execute the network command multiple times, the most recent configuration takes effect.

4.     (Optional.) Specify a secondary subnet.

network network-address [ mask-length | mask mask ] secondary

By default, no secondary subnet is specified.

You can specify a maximum of 32 secondary subnets in one address pool.

5.     (Optional.) Return to address pool view.

quit

Setting the lease duration for dynamically allocation IP addresses

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Set the address lease duration.

expired { day day [ hour hour [ minute minute [ second second ] ] ] | unlimited }

The default setting is 1 day.

Excluding IP addresses from dynamic allocation

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Exclude the specified IP addresses from dynamic allocation.

forbidden-ip ip-address&<1-8>

By default, all IP addresses in the DHCP address pool are assignable.

To exclude multiple addresses from dynamic allocation in the address pool, repeat this step.

4.     (Optional.) Exclude an IP range from dynamic allocation in the address pool.

forbidden-ip-range start-ip-address [ end-ip-address ]

By default, only the DHCP server IP address is not assignable in the address pool.

To exclude multiple address ranges from dynamic allocation in the address pool, repeat this step.

5.     (Optional.) Exclude the specified IP addresses from dynamic allocation in system view.

a.     Return to system view.

quit

b.     Exclude the specified IP addresses from dynamic allocation globally.

dhcp server forbidden-ip start-ip-address [ end-ip-address ]

By default, except for the IP address of the DHCP server interface, IP addresses in all address pools are assignable.

To exclude multiple address ranges globally, repeat this step.

Configuring a static binding in a DHCP address pool

About this task

Some DHCP clients, such as a WWW server, need fixed IP addresses. To provide a fixed IP address for a client, you can statically bind the MAC address or ID of the client to an IP address in a DHCP address pool. When the client requests an IP address, the DHCP server assigns the IP address in the static binding to the client.

Restrictions and guidelines

·     The IP address of a static binding cannot be the address of the DHCP server interface. Otherwise, an IP address conflict occurs and the bound client cannot obtain an IP address correctly.

·     Multiple interfaces on the same device might all use DHCP to request a static IP address. In this case, use client IDs rather than the device's MAC address to identify the interfaces. Otherwise, IP address allocation will fail.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Configure a static binding.

static-bind ip-address ip-address [ mask-length | mask mask ] { client-identifier client-identifier | hardware-address hardware-address [ ethernet | token-ring ] }

By default, no static binding is configured.

One IP address can be bound to only one client MAC or client ID. You cannot modify bindings that have been created. To change the binding for a DHCP client, you must delete the existing binding first.

4.     (Optional.) Set the lease duration for the IP address.

expired { day day [ hour hour [ minute minute [ second second ] ] ] | unlimited }

By default, the lease duration is 1 day.

Specifying gateways for DHCP clients

About this task

DHCP clients send packets destined for other networks to a gateway. The DHCP server can assign the gateway address to the DHCP clients.

Restrictions and guidelines

You can specify gateway addresses in each address pool on the DHCP server. A maximum of 64 gateways can be specified in DHCP address pool view or secondary subnet view.

The DHCP server assigns gateway addresses to clients on a secondary subnet in the following ways:

·     If gateways are specified in both address pool view and secondary subnet view, DHCP assigns those specified in the secondary subnet view.

·     If gateways are specified in address pool view but not in secondary subnet view, DHCP assigns those specified in address pool view.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify gateways.

gateway-list ip-address&<1-64>

By default, no gateway is specified.

4.     (Optional.) Specify gateways in secondary subnet view.

a.     Enter secondary subnet view.

network network-address [ mask-length | mask mask ] secondary

b.     Specify gateways.

gateway-list ip-address&<1-64>

By default, no gateway is specified.

Specifying a domain name suffix for DHCP clients

About this task

You can specify a domain name suffix in a DHCP address pool on the DHCP server. With this suffix assigned, the client only needs to input part of a domain name, and the system adds the domain name suffix for name resolution. For more information about DNS, see "Configuring DNS."

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify a domain name suffix.

domain-name domain-name

By default, no domain name is specified.

Specifying DNS servers for DHCP clients

About this task

To access hosts on the Internet through domain names, a DHCP client must contact a DNS server to resolve names. You can specify up to eight DNS servers in a DHCP address pool.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify DNS servers.

dns-list ip-address&<1-8>

By default, no DNS server is specified.

Specifying WINS servers and NetBIOS node type for DHCP clients

About this task

A Microsoft DHCP client using NetBIOS protocol must contact a WINS server for name resolution.

In addition, you must specify one of the following NetBIOS node types to approach name resolution:

·     b (broadcast)-node—A b-node client sends the destination name in a broadcast message. The destination returns its IP address to the client after receiving the message.

·     p (peer-to-peer)-node—A p-node client sends the destination name in a unicast message to the WINS server. The WINS server returns the destination IP address.

·     m (mixed)-node—An m-node client broadcasts the destination name. If it receives no response, it unicasts the destination name to the WINS server to get the destination IP address.

·     h (hybrid)-node—An h-node client unicasts the destination name to the WINS server. If it receives no response, it broadcasts the destination name to get the destination IP address.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

By default, no DHCP address pool exists.

3.     Specify WINS servers.

nbns-list ip-address&<1-8>

By default, no WINS server is specified.

This step is optional for b-node. You can specify a maximum of eight WINS servers for such clients in one DHCP address pool.

4.     Specify the NetBIOS node type.

netbios-type { b-node | h-node | m-node | p-node }

By default, no NetBIOS node type is specified.

Specifying BIMS server for DHCP clients

About this task

Perform this task to provide the BIMS server IP address, port number, and shared key for the clients. The DHCP clients contact the BIMS server to get configuration files and perform software upgrade and backup.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify the BIMS server IP address, port number, and shared key.

bims-server ip ip-address [ port port-number ] sharekey { cipher | simple } string

By default, no BIMS server information is specified.

Specifying the configuration file for DHCP client automatic configuration

About this task

Automatic configuration enables a device to automatically obtain a set of configuration settings at startup. The server-based automatic configuration requires the cooperation of the DHCP server and file server (TFTP or HTTP server). The device uses the obtained parameters to contact the file server to get the configuration file. For more information about automatic configuration, see Fundamentals Configuration Guide.

Specifying the configuration file on a TFTP file server

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

By default, no DHCP address pool exists.

3.     Specify the IP address or the name of a TFTP server.

¡     Specify the IP address of the TFTP server.

tftp-server ip-address ip-address

By default, no TFTP server IP address is specified.

¡     Specify the name of the TFTP server.

tftp-server domain-name domain-name

By default, no TFTP server name is specified.

4.     Specify the configuration file name.

bootfile-name bootfile-name

By default, no configuration file name is specified.

Specifying the URL of the configuration file on an HTTP file server

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify the URL of the configuration file.

bootfile-name url

By default, no configuration file URL is specified.

Specifying a server for DHCP clients

About this task

Some DHCP clients need to obtain configuration information from a server, such as a TFTP server. You can specify the IP address of that server. The DHCP server sends the server's IP address to DHCP clients along with other configuration information.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Specify the IP address of a server.

next-server ip-address

By default, no server is specified.

Customizing DHCP options

DHCP option customization applications

You can customize DHCP options for the following purposes:

·     Add newly released options.

·     Add options for which the vendor defines the contents, for example, Option 43.

·     Add options for which the CLI does not provide a dedicated configuration command. For example, you can use the option 4 ip-address 1.1.1.1 command to define the time server address 1.1.1.1 for DHCP clients.

·     Add all option values if the actual requirement exceeds the limit for a dedicated option configuration command. For example, the dns-list command can specify up to eight DNS servers. To specify more than eight DNS servers, you must use the option 6 command to define all DNS servers.

Common DHCP options

Table 1 lists common DHCP options and their parameters.

Table 1 Common DHCP options

Option

Option name

Corresponding command

Recommended parameter in the option command

3

Router Option

gateway-list

ip-address

6

Domain Name Server Option

dns-list

ip-address

15

Domain Name

domain-name

ascii

44

NetBIOS over TCP/IP Name Server Option

nbns-list

ip-address

46

NetBIOS over TCP/IP Node Type Option

netbios-type

hex

66

TFTP server name

tftp-server

ascii

67

Boot file name

bootfile-name

ascii

43

Vendor Specific Information

N/A

hex

Restrictions and guidelines

Use caution when customizing DHCP options because the configuration might affect DHCP operation.

You can customize a DHCP option in a DHCP address pool

You can customize a DHCP option in a DHCP option group, and specify the option group for a user class in an address pool. A DHCP client in the user class will obtain the option configuration.

Customizing a DHCP option in a DHCP address pool

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Customize a DHCP option.

option code { ascii ascii-string | hex hex-string | ip-address ip-address&<1-8> }

By default, no DHCP option is customized in a DHCP address pool.

DHCP options specified in DHCP option groups take precedence over those specified in DHCP address pools.

Customizing a DHCP option in a DHCP option group

1.     Enter system view.

system-view

2.     Create a DHCP option group and enter DHCP option group view.

dhcp option-group option-group-number

3.     Customize a DHCP option.

option code { ascii ascii-string | hex hex-string | ip-address ip-address&<1-8> }

By default, no DHCP option is customized in a DHCP option group.

If multiple DHCP option groups have the same option, the server selects the option in the DHCP option group first matching the user class.

4.     Return to system view.

quit

5.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

6.     Specify the DHCP option group for the DHCP user class.

class class-name option-group option-group-number

By default, no DHCP option group is specified for a DHCP user class.

The DHCP user class must already be created by using the dhcp class command.

Configuring the DHCP user class whitelist

About this task

The DHCP user class whitelist allows the DHCP server to process requests only from clients on the DHCP user class whitelist.

Restrictions and guidelines

The whitelist does not take effect on clients who request static IP addresses, and the server always processes their requests.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Enable the DHCP user class whitelist.

verify class

By default, the DHCP user class whitelist is disabled.

4.     Add DHCP user classes to the DHCP user class whitelist.

valid class class-name&<1-8>

By default, no DHCP user class is on the DHCP user class whitelist.

The DHCP user class must already be created by using the dhcp class command.

Binding gateways to DHCP server's MAC address

About this task

This feature enables the DHCP server to assign different gateway IP addresses to DHCP clients. In addition, the DHCP server uses the gateway IP addresses and the server's MAC address to reply to ARP requests from the clients. An example network is PPPoE.

As shown in Figure 1, the DHCP server is configured on the access device that provides access for clients of different service types, such as broadband, IPTV, and IP telephone. The clients of different types obtain IP addresses on different subnets. For the clients to access the network, the access interface typically has no IP address configured. You must bind the gateways to the DHCP server's MAC address when specifying gateways for the DHCP clients.

Figure 1 Network diagram

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     Bind the gateways to the device's MAC address.

gateway-list ip-address&<1-64> export-route

By default, gateways are not bound to any MAC address.

Advertising subnets that are assigned to clients

About this task

This feature enables the route management module to advertise subnets assigned to DHCP clients. This feature achieves symmetric routing for traffic of the same host.

As shown in Figure 2, Router A and Router B act as both the DHCP server and the BRAS device. The BRAS devices send accounting packets to the RADIUS server. To enable the BRAS devices to collect correct accounting information for each RADIUS user, configure the DHCP server to advertise subnets assigned to clients. The upstream and downstream traffic of a RADIUS user will pass through the same BRAS device.

Figure 2 Network diagram

Procedure

1.     Enter system view.

system-view

2.     Create a DHCP address pool and enter its view.

dhcp server ip-pool pool-name

3.     Advertise subnets assigned to DHCP clients.

network network-address [ mask-length | mask mask ] export-route [ secondary ]

By default, the subnets assigned to DHCP clients are not advertised.

Applying an address pool to an interface

About this task

Perform this task to apply a DHCP address pool to an interface.

Upon receiving a DHCP request from the interface, the DHCP server performs address allocation in the following ways:

·     If a static binding is found for the client, the server assigns the static IP address and configuration parameters from the address pool that contains the static binding.

·     If no static binding is found for the client, the server uses the address pool applied to the interface for address and configuration parameter allocation.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Apply an address pool to the interface.

dhcp server apply ip-pool pool-name

By default, no address pool is applied to an interface.

If the applied address pool does not exist, the DHCP server fails to perform dynamic address allocation.

Configuring a DHCP policy for dynamic assignment

About this task

In a DHCP policy, each DHCP user class has a bound DHCP address pool. Clients matching different user classes obtain IP addresses and other parameters from different address pools. The DHCP policy must be applied to the interface that acts as the DHCP server. When receiving a DHCP request, the DHCP server compares the packet against the user classes in the order that they are configured.

·     If a matching user class is found and the bound address pool has assignable IP addresses, the server assigns an IP address and other parameters from the address pool. If the address pool does not have assignable IP addresses, the address assignment fails.

·     If no match is found, the server assigns an IP address and other parameters from the default DHCP address pool. If no default address pool is specified or the default address pool does not have assignable IP addresses, the address assignment fails.

For successful address assignment, make sure the applied DHCP policy and the bound address pools exist.

Restrictions and guidelines

A DHCP policy take effect only after it is applied to an interface.

Procedure

1.     Enter system view.

system-view

2.     Create a DHCP policy and enter DHCP policy view.

dhcp policy policy-name

3.     Specify a DHCP address pool for a DHCP user class.

class class-name ip-pool pool-name

By default, no address pool is specified for a user class.

The DHCP user class must already be created by using the dhcp class command.

4.     Specify the default DHCP address pool.

default ip-pool pool-name

By default, no default address pool is specified.

5.     Return to system view.

quit

6.     Enter interface view.

interface interface-type interface-number

7.     Apply the DHCP policy to the interface.

dhcp apply-policy policy-name

By default, no DHCP policy is applied to an interface.

Enabling DHCP

Restrictions and guideline

You must enable DHCP to make other DHCP configurations take effect.

Procedure

1.     Enter system view.

system-view

2.     Enable DHCP.

dhcp enable

By default, DHCP is disabled.

Enabling the DHCP server on an interface

About this task

Perform this task to enable the DHCP server on an interface. Upon receiving a DHCP request on the interface, the DHCP server assigns the client an IP address and other configuration parameters from a DHCP address pool.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable the DHCP server on the interface.

dhcp select server

By default, the DHCP server is enabled on the interface.

Configuring IP address conflict detection

About this task

Before assigning an IP address, the DHCP server pings that IP address.

·     If the server receives a response within the specified period, it selects and pings another IP address.

·     If it receives no response, the server continues to ping the IP address until the maximum number of ping packets are sent. If still no response is received, the server assigns the IP address to the requesting client. The DHCP client uses gratuitous ARP to perform IP address conflict detection.

Procedure

1.     Enter system view.

system-view

2.     (Optional.) Set the maximum number of ping packets to be sent for conflict detection.

dhcp server ping packets number

The default setting is one.

To disable IP address conflict detection, set the value to 0.

3.     (Optional.) Set the ping timeout time.

dhcp server ping timeout milliseconds

The default setting is 500 ms.

To disable IP address conflict detection, set the value to 0.

Enabling handling of Option 82

About this task

Perform this task to enable the DHCP server to handle Option 82. Upon receiving a DHCP request that contains Option 82, the DHCP server adds Option 82 into the DHCP response.

If you disable the DHCP to handle Option 82, it does not add Option 82 into the response message.

You must enable handling of Option 82 on both the DHCP server and the DHCP relay agent to ensure correct processing for Option 82. For information about enabling handling of Option 82 on the DHCP relay agent, see "Configuring DHCP relay agent support for Option 82."

Procedure

1.     Enter system view.

system-view

2.     Enable the server to handle Option 82.

dhcp server relay information enable

By default, handling of Option 82 is enabled.

Configuring DHCP server compatibility

Perform this task to enable the DHCP server to support DHCP clients that are incompliant with RFC.

Configuring the DHCP server to always broadcast responses

About this task

By default, the DHCP server broadcasts a response only when the broadcast flag in the DHCP request is set to 1. You can configure the DHCP server to ignore the broadcast flag and always broadcast a response. This feature is useful when some clients set the broadcast flag to 0 but do not accept unicast responses.

The DHCP server always unicasts a response in the following situations, regardless of whether this feature is configured or not:

·     The DHCP request is from a DHCP client that has an IP address (the ciaddr field is not 0).

·     The DHCP request is forwarded by a DHCP relay agent from a DHCP client (the giaddr field is not 0).

Procedure

1.     Enter system view.

system-view

2.     Enable the DHCP server to always broadcast all responses.

dhcp server always-broadcast

By default, the DHCP server reads the broadcast flag to decide whether to broadcast or unicast a response.

Configuring the DHCP server to ignore BOOTP requests

About this task

The lease duration of the IP addresses obtained by the BOOTP clients is unlimited. For some scenarios that do not allow unlimited leases, you can configure the DHCP server to ignore BOOTP requests.

Procedure

1.     Enter system view.

system-view

2.     Configure the DHCP server to ignore BOOTP requests.

dhcp server bootp ignore

By default, the DHCP server processes BOOTP requests.

Configuring the DHCP server to send BOOTP responses in RFC 1048 format

About this task

Not all BOOTP clients can send requests that are compatible with RFC 1048. By default, the DHCP server does not process the Vend field of RFC 1048-incompliant requests but copies the Vend field into responses.

This feature enables the DHCP server to fill the Vend field in RFC 1048-compliant format in DHCP responses to RFC 1048-incompliant requests sent by BOOTP clients.

Procedure

1.     Enter system view.

system-view

2.     Enable the DHCP server to send BOOTP responses in RFC 1048 format to the RFC 1048-incompliant BOOTP requests.

dhcp server bootp reply-rfc-1048

By default, the DHCP server directly copies the Vend field of such requests into the responses.

Disabling Option 60 encapsulation in DHCP replies

About this task

If one or more DHCP clients cannot resolve Option 60, disable the DHCP server from encapsulating Option 60 in DHCP replies. If you do not disable the capability, the DHCP server encapsulates Option 60 in a DHCP reply in the following situations:

·     The received DHCP packet contains Option 60.

·     Option 60 is configured for the address pool.

Procedure

1.     Enter system view.

system-view

2.     Disable the DHCP server from encapsulating Option 60 in DHCP replies.

dhcp server reply-exclude-option60

By default, the DHCP server can encapsulate Option 60 in DHCP replies.

Setting the DSCP value for DHCP packets sent by the DHCP server

About this task

The DSCP value of a packet specifies the priority level of the packet and affects the transmission priority of the packet.

Procedure

1.     Enter system view.

system-view

2.     Set the DSCP value for DHCP packets sent by the DHCP server.

dhcp dscp dscp-value

By default, the DSCP value in DHCP packets sent by the DHCP server is 56.

Configuring DHCP binding auto backup

About this task

The auto backup feature saves bindings to a backup file and allows the DHCP server to download the bindings from the backup file at the server reboot. The bindings include the lease bindings and conflicted IP addresses. They cannot survive a reboot on the DHCP server.

The DHCP server does not provide services during the download process. If a connection error occurs during the process and cannot be repaired in a short amount of time, you can terminate the download operation. Manual interruption allows the DHCP server to provide services without waiting for the connection to be repaired.

Procedure

1.     Enter system view.

system-view

2.     Configure the DHCP server to back up the bindings to a file.

dhcp server database filename { filename | url url [ username username [ password { cipher | simple } string ] ] }

By default, the DHCP server does not back up the DHCP bindings.

With this command executed, the DHCP server backs up its bindings immediately and runs auto backup.

3.     (Optional.) Manually save the DHCP bindings to the backup file.

dhcp server database update now

4.     (Optional.) Set the waiting time after a DHCP binding change for the DHCP server to update the backup file.

dhcp server database update interval interval

By default, the DHCP server waits 300 seconds to update the backup file after a DHCP binding change. If no DHCP binding changes, the backup file is not updated.

5.     (Optional.) Terminate the download of DHCP bindings from the backup file.

dhcp server database update stop

This command only triggers one termination.

Enabling client offline detection on the DHCP server

About this task

The client offline detection feature reclaims an assigned IP address and deletes the binding entry when the ARP entry for the IP address ages out.

Restrictions and guidelines

The feature does not function if an ARP entry is manually deleted.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable client offline detection.

dhcp client-detect

By default, client offline detection is disabled on the DHCP server.

Configuring address pool usage alarming

About this task

Perform this task to set the threshold for address pool usage alarming. When the threshold is exceeded, the system sends log messages to the information center. According to the log information, you can optimize the address pool configuration. For more information about the information center, see System Management Configuration Guide.

Procedure

1.     Enter system view.

system-view

2.     Enter DHCP address pool view.

dhcp server ip-pool pool-name

3.     (Optional.) Set the threshold for address pool usage alarming.

ip-in-use threshold threshold-value

The default threshold is 100%.

Enabling DHCP logging on the DHCP server

About this task

The DHCP logging feature enables the DHCP server to generate DHCP logs and send them to the information center. The information helps administrators locate and solve problems. For information about the log destination and output rule configuration in the information center, see System Management Configuration Guide.

Restrictions and guidelines

As a best practice, disable this feature if the log generation affects the device performance or reduces the address allocation efficiency. For example, this situation might occur when a large number of clients frequently come online or go offline.

Procedure

1.     Enter system view.

system-view

2.     Enable DHCP logging.

dhcp log enable

By default, DHCP logging is disabled.

Display and maintenance commands for DHCP server

IMPORTANT

IMPORTANT:

A restart of the DHCP server or execution of the reset dhcp server ip-in-use command deletes all lease information. The DHCP server denies any DHCP request for lease extension, and the client must request an IP address again.

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display information about IP address conflicts.

display dhcp server conflict [ ip ip-address ]

Display information about DHCP binding auto backup.

display dhcp server database

Display information about lease-expired IP addresses.

display dhcp server expired [ ip ip-address | pool pool-name ]

Display information about assignable IP addresses.

display dhcp server free-ip [ pool pool-name ]

Display information about assigned IP addresses.

display dhcp server ip-in-use [ ip ip-address | pool pool-name ]

Display information about DHCP address pools.

display dhcp server pool [ pool-name ]

Display DHCP server statistics.

display dhcp server statistics [ pool pool-name ]

Clear information about IP address conflicts.

reset dhcp server conflict [ ip ip-address ]

Clear information about lease-expired IP addresses.

reset dhcp server expired [ ip ip-address | pool pool-name ]

Clear information about assigned IP addresses.

reset dhcp server ip-in-use [ ip ip-address | pool pool-name ]

Clear DHCP server statistics.

reset dhcp server statistics

DHCP server configuration examples

The AP models and serial numbers in this document are used only as examples. Support for AP models and serial numbers depends on the AC model.

Example: Configuring dynamic IP address assignment

Network configuration

As shown in Figure 3, the DHCP server (AC) assigns IP addresses to the AP and DHCP clients on subnet 10.1.1.0/24, which is subnetted into 10.1.1.0/25 and 10.1.1.128/25.

Configure DHCP server on the AC to assign IP addresses on subnet 10.1.1.0/25 to the AP and IP addresses on subnet 10.1.1.128/25 to DHCP clients.

Figure 3 Network diagram

Procedure

1.     Configure VLANs and VLAN interfaces:

# Create VLAN 10 and VLAN 20.

<AC> system-view

[AC] vlan 10

[AC-vlan10] quit

[AC] vlan 20

[AC-vlan20] quit

# Add the interface connected to the AP to VLAN 10 and VLAN 20.

[AC] interface gigabitethernet 1/0/2

[AC-GigabitEthernet1/0/2] port link-type trunk

[AC-GigabitEthernet1/0/2] port trunk permit vlan 10 20

[AC-GigabitEthernet1/0/2] port trunk pvid vlan 10

[AC-GigabitEthernet1/0/2] quit

# Assign IP addresses to VLAN-interface 10 and VLAN-interface 20.

[AC] interface vlan-interface 10

[AC-Vlan-interface10] ip address 10.1.1.1 25

[AC-Vlan-interface10] quit

[AC] interface vlan-interface 20

[AC-Vlan-interface20] ip address 10.1.1.129 25

[AC-Vlan-interface20] quit

2.     Configure wireless services:

# Configure a service template and bind VLAN 20 to the service template.

[AC] wlan service-template service

[AC-wlan-st-service] ssid service

[AC-wlan-st-service] vlan 20

[AC-wlan-st-service] service-template enable

[AC-wlan-st-service] quit

# Configure the AP.

[AC] wlan ap ap1 model WA6320

[AC-wlan-ap-ap1] serial-id 219801A28N819CE0002T

[AC-wlan-ap-ap1] radio 1

[AC-wlan-ap-ap1-radio-1] service-template service

[AC-wlan-ap-ap1-radio-1] radio enable

[AC-wlan-ap-ap1-radio-1] quit

[AC-wlan-ap-ap1] quit

3.     Configure the DHCP server:

# Enable DHCP.

[AC] dhcp enable

# Enable the DHCP server on VLAN-interface 10 and VLAN-interface 20.

[AC] interface vlan-interface 10

[AC-Vlan-interface10] dhcp select server

[AC-Vlan-interface10] quit

[AC] interface vlan-interface 20

[AC-Vlan-interface20] dhcp select server

[AC-Vlan-interface20] quit

# Configure DHCP address pool 1 to assign IP addresses to the AP on subnet 10.1.1.0/25.

[AC] dhcp server ip-pool 1

[AC-dhcp-pool-1] network 10.1.1.0 mask 255.255.255.128

[AC-dhcp-pool-1] quit

# Configure DHCP address pool 2 to assign IP addresses to DHCP clients on subnet 10.1.1.128/25.

[AC] dhcp server ip-pool 2

[AC-dhcp-pool-2] network 10.1.1.128 mask 255.255.255.128

[AC-dhcp-pool-2] quit

Verifying the configuration

# Verify that the AP on subnet 10.1.1.0/25 and the DHCP clients on subnet 10.1.1.128/25 can obtain correct IP addresses from the DHCP server. (Details not shown.)

# On the DHCP server, display the IP addresses assigned to the AP and DHCP clients.

[AC] display dhcp server ip-in-use

IP address       Client identifier/    Lease expiration      Type

                 Hardware address

10.1.1.3         0031-3865-392e-6262-  Jan 1 22:25:03 2015   Auto(C)

                 3363-2e30-3230-352d-

                 4745-302f-30

10.1.1.130       3030-3030-2e30-3030-  Jan 9 10:45:11 2015   Auto(C)

                 662e-3030-3033-2d45-

                 7568-6572-1e

10.1.1.131       3030-0020-fe02-3020-  Jan 9 10:45:11 2015   Auto(C)

                 7052-0201-2013-1e02

                 0201-9068-23

10.1.1.132       2020-1220-1102-3021-  Jan 9 10:45:11 2015   Auto(C)

                 7e52-0211-2025-3402

                 0201-9068-9a

10.1.1.133       2021-d012-0202-4221-  Jan 9 10:45:11 2015   Auto(C)

                 8852-0203-2022-55e0

                 3921-0104-31

Example: Configuring DHCP user class

Network requirement

As shown in Figure 4, the DHCP relay agent (the switch) forwards DHCP packets between DHCP clients and the DHCP server (AC). Enable the switch to support Option 82 so that the switch can add Option 82 in the DHCP requests sent by the DHCP clients.

Configure the address allocation scheme as follows:

 

Assign IP addresses

To clients

10.10.1.2 to 10.10.1.10

The DHCP request contains Option 82.

10.10.1.11 to 10.10.1.26

The hardware address in the request is six bytes long and begins with aabb-aabb-aab.

 

For clients on subnet 10.10.1.0/24, the DNS server address is 10.10.1.20/24 and the gateway address is 10.10.1.254/24.

Figure 4 Network diagram

Procedure

1.     Assign IP addresses to interfaces on the DHCP server and DHCP relay agent. (Details not shown.)

Configure basic settings on the AC. For more information, see WLAN Access Configuration Guide.

2.     Configure DHCP services:

# Enable DHCP and configure the DHCP server to handle Option 82.

<AC> system-view

[AC] dhcp enable

[AC] dhcp server relay information enable

# Enable DHCP server on VLAN-interface10.

[AC] interface vlan-interface 10

[AC-Vlan-interface10] dhcp select server

[AC-Vlan-interface10] quit

# Create DHCP user class tt and configure a match rule to match client requests with Option 82.

[AC] dhcp class tt

[AC-dhcp-class-tt] if-match rule 1 option 82

[AC-dhcp-class-tt] quit

# Create DHCP user class ss and configure a match rule to match DHCP requests in which the hardware address is six bytes long and begins with aabb-aabb-aab.

[AC] dhcp class ss

[AC-dhcp-class-ss] if-match rule 1 hardware-address aabb-aabb-aab0 mask ffff-ffff-fff0

[AC-dhcp-class-ss] quit

# Create DHCP address pool aa.

[AC] dhcp server ip-pool aa

# Specify the subnet for dynamic allocation.

[AC-dhcp-pool-aa] network 10.10.1.0 mask 255.255.255.0

# Specify the address range for dynamic allocation.

[AC-dhcp-pool-aa] address range 10.10.1.2 10.10.1.100

# Specify the address range for user class tt.

[AC-dhcp-pool-aa] class tt range 10.10.1.2 10.10.1.10

# Specify the address range for user class ss.

[AC-dhcp-pool-aa] class ss range 10.10.1.11 10.10.1.26

# Specify the gateway address and DNS server address.

[AC-dhcp-pool-aa] gateway-list 10.10.1.254

[AC-dhcp-pool-aa] dns-list 10.10.1.20

[AC-dhcp-pool-aa] quit

Verifying the configuration

# Verify that clients matching the user classes can obtain IP addresses in the specified ranges and all other configuration parameters from the DHCP server. (Details not shown.)

# Display the IP addresses assigned by the DHCP server.

[AC] display dhcp server ip-in-use

IP address       Client identifier/    Lease expiration      Type

                 Hardware address

10.10.1.2        0031-3865-392e-6262-  Jan 14 22:25:03 2015  Auto(C)

                 3363-2e30-3230-352d-

                 4745-302f-30

10.10.1.11       aabb-aabb-aab1        Jan 14 22:25:03 2015  Auto(C)

Example: Configuring DHCP user class whitelist

Network configuration

As shown in Figure 5, configure the DHCP user class whitelist to allow the DHCP server to assign IP addresses to clients whose hardware addresses are six bytes long and begin with aabb-aabb.

Figure 5 Network diagram

Procedure

1.     Assign IP addresses to the interfaces on the DHCP server. (Details not shown.)

Configure basic settings on the AC. For more information, see WLAN Access Configuration Guide.

2.     Configure DHCP:

# Enable DHCP.

<AC> system-view

[AC] dhcp enable

# Enable DHCP server on VLAN-interface 2.

[AC] interface vlan-interface 2

[AC-Vlan-interface2] dhcp select server

[AC-Vlan-interface2] quit

# Create DHCP user class ss and configure a match rule to match DHCP requests in which the hardware address is six bytes long and begins with aabb-aabb.

[AC] dhcp class ss

[AC-dhcp-class-ss] if-match rule 1 hardware-address aabb-aabb-0000 mask ffff-ffff-0000

[AC-dhcp-class-ss] quit

# Create DHCP address pool aa.

[AC] dhcp server ip-pool aa

# Specify the subnet for dynamic allocation.

[AC-dhcp-pool-aa] network 10.1.1.0 mask 255.255.255.0

# Enable DHCP user class whitelist.

[AC-dhcp-pool-aa] verify class

# Add DHCP user class ss to the DHCP user class whitelist.

[AC-dhcp-pool-aa] valid class ss

[AC-dhcp-pool-aa] quit

Verifying the configuration

# Verify that clients matching the DHCP user class can obtain IP addresses on subnet 10.1.1.0/24 from the DHCP server. (Details not shown.)

# On the DHCP server, display the IP addresses assigned to the clients.

[AC] display dhcp server ip-in-use

IP address       Client identifier/    Lease expiration      Type

                 Hardware address

10.1.1.2         aabb-aabb-ab01        Jan 14 22:25:03 2015  Auto(C)

Example: Configuring primary and secondary subnets

Network configuration

As shown in Figure 6, the DHCP server (AC) dynamically assigns IP addresses to clients in the LAN.

Configure two subnets in the address pool on the DHCP server: 10.1.1.0/24 as the primary subnet and 10.1.2.0/24 as the secondary subnet. The DHCP server selects IP addresses from the secondary subnet when the primary subnet has no assignable addresses.

The AC also assigns the following parameters:

·     The default gateway 10.1.1.254/24 to clients on subnet 10.1.1.0/24.

·     The default gateway 10.1.2.254/24 to clients on subnet 10.1.2.0/24.

Figure 6 Network diagram

Procedure

# Configure basic settings on the AC. For more information, see WLAN Access Configuration Guide.

# Enable DHCP

<AC> system-view

[AC] dhcp enable

# Configure the primary and secondary IP addresses of VLAN-interface 10.

[AC] interface vlan-interface 10

[AC-Vlan-interface10] ip address 10.1.1.1 24

[AC-Vlan-interface10] ip address 10.1.2.1 24 sub

# Enable the DHCP server on VLAN-interface 10.

[AC-Vlan-interface10] dhcp select server

[AC-Vlan-interface10] quit

# Create DHCP address pool aa.

[AC] dhcp server ip-pool aa

# Specify the primary subnet and the gateway for dynamic allocation.

[AC-dhcp-pool-aa] network 10.1.1.0 mask 255.255.255.0

[AC-dhcp-pool-aa] gateway-list 10.1.1.254

# Specify the secondary subnet and the gateway for dynamic allocation.

[AC-dhcp-pool-aa] network 10.1.2.0 mask 255.255.255.0 secondary

[AC-dhcp-pool-aa-secondary] gateway-list 10.1.2.254

[AC-dhcp-pool-aa-secondary] quit

[AC-dhcp-pool-aa] quit

Verifying the configuration

# Verify that the DHCP server assigns clients IP addresses and gateway address from the secondary subnet when no address is available from the primary subnet. (Details not shown.)

# Display the primary and secondary subnet IP addresses the DHCP server has assigned. The following is part of the command output.

[AC] display dhcp server ip-in-use

IP address       Client identifier/    Lease expiration      Type

                 Hardware address

10.1.1.2         0031-3865-392e-6262-  Jan 14 22:25:03 2015  Auto(C)

                 3363-2e30-3230-352d-

                 4745-302f-30

10.1.2.2         3030-3030-2e30-3030-  Jan 14 22:25:03 2015  Auto(C)

                 662e-3030-3033-2d45-

                 7568-6572-1e

Troubleshooting DHCP server configuration

Failure to obtain a non-conflicting IP address

Symptom

A client's IP address obtained from the DHCP server conflicts with an IP address of another host.

Solution

Another host on the subnet might have the same IP address.

To resolve the problem:

1.     Disable the client's network adapter or disconnect the client's network cable. Ping the IP address of the client from another host to check whether there is a host using the same IP address.

2.     If a ping response is received, the IP address has been manually configured on a host. Execute the dhcp server forbidden-ip command on the DHCP server to exclude the IP address from dynamic allocation.

3.     Enable the network adapter or connect the network cable, release the IP address, and obtain another one on the client. For example, to release the IP address and obtain another one on a Windows XP DHCP client:

a.     In Windows environment, execute the cmd command to enter the DOS environment.

b.     Enter ipconfig /release to relinquish the IP address.

c.     Enter ipconfig /renew to obtain another IP address.


Configuring the DHCP relay agent

About DHCP relay agent

The DHCP relay agent enables clients to get IP addresses and configuration parameters from a DHCP server on another subnet.

Figure 7 shows a typical application of the DHCP relay agent.

Figure 7 DHCP relay agent application

DHCP relay agent operation

The DHCP server and client interact with each other in the same way regardless of whether the relay agent exists.The following only describes steps related to the DHCP relay agent:

1.     After receiving a DHCP-DISCOVER or DHCP-REQUEST broadcast message from a DHCP client, the DHCP relay agent processes the message as follows:

a.     Fills the giaddr field of the message with its IP address.

b.     Unicasts the message to the designated DHCP server.

2.     Based on the giaddr field, the DHCP server returns an IP address and other configuration parameters in a response.

3.     The relay agent conveys the response to the client.

Figure 8 DHCP relay agent operation

DHCP relay agent support for Option 82

Option 82 records the location information about the DHCP client. It enables the administrator to perform the following tasks:

·     Locate the DHCP client for security and accounting purposes.

·     Assign IP addresses in a specific range to clients.

If the DHCP relay agent supports Option 82, it handles DHCP requests by following the strategies described in Table 2.

If a response returned by the DHCP server contains Option 82, the DHCP relay agent removes the Option 82 before forwarding the response to the client.

Table 2 Handling strategies of the DHCP relay agent

If a DHCP request has…

Handling strategy

The DHCP relay agent…

Option 82

Drop

Drops the message.

Keep

Forwards the message without changing Option 82.

Replace

Forwards the message after replacing the original Option 82 with the Option 82 padded according to the configured padding format, padding content, and code type.

No Option 82

N/A

Forwards the message after adding Option 82 padded according to the configured padding format, padding content, and code type.

DHCP relay agent tasks at a glance

To configure a DHCP relay agent, perform the following tasks:

1.     Enabling DHCP

2.     Enabling the DHCP relay agent on an interface

3.     Specifying DHCP servers

4.     (Optional.) Specifying a DHCP relay address pool for DHCP clients

5.     (Optional.) Configuring the DHCP relay agent security features

6.     (Optional.) Configuring the DHCP relay agent to release an IP address

7.     (Optional.) Configuring DHCP relay agent support for Option 82

8.     (Optional.) Setting the DSCP value for DHCP packets sent by the DHCP relay agent

9.     (Optional.) Specifying the DHCP relay agent address for the giaddr field

10.     (Optional.) Specifying the source IP address for relayed DHCP requests

Enabling DHCP

Restrictions and guidelines

You must enable DHCP to make other DHCP relay agent settings take effect.

Procedure

1.     Enter system view.

system-view

2.     Enable DHCP.

dhcp enable

By default, DHCP is disabled.

Enabling the DHCP relay agent on an interface

About this task

With the DHCP relay agent enabled, an interface forwards incoming DHCP requests to a DHCP server.

An IP address pool that contains the IP address of the DHCP relay interface must be configured on the DHCP server. Otherwise, the DHCP clients connected to the relay agent cannot obtain correct IP addresses.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable the DHCP relay agent.

dhcp select relay

By default, when DHCP is enabled, an interface operates in the DHCP server mode.

Specifying DHCP servers

Specifying DHCP servers on a relay agent

About this task

To improve availability, you can specify several DHCP servers on the DHCP relay agent. When the interface receives request messages from clients, the relay agent forwards them to all DHCP servers.

Restrictions and guidelines

The IP address of any specified DHCP server must not reside on the same subnet as the IP address of the relay interface. Otherwise, the clients might fail to obtain IP addresses.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Specify a DHCP server address on the relay agent.

dhcp relay server-address ip-address

By default, no DHCP server address is specified on the relay agent.

To specify multiple DHCP server addresses, repeat this step. You can specify a maximum of eight DHCP servers.

Specifying DHCP servers in a DHCP relay address pool

About this task

DHCP address pools created on a DHCP relay agent are called DHCP relay address pools. You can create a relay address pool and specify DHCP servers in this address pool. This feature allows DHCP clients of the same type to obtain IP addresses and other configuration parameters from the DHCP servers specified in the matching DHCP relay address pool.

It applies to scenarios where the DHCP relay agent connects to clients of the same access type but classified into different types by their locations. In this case, the relay interface typically has no IP address configured. You can use the gateway-list command to specify gateway addresses for clients matching the same DHCP relay address pool and bind the gateway addresses to the device's MAC address.

Upon receiving a DHCP DISCOVER or REQUEST from a client that matches a DHCP relay address pool, the relay agent processes the packet as follows:

·     Fills the giaddr field of the packet with a specified gateway address.

·     Forwards the packet to all DHCP servers in the matching DHCP relay address pool.

The DHCP servers select a DHCP address pool according to the gateway address.

Restrictions and guidelines

If PPPoE users are in the network, follow these restrictions and guidelines when you configure the DHCP relay address pool:

·     Enable the DHCP relay agent to record DHCP relay entries by using the dhcp relay client-information record command. When a PPPoE user goes offline, the DHCP relay agent can find a matching relay entry and send a DHCP-RELEASE message to the DHCP server. This mechanism ensures the DHCP server is aware of the releasing of the IP address in a timely manner.

·     The remote-server command also configures the device as a DHCP relay agent. You do not need to enable the DHCP relay agent by using the dhcp select relay command.

Procedure

1.     Enter system view.

system-view

2.     Create a DHCP relay address pool and enter its view.

dhcp server ip-pool pool-name

3.     Specify gateways in the DHCP relay address pool.

gateway-list ip-address&<1-64> [ export-route ]

By default, no gateway address is specified.

4.     Specify DHCP servers in the DHCP relay address pool.

remote-server ip-address&<1-8>

By default, no DHCP server is specified in the DHCP relay address pool.

You can specify a maximum of eight DHCP servers in one DHCP relay address pool for high availability.

Specifying a DHCP relay address pool for DHCP clients

About this task

After you configure multiple DHCP relay address pools on a DHCP relay agent, you can specify these pools on an interface. To match DHCP clients based on options, you can define option settings when you specify the relay address pools.

Procedure

1.     Enter system view.

system-view

2.     Create a DHCP relay address pool and enter its view.

dhcp server ip-pool pool-name

By default, no DHCP relay address pools exist.

3.     Specify DHCP servers in the DHCP relay address pool.

remote-server ip-address&<1-8>

By default, no DHCP server is specified in the DHCP relay address pool.

4.     Specify gateway addresses for the clients matching the DHCP relay address pool.

gateway-list ip-address&<1-64>

By default, no gateway address is specified.

Configuring the DHCP relay agent security features

Enabling the DHCP relay agent to record relay entries

About this task

Perform this task to enable the DHCP relay agent to automatically record clients' IP-to-MAC bindings (relay entries) after they obtain IP addresses through DHCP.

Some security features use the relay entries to check incoming packets and block packets that do not match any entry. In this way, illegal hosts are not able to access external networks through the relay agent. Examples of the security features are ARP address check, authorized ARP, and IP source guard.

Rustications and guidelines

The DHCP relay agent does not record IP-to-MAC bindings for DHCP clients running on synchronous/asynchronous serial interfaces.

Procedure

1.     Enter system view.

system-view

2.     Enable the relay agent to record relay entries.

dhcp relay client-information record

By default, the relay agent does not record relay entries.

Enabling periodic refresh of dynamic relay entries

About this task

A DHCP client unicasts a DHCP-RELEASE message to the DHCP server to release its IP address. The DHCP relay agent conveys the message to the DHCP server and does not remove the IP-to-MAC entry of the client.

With this feature, the DHCP relay agent uses the IP address of a relay entry to periodically send a DHCP-REQUEST message to the DHCP server.

The relay agent maintains the relay entries depending on what it receives from the DHCP server:

·     If the server returns a DHCP-ACK message or does not return any message within an interval, the DHCP relay agent removes the relay entry. In addition, upon receiving the DHCP-ACK message, the relay agent sends a DHCP-RELEASE message to release the IP address.

·     If the server returns a DHCP-NAK message, the relay agent keeps the relay entry.

Procedure

1.     Enter system view.

system-view

2.     Enable periodic refresh of dynamic relay entries.

dhcp relay client-information refresh enable

By default, periodic refresh of dynamic relay entries is enabled.

3.     (Optional.) Set the refresh interval.

dhcp relay client-information refresh [ auto | interval interval ]

By default, the refresh interval is auto, which is calculated based on the number of total relay entries.

Enabling DHCP starvation attack protection

About this task

A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server might also fail to work because of exhaustion of system resources. The following methods are available to relieve or prevent such attacks.

·     To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source MAC addresses, you can use one of the following methods:

¡     Limit the number of ARP entries that a Layer 3 interface can learn.

¡     Set the MAC learning limit for a Layer 2 port, and disable unknown frame forwarding when the MAC learning limit is reached.

·     To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source MAC address, you can enable MAC address check on the DHCP relay agent. The DHCP relay agent compares the chaddr field of a received DHCP request with the source MAC address in the frame header. If they are the same, the DHCP relay agent forwards the request to the DHCP server. If not, the relay agent discards the request.

Enable MAC address check only on the DHCP relay agent directly connected to the DHCP clients. A DHCP relay agent changes the source MAC address of DHCP packets before sending them.

A MAC address check entry has an aging time. When the aging time expires, both of the following occur:

·     The entry ages out.

·     The DHCP relay agent rechecks the validity of DHCP requests sent from the MAC address in the entry.

Procedure

1.     Enter system view.

system-view

2.     Set the aging time for MAC address check entries.

dhcp relay check mac-address aging-time time

The default aging time is 30 seconds.

This command takes effect only after you execute the dhcp relay check mac-address command.

3.     Enter the interface view.

interface interface-type interface-number

4.     Enable MAC address check.

dhcp relay check mac-address

By default, MAC address check is disabled.

Enabling DHCP server proxy on the DHCP relay agent

About this task

The DHCP server proxy feature isolates DHCP servers from DHCP clients and protects DHCP servers against attacks.

Upon receiving a response from the server, the DHCP server proxy modifies the server's IP address as the relay interface's IP address before sending out the response. The DHCP client takes the DHCP relay agent as the DHCP server.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable DHCP relay agent and DHCP server proxy on the interface.

dhcp select relay proxy

By default, the interface operates in DHCP server mode after DHCP is enabled.

Enabling client offline detection on the DHCP relay agent

About this task

The client offline detection on the DHCP relay agent detects the user online status based on the ARP entry aging. When an ARP entry ages out, the DHCP client offline detection feature deletes the relay entry for the IP address and sends a RELEASE message to the DHCP server.

Restrictions and guidelines

The feature does not function if an ARP entry is manually deleted.

Procedure

1.     Enter system view.

system-view

2.     Enable the relay agent to record relay entries.

dhcp relay client-information record

By default, the relay agent does not record relay entries.

Without relay entries, client offline detection cannot function correctly.

3.     Enter interface view.

interface interface-type interface-number

4.     Enable the DHCP relay agent.

dhcp select relay

By default, when DHCP is enabled, an interface operates in the DHCP server mode.

5.     Enable client offline detection.

dhcp client-detect

By default, client offline detection is disabled on the DHCP relay agent.

Configuring the DHCP relay agent to release an IP address

About this task

Configure the relay agent to release the IP address for a relay entry. The relay agent sends a DHCP-RELEASE message to the server and meanwhile deletes the relay entry. Upon receiving the DHCP-RELEASE message, the DHCP server releases the IP address.

This command can release only the IP addresses in the recorded relay entries.

Procedure

1.     Enter system view.

system-view

2.     Configure the DHCP relay agent to release an IP address.

dhcp relay release ip ip-address

Configuring DHCP relay agent support for Option 82

To support Option 82, you must perform related configuration on both the DHCP server and relay agent. For DHCP server Option 82 configuration, see "Enabling handling of Option 82."

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable the relay agent to handle Option 82.

dhcp relay information enable

By default, handling of Option 82 is disabled.

4.     (Optional.) Configure the strategy for handling DHCP requests that contain Option 82.

dhcp relay information strategy { drop | keep | replace }

By default, the handling strategy is replace.

If the handling strategy is replace, configure a padding mode and a padding format for Option 82. If the handling strategy is keep or drop, you do not need to configure a padding mode or padding format for Option 82.

5.     (Optional.) Configure the padding mode and padding format for the Circuit ID sub-option.

In Layer 2 Ethernet interface view/Layer 2 aggregate interface view:

dhcp relay information circuit-id { bas | string circuit-id | { normal | verbose [ node-identifier { mac | sysname | user-defined node-identifier } ] [ interface ] } [ format { ascii | hex } ] }

In service template view:

dhcp snooping information circuit-id { normal | wlan-private } [ format { ascii | hex } ]

By default, the padding mode for Circuit ID sub-option is normal, and the padding format is hex.

The device name (sysname) must not include spaces if it is configured as the padding content for sub-option 1. Otherwise, the DHCP relay agent will fail to add or replace Option 82.

6.     (Optional.) Configure the padding mode and padding format for the Remote ID sub-option.

dhcp relay information remote-id { { ap-mac | ap-mac-ssid | normal } [ format { ascii | hex } ] | ap-name | ap-name-ssid | string remote-id | sysname }

By default, the padding mode for the Remote ID sub-option is normal, and the padding format is hex.

Setting the DSCP value for DHCP packets sent by the DHCP relay agent

About this task

The DSCP value of a packet specifies the priority level of the packet and affects the transmission priority of the packet.

Procedure

1.     Enter system view.

system-view

2.     Set the DSCP value for DHCP packets sent by the DHCP relay agent.

dhcp dscp dscp-value

By default, the DSCP value in DHCP packets sent by the DHCP relay agent is 56.

Specifying the DHCP relay agent address for the giaddr field

Manually specifying the DHCP relay agent address for the giaddr field

About this task

This task allows you to specify the IP addresses to be encapsulated to the giaddr field of the DHCP requests. If you do not specify any DHCP relay agent address, the primary IP address of the DHCP relay interface is encapsulated to the giaddr field of DHCP requests.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Specify the DHCP relay agent address to be encapsulated in relayed DHCP requests.

dhcp relay gateway ip-address

By default, the primary IP address of the DHCP relay interface is encapsulated in the relayed DHCP requests.

Configuring smart relay to specify the DHCP relay agent address for the giaddr field

About this task

By default, the relay agent only encapsulates the primary IP address to the giaddr field of all requests before relaying them to the DHCP server. The DHCP server then selects an IP address on the same subnet as the address in the giaddr filed. If no assignable addresses on the subnet are available, the DHCP server does not assign any IP address. The DHCP smart relay feature is introduced to allow the DHCP relay agent to encapsulate secondary IP addresses when the DHCP server does not send back a DHCP-OFFER message.

The relay agent initially encapsulates its primary IP address to the giaddr field before forwarding a request to the DHCP server. If no DHCP-OFFER is received, the relay agent allows the client to send a maximum of two requests to the DHCP server by using the primary IP address. If no DHCP-OFFER is returned after two retries, the relay agent switches to a secondary IP address. If the DHCP server still does not respond, the next secondary IP address is used. After the secondary IP addresses are all tried and the DHCP server does not respond, the relay agent repeats the process by starting from the primary IP address.

Procedure

1.     Enter system view.

system-view

2.     Enable the DHCP smart relay feature.

dhcp smart-relay enable

By default, the DHCP smart relay feature is disabled.

Specifying the source IP address for relayed DHCP requests

About this task

This task is required if multiple relay interfaces share the same IP address or if a relay interface does not have routes to DHCP servers. You can specify an IP address or the IP address of another interface, typically the loopback interface, on the DHCP relay agent as the source IP address for DHCP requests. The relay interface inserts the source IP address in the source IP address field as well as the giaddr field in DHCP requests.

If multiple relay interfaces share the same IP address, you must also configure the relay interface to support Option 82. Upon receiving a DHCP request, the relay interface inserts the subnet information in sub-option 5 in Option 82. The DHCP server assigns an IP address according to sub-option 5. The DHCP relay agent looks up the output interface in the MAC address table to forward the DHCP reply.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Specify the source IP address for DHCP requests.

dhcp relay source-address { ip-address | gateway | relay-interface }

The relay agent chooses the default source IP address for relayed requests depending on whether its server-side interface and the DHCP server belong to the same VPN instance:

¡     If they belong to the same VPN instance, the relay agent uses the IP address of the output interface for relayed requests as the default source IP address.

¡     If they belong to different VPN instances, the relay agent uses the lowest IP address that is in the same VPN instance as the DHCP server as the default source address.

Display and maintenance commands for DHCP relay agent

Execute display commands in any view and reset commands in user view.

 

Task

Command

Display MAC address check entries on the DHCP relay agent.

display dhcp relay check mac-address

Display relay entries on the DHCP relay agent.

display dhcp relay client-information [ interface interface-type interface-number | ip ip-address ]

Display Option 82 configuration information on the DHCP relay agent.

display dhcp relay information [ interface interface-type interface-number ]

Display information about DHCP servers on an interface.

display dhcp relay server-address [ interface interface-type interface-number ]

Display packet statistics on the DHCP relay agent.

display dhcp relay statistics [ interface interface-type interface-number ]

Clear relay entries on the DHCP relay agent.

reset dhcp relay client-information [ interface interface-type interface-number | ip ip-address ]

Clear packet statistics on the DHCP relay agent.

reset dhcp relay statistics [ interface interface-type interface-number ]

DHCP relay agent configuration examples

Example: Configuring the DHCP relay agent

Network configuration

As shown in Figure 9, configure the DHCP relay agent on the AC. The DHCP relay agent enables DHCP clients to obtain IP addresses and other configuration parameters from the DHCP server on another subnet.

The DHCP relay agent and server are on different subnets. Configure static or dynamic routing to make them reachable to each other.

Configure the DHCP server to guarantee the client-server communication. For DHCP server configuration information, see "DHCP server configuration examples."

Figure 9 Network diagram

Procedure

# Assign IP addresses to the interfaces. (Details not shown.)

# Configure basic settings on the AC. For more information, see WLAN Access Configuration Guide.

# Enable DHCP.

<AC> system-view

[AC] dhcp enable

# Enable the DHCP relay agent on VLAN-interface 10.

[AC] interface vlan-interface 10

[AC-Vlan-interface10] dhcp select relay

# Specify the IP address of the DHCP server on the relay agent.

[AC-Vlan-interface10] dhcp relay server-address 10.1.1.1

Verifying the configuration

# Verify that DHCP clients can obtain IP addresses and all other network parameters from the DHCP server through the DHCP relay agent. (Details not shown.)

# Display the statistics of DHCP packets forwarded by the DHCP relay agent.

[AC] display dhcp relay statistics

# Display relay entries if you have enabled relay entry recording on the DHCP relay agent.

[AC] display dhcp relay client-information

Troubleshooting DHCP relay agent configuration

Failure of DHCP clients to obtain configuration parameters through the DHCP relay agent

Symptom

DHCP clients cannot obtain configuration parameters through the DHCP relay agent.

Solution

Some problems might occur with the DHCP relay agent or server configuration.

To locate the problem, enable debugging and execute the display command on the DHCP relay agent to view the debugging information and interface state information.

Check that:

·     DHCP is enabled on the DHCP server and relay agent.

·     The DHCP server has an address pool on the same subnet as the DHCP clients.

·     The DHCP server and DHCP relay agent can reach each other.

·     The DHCP server address specified on the DHCP relay interface connected to the DHCP clients is correct.


Configuring the DHCP client

About DHCP client

With DHCP client enabled, an interface uses DHCP to obtain configuration parameters from the DHCP server, for example, an IP address.

Restrictions and guidelines: DHCP client configuration

The DHCP client configuration is supported only on VLAN interfaces.

DHCP client tasks at a glance

To configure a DHCP client, perform the following tasks:

1.     Enabling the DHCP client on an interface

2.     Configuring a DHCP client ID for an interface

Perform this task if the DHCP client uses the client ID to obtain IP addresses.

3.     (Optional.) Enabling duplicated address detection

4.     (Optional.) Setting the DSCP value for DHCP packets sent by the DHCP client

Enabling the DHCP client on an interface

Restrictions and guidelines

·     If the number of IP address request failures reaches the system-defined amount, the DHCP client-enabled interface uses a default IP address.

·     An interface can be configured to acquire an IP address in multiple ways. The new configuration overwrites the old.

·     Secondary IP addresses cannot be configured on an interface that is enabled with the DHCP client.

·     If the interface obtains an IP address on the same segment as another interface on the device, the interface does not use the assigned address. Instead, it requests a new IP address from the DHCP server.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Configure an interface to use DHCP for IP address acquisition.

ip address dhcp-alloc

By default, an interface does not use DHCP for IP address acquisition.

Configuring a DHCP client ID for an interface

About this task

A DHCP client ID is added to the DHCP option 61 to uniquely identify a DHCP client. A DHCP server can assign IP addresses to clients based on their DHCP client IDs.

DHCP client ID includes an ID type and a type value. Each ID type has a fixed type value. You can specify a DHCP client ID by using one of the following methods:

·     Use an ASCII string as the client ID. If an ASCII string is used, the type value is 00.

·     Use a hexadecimal number as the client ID. If a hexadecimal number is used, the type value is the first two characters in the number.

·     Use the MAC address of an interface to generate a client ID. If this method is used, the type value is 01.

The type value of a DHCP client ID can be displayed by the display dhcp server ip-in-use or display dhcp client command.

Restrictions and guidelines

Make sure the ID for each DHCP client is unique.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Configure a DHCP client ID for the interface.

dhcp client identifier { ascii ascii-string | hex hex-string | mac interface-type interface-number }

By default, an interface generates the DHCP client ID based on its MAC address. If the interface has no MAC address, it uses the MAC address of the first Ethernet interface to generate its client ID.

Enabling duplicated address detection

About this task

DHCP client detects IP address conflict through ARP packets. An attacker can act as the IP address owner to send an ARP reply. The spoofing attack makes the client unable to use the IP address assigned by the server. As a best practice, disable duplicate address detection when ARP attacks exist on the network.

Procedure

1.     Enter system view.

system-view

2.     Enable duplicate address detection.

dhcp client dad enable

By default, the duplicate address detection feature is enabled on an interface.

Setting the DSCP value for DHCP packets sent by the DHCP client

About this task

The DSCP value of a packet specifies the priority level of the packet and affects the transmission priority of the packet.

Procedure

1.     Enter system view.

system-view

2.     Set the DSCP value for DHCP packets sent by the DHCP client.

dhcp client dscp dscp-value

By default, the DSCP value in DHCP packets sent by the DHCP client is 56.

Display and maintenance commands for DHCP client

Execute display command in any view.

 

Task

Command

Display DHCP client information.

display dhcp client [ verbose ] [ interface interface-type interface-number ]


Configuring DHCP snooping

About DHCP snooping

DHCP snooping is a security feature for DHCP.

DHCP snooping works between the DHCP client and server, or between the DHCP client and DHCP relay agent. It guarantees that DHCP clients obtain IP addresses from authorized DHCP servers. Also, it records IP-to-MAC bindings of DHCP clients (called DHCP snooping entries) for security purposes.

DHCP snooping defines trusted and untrusted ports to make sure clients obtain IP addresses only from authorized DHCP servers.

·     Trusted—A trusted port can forward DHCP messages correctly to make sure the clients get IP addresses from authorized DHCP servers.

·     Untrusted—An untrusted port discards received DHCP-ACK and DHCP-OFFER messages to prevent unauthorized servers from assigning IP addresses.

DHCP snooping reads DHCP-ACK messages received from trusted ports and DHCP-REQUEST messages to create DHCP snooping entries. A DHCP snooping entry includes the MAC and IP addresses of a client, the port that connects to the DHCP client, and the VLAN.

The following features need to use DHCP snooping entries:

·     ARP fast-reply—Uses DHCP snooping entries to reduce ARP broadcast traffic. For more information, see "Configuring ARP fast-reply."

·     ARP attack detection—Uses DHCP snooping entries to filter ARP packets from unauthorized clients. For more information, see Security Configuration Guide.

·     IP source guard—Uses DHCP snooping entries to filter illegal packets on a per-port basis. For more information, see Security Configuration Guide.

Application of trusted and untrusted ports

Configure ports facing the DHCP server as trusted ports, and configure other ports as untrusted ports.

As shown in Figure 10, configure the DHCP snooping device's port that is connected to the DHCP server as a trusted port. The trusted port forwards response messages from the DHCP server to the client. The untrusted port connected to the unauthorized DHCP server discards incoming DHCP response messages.

Figure 10 Trusted and untrusted ports

In a cascaded network as shown in Figure 11, configure the DHCP snooping devices' ports facing the DHCP server as trusted ports. To save system resources, you can enable only the untrusted ports directly connected to the DHCP clients to record DHCP snooping entries.

Figure 11 Trusted and untrusted ports in a cascaded network

 

DHCP snooping support for Option 82

Option 82 records the location information about the DHCP client so the administrator can locate the DHCP client for security and accounting purposes.

DHCP snooping uses the same strategies as the DHCP relay agent to handle Option 82 for DHCP request messages, as shown in Table 3. If a response returned by the DHCP server contains Option 82, DHCP snooping removes Option 82 before forwarding the response to the client. If the response contains no Option 82, DHCP snooping forwards it directly.

Table 3 Handling strategies

If a DHCP request has…

Handling strategy

DHCP snooping…

Option 82

Drop

Drops the message.

Keep

Forwards the message without changing Option 82.

Replace

Forwards the message after replacing the original Option 82 with the Option 82 padded according to the configured padding format, padding content, and code type.

No Option 82

N/A

Forwards the message after adding the Option 82 padded according to the configured padding format, padding content, and code type.

Restrictions and guidelines: DHCP snooping configuration

·     The DHCP snooping configuration does not take effect on a Layer 2 Ethernet interface that is an aggregation member port. The configuration takes effect when the interface leaves the aggregation group.

·     Specify the ports connected to authorized DHCP servers as trusted ports to make sure that DHCP clients can obtain valid IP addresses. The trusted ports and the ports connected to DHCP clients must be in the same VLAN.

·     You can specify the following interfaces as trusted ports: Layer 2 Ethernet interfaces and Layer 2 aggregate interfaces. For more information about aggregate interfaces, see Ethernet link aggregation configuration Network Connectivity Configuration Guide.

DHCP snooping tasks at a glance

To configure DHCP snooping, perform the following tasks:

1.     Configuring basic DHCP snooping features

2.     (Optional.) Configuring DHCP snooping support for Option 82

3.     (Optional.) Configuring DHCP snooping entry auto backup

4.     (Optional.) Setting the maximum number of DHCP snooping entries

5.     (Optional.) Configuring DHCP packet rate limit

6.     (Optional.) Configuring DHCP snooping security features

7.     (Optional.) Enabling DHCP snooping logging

Configuring basic DHCP snooping features

About this task

Basic DHCP snooping features refer to the following:

·     Enabling DHCP snooping.

·     Configuring DHCP snooping trusted ports.

·     Enabling recording client information in DHCP snooping entries.

If you enable DHCP snooping globally, DHCP snooping is enabled on all interfaces on the device.

You can also enable DHCP snooping for specific VLANs. After enabling DHCP snooping for a VLAN, you can configure the other basic DHCP snooping features in the VLAN.

Restrictions and guidelines

If the basic DHCP snooping features are configured globally, you can only use the undo form of the global configuration commands to disable the settings globally. The VLAN-specific configuration commands cannot disable the settings.

If the basic DHCP snooping features are configured in a VLAN, you can only use the undo form of the VLAN-specific configuration commands to disable the settings in the VLAN. The global configuration command cannot disable the settings.

Procedure

1.     Enter system view.

system-view

2.     Enable DHCP snooping.

dhcp snooping enable

By default, DHCP snooping is disabled.

3.     Enter interface view.

interface interface-type interface-number

This interface must connect to the DHCP server.

4.     Specify the port as a trusted port.

dhcp snooping trust

By default, all ports are untrusted ports after DHCP snooping is enabled.

5.     (Optional.) Enable the recording of DHCP snooping entries.

a.     Return to system view.

quit

b.     Enter interface view.

interface interface-type interface-number

This interface must connect to the DHCP client.

c.     Enable the recording of DHCP snooping entries.

dhcp snooping binding record

By default, the recording of DHCP snooping entries is disabled.

Configuring DHCP snooping support for Option 82

Restrictions and guidelines

·     The Option 82 configuration on a Layer 2 Ethernet interface that has been added to an aggregation group does not take effect unless the interface leaves the aggregation group.

·     To support Option 82, you must configure Option 82 on both the DHCP server and the DHCP snooping device. For information about configuring Option 82 on the DHCP server, see "Enabling handling of Option 82."

·     If Option 82 contains the device name, the device name must contain no spaces. Otherwise, DHCP snooping drops the message. You can use the sysname command to specify the device name. For more information about this command, see device management commands in System Management Command Reference.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable DHCP snooping to support Option 82.

dhcp snooping information enable

By default, DHCP snooping does not support Option 82.

4.     (Optional.) Configure a handling strategy for DHCP requests that contain Option 82.

dhcp snooping information strategy { drop | keep | replace }

By default, the handling strategy is replace.

If the handling strategy is append or replace, configure a padding mode and padding format for Option 82. If the handling strategy is keep or drop, you do not need to configure any padding mode or padding format for Option 82.

5.     (Optional.) Configure the padding mode and padding format for the Circuit ID sub-option.

dhcp snooping information circuit-id { [ vlan vlan-id ] string circuit-id | { normal | verbose [ node-identifier { mac | sysname | user-defined node-identifier } ] } [ format { ascii | hex } ] }

By default, the padding mode is normal and the padding format is hex for the Circuit ID sub-option.

If the device name (sysname) is configured as the padding content for sub-option 1, make sure the device name does not include spaces. Otherwise, the DHCP snooping device will fail to add or replace Option 82.

6.     (Optional.) Configure the padding mode and padding format for the Remote ID sub-option.

dhcp snooping information remote-id { normal [ format { ascii | hex } ] | [ vlan vlan-id ] string remote-id | sysname }

By default, the padding mode is normal and the padding format is hex for the Remote ID sub-option.

Configuring DHCP snooping entry auto backup

About this task

The auto backup feature saves DHCP snooping entries to a backup file, and allows the DHCP snooping device to download the entries from the backup file at device reboot. The entries on the DHCP snooping device cannot survive a reboot. The auto backup helps the security features provide services if these features (such as IP source guard) must use DHCP snooping entries for user authentication.

Restrictions and guidelines

If you disable DHCP snooping with the undo dhcp snooping enable command, the device deletes all DHCP snooping entries, but entries stored in the backup file still exist. They are deleted next time the device updates the backup file.

Procedure

1.     Enter system view.

system-view

2.     Configure the DHCP snooping device to back up DHCP snooping entries to a file.

dhcp snooping binding database filename { filename | url url [ username username [ password { cipher | simple } string ] ] }

By default, the DHCP snooping device does not back up DHCP snooping entries.

With this command executed, the DHCP snooping device backs up DHCP snooping entries immediately and runs auto backup.

This command automatically creates the file if you specify a non-existent file.

3.     (Optional.) Manually save DHCP snooping entries to the backup file.

dhcp snooping binding database update now

4.     (Optional.) Set the waiting time after a DHCP snooping entry change for the DHCP snooping device to update the backup file.

dhcp snooping binding database update interval interval

By default, the DHCP snooping device waits 300 seconds to update the backup file after a DHCP snooping entry change. If no DHCP snooping entry changes, the backup file is not updated.

Setting the maximum number of DHCP snooping entries

About this task

Perform this task to prevent the system resources from being overused.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Set the maximum number of DHCP snooping entries for the interface to learn.

dhcp snooping max-learning-num max-number

By default, the number of DHCP snooping entries for an interface to learn is unlimited.

Configuring DHCP packet rate limit

About this task

Perform this task to set the maximum rate at which an interface can receive DHCP packets. This feature discards exceeding DHCP packets to prevent attacks that send large number of DHCP packets.

Restrictions and guidelines

The rate set on the Layer 2 aggregate interface applies to all members of the aggregate interface. If a member interface leaves the aggregation group, it uses the rate set in its Ethernet interface view.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable DHCP snooping packet rate limit on an interface and set the limit value.

dhcp snooping rate-limit rate

By default, the DHCP snooping packet rate limit is disabled on an interface.

Configuring DHCP snooping security features

Enabling DHCP starvation attack protection

About this task

A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests that contain identical or different sender MAC addresses in the chaddr field to a DHCP server. This attack exhausts the IP address resources of the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server might also fail to work because of exhaustion of system resources.

You can prevent DHCP starvation attacks in the following ways:

·     If the forged DHCP requests contain different sender MAC addresses, use the mac-address max-mac-count command to set the MAC learning limit on a Layer 2 port. For more information about the command, see Network Connectivity Command Reference.

·     If the forged DHCP requests contain the same sender MAC address, perform this task to enable MAC address check for DHCP snooping. This feature compares the chaddr field of a received DHCP request with the source MAC address field in the frame header. If they are the same, the request is considered valid and forwarded to the DHCP server. If not, the request is discarded.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable MAC address check.

dhcp snooping check mac-address

By default, MAC address check is disabled.

Enabling DHCP-REQUEST attack protection

About this task

DHCP-REQUEST messages include DHCP lease renewal packets, DHCP-DECLINE packets, and DHCP-RELEASE packets. This feature prevents the unauthorized clients that forge the DHCP-REQUEST messages from attacking the DHCP server.

Attackers can forge DHCP lease renewal packets to renew leases for legitimate DHCP clients that no longer need the IP addresses. These forged messages disable the victim DHCP server from releasing the IP addresses.

Attackers can also forge DHCP-DECLINE or DHCP-RELEASE packets to terminate leases for legitimate DHCP clients that still need the IP addresses.

To prevent such attacks, you can enable DHCP-REQUEST check. This feature uses DHCP snooping entries to check incoming DHCP-REQUEST messages.

·     If a matching entry is found for a message, this feature compares the entry with the message information.

¡     If they are consistent, the message is considered as valid and forwarded to the DHCP server.

¡     If they are different, the message is considered as a forged message and is discarded.

·     If no matching entry is found, the message is considered valid and forwarded to the DHCP server.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Enable DHCP-REQUEST check.

dhcp snooping check request-message

By default, DHCP-REQUEST check is disabled.

Configuring a DHCP packet blocking port

About this task

Perform this task to configure a port as a DHCP packet blocking port. This blocking port drops all incoming DHCP requests.

Procedure

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

3.     Configure the port to block DHCP requests.

dhcp snooping deny

By default, the port does not block DHCP requests.

Enabling DHCP snooping logging

About this task

The DHCP snooping logging feature enables the DHCP snooping device to generate DHCP snooping logs and send them to the information center. The information helps administrators locate and solve problems. For information about the log destination and output rule configuration in the information center, see System Management Configuration Guide.

Restrictions and guidelines

As a best practice, disable this feature if the log generation affects the device performance.

Procedure

1.     Enter system view.

system-view

2.     Enable DHCP snooping logging.

dhcp snooping log enable

By default, DHCP snooping logging is disabled.

Display and maintenance commands for DHCP snooping

IMPORTANT

IMPORTANT:

The MSG series, WX2500H-WiNet series, WAC series, WX2500H-LI series, and AC1000 series access controllers do not support parameters or commands that are available only in IRF mode.

Execute display commands in any view, and reset commands in user view.

 

Task

Command

Display DHCP snooping entries.

display dhcp snooping binding [ ip ip-address [ vlan vlan-id ] ]

Display information about the file that stores DHCP snooping entries.

display dhcp snooping binding database

Display Option 82 configuration information on the DHCP snooping device.

display dhcp snooping information { all | interface interface-type interface-number }

Display DHCP packet statistics on the DHCP snooping device.

In standalone mode:

display dhcp snooping packet statistics

In IRF mode:

display dhcp snooping packet statistics [ slot slot-number ]

Display information about trusted ports.

display dhcp snooping trust

Clear DHCP snooping entries.

reset dhcp snooping binding { all | ip ip-address [ vlan vlan-id ] }

Clear DHCP packet statistics on the DHCP snooping device.

In standalone mode:

reset dhcp snooping packet statistics

In IRF mode:

reset dhcp snooping packet statistics [ slot slot-number ]

DHCP snooping configuration examples

Example: Configuring basic DHCP snooping features

Network configuration

As shown in Figure 12:

·     Configure the port GigabitEthernet 1/0/1 connected to the DHCP server as a trusted port.

·     Enable DHCP snooping to record clients' IP-to-MAC bindings by reading DHCP-ACK messages received from the trusted port and DHCP-REQUEST messages.

Figure 12 Network diagram

 

Procedure

# Configure basic settings on the AC. For more information, see WLAN Access Configuration Guide.

# Enable DHCP snooping.

<AC> system-view

[AC] dhcp snooping enable

# Configure GigabitEthernet 1/0/1 as a trusted port.

[AC] interface gigabitethernet 1/0/1

[AC-GigabitEthernet1/0/1] dhcp snooping trust

[AC-GigabitEthernet1/0/1] quit

# Enable DHCP snooping to record clients' IP-to-MAC bindings on GigabitEthernet 1/0/2.

[AC] interface gigabitethernet 1/0/2

[AC-GigabitEthernet1/0/2] dhcp snooping binding record

[AC-GigabitEthernet1/0/2] quit

Verifying the configuration

# Verify that the DHCP client can obtain an IP address and other configuration parameters from the DHCP server. (Details not shown.)

# Display the DHCP snooping entry recorded for the client.

[AC] display dhcp snooping binding


Configuring the BOOTP client

About BOOTP client

BOOTP client application

An interface that acts as a BOOTP client can use BOOTP to obtain information (such as IP address) from the BOOTP server.

To use BOOTP, an administrator must configure a BOOTP parameter file for each BOOTP client on the BOOTP server. The parameter file contains information such as MAC address and IP address of a BOOTP client. When a BOOTP client sends a request to the BOOTP server, the BOOTP server searches for the BOOTP parameter file and returns the corresponding configuration information.

BOOTP is usually used in relatively stable environments. In network environments that change frequently, DHCP is more suitable.

Because a DHCP server can interact with a BOOTP client, you can use the DHCP server to assign an IP address to the BOOTP client. You do not need to configure a BOOTP server. The DHCP server will assign an IP address to the BOOTP client based on the IP address allocation sequence.

Obtaining an IP address dynamically

A BOOTP client dynamically obtains an IP address from a BOOTP server as follows:

1.     The BOOTP client broadcasts a BOOTP request, which contains its own MAC address.

2.     Upon receiving the request, the BOOTP server searches the configuration file for the IP address and other information according to the BOOTP client's MAC address.

3.     The BOOTP server returns a BOOTP response to the BOOTP client.

4.     The BOOTP client obtains the IP address from the received response.

A DHCP server can take the place of the BOOTP server in the following dynamic IP address acquisition.

Protocols and standards

·     RFC 951, Bootstrap Protocol (BOOTP)

·     RFC 2132, DHCP Options and BOOTP Vendor Extensions

·     RFC 1542, Clarifications and Extensions for the Bootstrap Protocol

Configuring an interface to use BOOTP for IP address acquisition

1.     Enter system view.

system-view

2.     Enter interface view.

interface interface-type interface-number

BOOTP client configuration applies only to Layer 3 Ethernet interfaces (including subinterfaces) and VLAN interfaces.

3.     Configure an interface to use BOOTP for IP address acquisition.

ip address bootp-alloc

By default, an interface does not use BOOTP for IP address acquisition.

Display and maintenance commands for BOOTP client

Execute display command in any view.

 

Task

Command

Display BOOTP client information.

display bootp client [ interface interface-type interface-number ]

 

  • Cloud & AI
  • InterConnect
  • Intelligent Computing
  • Security
  • SMB Products
  • Intelligent Terminal Products
  • Product Support Services
  • Technical Service Solutions
All Services
  • Resource Center
  • Policy
  • Online Help
All Support
  • Become a Partner
  • Partner Resources
  • Partner Business Management
All Partners
  • Profile
  • News & Events
  • Online Exhibition Center
  • Contact Us
All About Us
新华三官网