DHCP configuration for Cisco switches

Here we mainly explain how to configure DHCP for Cisco switches. First, let's take a look at the network topology, then explain it, and then parse the configuration code and command.

Cisco switch configuration DHCP 1. Network Topology

 

Cisco switch configuration DHCP 2. Instructions

1. Topology Description: The aggregation layer switch is ipvst4506, the core switch is ipvst6506, And the access layer switch is ipvst2918. 4506 enable ip dhcp snooping, DAI, and IPSG. ports connected to and from 4506 are configured as TRUNKING; VLAN routing and DHCP server are configured on 6506; and port-based VLAN is configured on 2918.

2. dhcp snooping is like a firewall that works between a non-trusted port connecting to a host or network device) and a trusted port connecting to a dhcp server or network device, its dhcp snooping binding database stores the MAC address, the IP address, the lease time, the binding type, the VLAN number, and the interface information and other information, but do not save the information of the device connected to the trusted port; After ip dhcp snooping is enabled on the switch, the interface will work in the Layer 2 bridging status, intercept and protect DHCP messages to L2 VLANs. After ip dhcp snooping is enabled on a VLAN, the switch will work in the L2 bridging status within the same VLAN.

3. After the Cisco switch enables ip dhcp snooping in global configuration mode, all ports are in dhcp snooping untrusted mode by default, the dhcp offer, dhcp ack, dhcp nak, and dhcp leasequery packets received by the untrusted port are discarded. The trusted port receives and forwards the packets normally without monitoring.

4. The dhcp snooping binding database will be lost after the switch is reloaded or restarted. Therefore, you need to save the table in the FLASH of the switch or in a TFTP server, after RELOAD or restart, the switch can read information from it and reform the dhcp snooping binding database. For example, run the following command: renew ip dhcp snoop data tftp: // 192.169.200.1/snooping. dat.

5. After the Cisco switch enables ip dhcp snooping in global configuration mode, all DHCPRELAYThe information option function is disabled.

6. According to Cisco's English documents, after a convergence layer switch enables dhcp snooping, when it is connected to an edge switch with an embedded DHCP option-82 information, when the downstream port is a non-trusted port, the aggregation layer switch discards the DHCP packet with option-82 information received from this port; however, when the ip dhcp snooping information option ALLOW-UNTRUSTED function is enabled on the aggregation layer switch, although the port connecting to the edge switch is still a non-trusted port, however, DHCP packets with option-82 information can be normally received from this port.

According to the above analysis, I understand the following: I do not know if it is correct: After the Cisco switch enables IP DHCP SNOOPING in global configuration mode, all ports are in DHCP SNOOPING UNTRUSTED mode by default, however, the dhcp snooping information option function is enabled by default. DHCP packets are discarded when they reach a snooping untrusted port. Therefore, the ip dhcp snooping information option ALLOW-UNTRUSTED command must be configured in 4506 by default off) to allow 4506 to receive dhcp request packets with OPTION 82 from the dhcp snooping untrusted port. We recommend that you disable dhcp information option on the vswitch, that is, no ip dhcp snooping information option in global configuration mode.

7. For clients that allow manual configuration of parameters such as IP addresses, You can manually add BINDING entries to the dhcp snooping binding database. Ip dhcp snooping binding 00d0. 2bd0. d80a vlan100222.25.77.100 interface gig1/1 expiry 600 indicates manually adding a binding entry with the MAC address 00d0. 2bd0. d80a, IP address 222.25.77.100, access port GIG1/1, and lease period of 600 seconds.

8. IPSG (ip source guard) forms an ip source binding table based on the dhcp snooping function and only applies to layer-2 ports. When IPSG is enabled, all IP packets are received and only the IP packets that match the entries in the bound table are forwarded. By default, IPSG only filters IP packets based on the source IP address. If the source MAC address is used as the filter condition, dhcp snooping informaiton option 82 must be enabled.

9. DAI, that is, dynamic arp inspection, is also based on dhcp snooping binding database and is also divided into trust and untrusted ports. DAI only checks ARP packets of untrusted ports, you can intercept, record, and discard ARP packets that do not match the IP address-MAC address ing relationship entries in the snooping binding. If dhcp snooping is not used, you must manually configure the arp acl.

Cisco switch configuration DHCP 3. Configuration

1. 2918

Switch # configure terminal// Global configuration mode

Switch (config) # interface range fa0/1-12

Switch (config-if-range) # switchport access vlan 100

Switch (config-if-range) # interface range fa0/13-24

Switch (config-if-range) # switchport access vlan 200

Switch (config-if-range )#Interface gig0/1// Connect to port 4506

Switch (config-if )#// You can manually configure the TRUNK.

2. 4506

Switch # configure terminal

Switch (config )#VtpVersion 2

Switch (config )#Vtp mode client

Switch (config )#Vtp domain gzy

Switch (config )#Vtp password gzy123

Switch (config )#Vlan 100

Switch (config )#Vlan 200

Switch (config) # ip dhcp snooping// Enable dhcp snooping for the vswitch

Switch (config) # ip dhcp snooping vlan 100,200// Enable dhcp snooping in VLAN100 and 200

Switch (config) # no ip dhcp snooping information option// Disable embedding and deleting option 82 Information in DHCP packets

Switch (config) # ip dhcp snooping database tftp: // 192.168.200.1/snooping. dat

// Save the dhcp snooping database in the snooping. dat file of the tftp Server IP address 192.168.200.1)

Switch (config )#Ip arp inspection vlan 100,200// Enable the DAI function in VLAN100 and 200

Switch (config )#Ip arp inspection validate src-mac ip// Check whether the ARP packet is valid based on the source MAC address and IP address

Switch (config )#Interface gig1/1// Connect to port 6506

Switch (config-if )#Switchport trunk encapsulation dot1q

Switch (config-if )#Switchport mode trunk

Switch (config-if )#Ip dhcp snooping trust

Switch (config-if )#Ip arp inspection trust

Switch (config-if )#Interface gig2/2// Connect to port 2918

Switch (config-if )#Switchport trunk encapsulation dot1q

Switch (config-if )#Switchport mode trunk

Switch (config-if )#Ip arp inspection limit none

Switch (config-if )#Ip verify source vlan dhcp-snooping

Switch (config-if )#End

Switch (config )#Copy run start

Cisco switch configuration DHCP 4. Remarks

Writing to the end is getting increasingly lazy, basically it is like this. The configuration on 6506 is simple. Because 2918 does not support the above functions, it can only be enabled on port 4506. However, in this way, these functions can only be enabled on port 4506 connected to port 2918 under, the spoofing on 2918 cannot be prevented. No way, Cisco's approach is strange. Currently, many access layer Switches of domestic manufacturers can implement these functions, such as Quidway, H3C, shenzhoudigital, and ruijie. Due to the limited level, you can correct the incorrect content.