Dhcp relay handshake settings

We have explained some of the dhcp relay configurations. Here we will mainly introduce the dhcp relay handshake function and the security issue of disabling VLANs. How are these two configurations completed?

◆ Enable/disable dhcp security features on vlan interfaces

When the client obtains an IP address from the dhcp server through dhcp relay, dhcp relay records the binding relationship between the IP address and the mac address. You can also manually configure the user address table items, that is, static binding between the IP address and the mac address.

To prevent unauthorized users from statically configuring an IP address and accessing other networks, the device supports dhcp relay security features. Enabling dhcp security features on vlan interfaces will enable checks on the legality of user addresses under vlan interfaces, if the relationship between the IP address configured by the user and the mac address of the user does not include the dynamic record items of the dhcp relay and the manually configured user address table items in the user address table of the dhcp relay ), dhcp relay does not allow the user to access the external network.

Perform the following configurations in the vlan Interface view.

By default, dhcp security features on vlan interfaces are disabled.

After enabling the dhcp security feature on the vlan interface, the client that has applied for an IP address cannot obtain the access permission. The client needs to apply for an IP address again, it is recommended that the Administrator configure the IP address before the user does not obtain it!

◆ Enable dhcp relay handshake

When the dhcp Client obtains an IP address from the dhcp server through dhcp relay, dhcp relay records the binding relationship between the IP address and the mac address. After the dhcp relay handshake function is enabled on the vswitch, dhcp relay periodically sends a handshake packet to the dhcp server based on the IP address in the binding relationship and its mac address ).

If the dhcp server responds to the dhcp-ack packet, it indicates that the IP address can be allocated. dhcp relay will aging the table items in the dynamic user address table;

If the dhcp server responds to the dhcp-nak packet, it indicates that the lease of the IP address still exists, and dhcp relay will not aging the table items corresponding to the IP address;

If the dhcp server does not respond to the handshake packet of the dhcp relay, the dhcp relay will continue to send the handshake to the binding relationship. When the response cannot be received three times, the IP address can be allocated, dhcp relay ages the table items in the dynamic user address table;

When the dhcp relay handshake function is disabled on the vswitch, dhcp relay does not regularly send a handshake packet dhcp-request packet to the dhcp server), which leads to an increasing number of user security table items, it will occupy a large amount of system resources. Please use it with caution!

When the dhcp client releases the IP address, it sends a unicast dhcp-release packet to the dhcp server. The dhcp relay does not process the packet, so that the user address of the dhcp relay cannot be refreshed in real time.