DHCP White Paper

 

DHCP White Paper

Key words: DHCP, BOOTP, DHCP server, DHCP relay, DHCP Client, DHCP snooping, DHCP Security

Abstract: This article introduces the basic principles and typical applications of DHCP, as well as the features and networking of the DHCP feature solution of H3C.

Abbreviations:

Abbreviations	Full English name	Explanation
DHCP	Dynamic Host Configuration Protocol	Dynamic Host Configuration Protocol
BOOTP	Bootstrap Protocol	Custom protocol
ARP	Address Resolution Protocol	Address Resolution Protocol
Option 82	DHCP relay agent information Option	DHCP relay proxy information Option
TFTP	Trivial File Transfer Protocol	Simple File Transfer Protocol

 

1 Overview 1.1 Background

A computer connected to the Internet needs to know its IP address and other information before sending or receiving a datagram, such as the gateway address, the subnet mask used, and the address of the Domain Name Server. Computers can obtain this information through the BOOTP protocol.

BOOTP protocol (Bootstrap Protocol) is an earlier remote startup protocol. It communicates with a remote server to obtain necessary information for communication, it is mainly used for non-disk clients to obtain their own IP addresses from the server, Server IP addresses, startup image file names, gateway IP addresses, and so on.

BOOTP is designed for relatively static environments. Each host has a permanent network connection. The Administrator creates a bootp configuration file that defines a set of BOOTP parameters for each host. Because the configuration remains unchanged, the file will not change frequently. In typical cases, the configuration remains unchanged for several weeks.

As the network scale expands and the network complexity increases, the network configuration becomes more and more complex and often moves on computers (such as hosts or wireless networks) and the number of computers exceeds the allocated IP address, and so on, the original BOOTP protocol for static hosts is increasingly unable to meet the actual needs. To facilitate users to quickly access and exit the network and improve the utilization of IP Address Resources, an automatic mechanism should be developed based on BOOTP for IP Address allocation. Therefore, IETF has designed a new protocol, namely, DHCP (Dynamic Host Configuration Protocol ).

1.2 technical advantages

DHCP is an enhanced version of BOOTP. It adopts the client/server communication mode. All IP address configuration parameters are centrally managed by the DHCP server and are responsible for handling DHCP requests from the client. The client uses the IP address parameters allocated by the server for communication.

DHCP provides three IP Address Allocation Policies for different client needs:

L manual Address Allocation: the Administrator binds a fixed IP address to a few specific clients (such as WWW servers) and sends the configured fixed IP address to the client through DHCP;

L automatic Address Allocation: DHCP assigns an unlimited IP address for the client;

L Dynamic Address Allocation: DHCP assigns a valid IP address to the client. After the validity period is reached, the client needs to apply for a new IP address.

The administrator can select the DHCP policy to respond to each network or host.

DHCP expands BOOTP in two aspects:

L DHCP allows the computer to quickly and dynamically obtain IP addresses. To use the Dynamic Address Allocation Mechanism of DHCP, the Administrator must configure the DHCP server so that it can provide a group of IP addresses, which are called address pools. Once a new computer is connected to the network, the computer will contact the server and apply for an IP address. The server selects an address from the configured address pool and assigns it to the computer.

L compared with BOOTP, DHCP can provide clients with richer network configuration information.

2 DHCP protocol introduction 2.1 Related Terms

L DHCP server: The Dhcp Service Provider interacts with the DHCP client through DHCP packets, assigns appropriate IP addresses for various types of clients, and can assign other network parameters to the client as needed.

L DHCP Client: it is the initiator and driver of the entire DHCP process. Through DHCP messages and DHCP server interaction, the IP address and other network parameters are obtained.

L DHCP relay: the relay forwarder of DHCP packets. It undertakes the relay service between DHCP clients and servers in different network segments, solving the problem that DHCP clients and DHCP servers must be in the same network segment.

L DHCP snooping: The layer-2 listening function of the DHCP service. This feature is used to extract and record IP and MAC address information from received DHCP-ACK and DHCP-REQUEST messages.

 

2.2 DHCP packet format

DHCP packet format 1

 

Figure 1 DHCP packet format

The fields of DHCP packets are described as follows:

L op: The operation type of the message, which can be request message and Response Message. 1 is request message and 2 is Response Message. The specific message type is identified in the option field.

L htype: hardware address type.

L hlen: hardware address length. Currently, the system only supports Ethernet, and the hardware address length is fixed to 6.

L hops: Number of DHCP relay packets. Each time a DHCP Request Packet passes through a DHCP relay, this field is increased by 1.

L Xid: Random Number generated by the client software, used to match request and response packets.

L secs: the time when the client enters the IP address application process or updates the IP address process. The time is set by the client software based on the situation. Not used currently, fixed to 0.

L flags: flag field. The first bit is the broadcast response identifier. It is used to identify whether the DHCP server sends the response packets in single-play or broadcast mode. 0 indicates single-play mode, and 1 indicates broadcast mode. Other BITs are reserved.

L ciaddr: IP address of the DHCP client.

L yiaddr: IP address assigned to the client by the DHCP server.

L siaddr: IP address of the server where the DHCP Client obtains IP addresses and other information.

L giaddr: IP address of the first DHCP relay after the DHCP client sends a request message.

L chaddr: The hardware address of the DHCP client.

L sname: name of the server on which the DHCP Client obtains IP addresses and other information.

L file: the name and path of the startup configuration file specified by the DHCP server for the DHCP client.

L options: Optional Variable Length option field, including the packet type, valid lease period, IP address of the DNS server, IP address of the WINS server, and other configuration information.

2.3 DHCP protocol Working Process

The DHCP client and server must be in the same CIDR block because packets are sent in broadcast mode when IP addresses are dynamically obtained. If the DHCP client and the DHCP server are in different network segments, DHCP relay is required to forward DHCP packets.

When dynamic configuration is completed through DHCP relay, the client and server are processed in the same way as when DHCP relay is not used. The following uses the IP address range of the DHCP client and the DHCP server as an example to describe how the DHCP protocol works. For the DHCP relay procedure, see "2.4 DHCP relay procedure ".

2.3.1 Dynamically Retrieve IP addresses

To dynamically obtain and use a valid IP address, you need to go through the following phases:

(1) discovery stage: the stage in which the DHCP Client searches for a DHCP server.

(2) supply phase: the phase in which the DHCP server provides IP addresses.

(3) selection phase: the phase in which the DHCP Client selects the IP address provided by a DHCP server.

(4) confirmation stage: the stage in which the DHCP server confirms the IP address provided.

Figure 2 Dynamic IP address acquisition process

The Dynamic IP address acquisition process 2 is shown. The following describes the working process of each stage in detail.

1. discovery phase

In the discovery phase, the DHCP client looks for a DHCP server by sending a DHCP-DISCOVER message.

Because the IP address of the DHCP server is unknown to the client, the DHCP Client sends DHCP-DISCOVER packets in broadcast mode. All DHCP servers that receive the DHCP-DISCOVER packet will send a response message so that the DHCP client can know where the DHCP server exists in the network.

2. Provision phase

The DHCP server that receives the DHCP-DISCOVER packet in the network selects a suitable IP address, along with the IP address lease term and other configuration information (such as gateway address, Domain Name Server address, etc) send it to the DHCP client through the DHCP-OFFER message.

The DHCP server saves available IP addresses and other configuration information through the address pool. When the DHCP server receives the DHCP request message, it obtains the idle IP address and its parameters from the IP address pool and sends it to the DHCP client.

The priority of the DHCP server to assign IP addresses to clients is as follows:

(1) IP addresses statically bound to the MAC address or client ID of the client;

(2) IP addresses recorded by the DHCP server that have been assigned to the client;

(3) the IP address specified by the option 50 field in the DHCP-DISCOVER message sent by the client;

(4) In the DHCP address pool, find the IP addresses available for allocation in sequence, and find the IP addresses first;

(5) If no available IP addresses are found, query the IP addresses that have expired the lease and conflict with each other in sequence. If yes, allocate the IP addresses. Otherwise, the IP addresses will not be processed.

When the DHCP server assigns an IP address to the client, the server first needs to confirm that the assigned IP address is not used by other devices on the network. The DHCP server sends an ICMP Echo Request (PING) packet to detect the allocated IP address. If no response is received within the specified time, the server sends a ping message again. If no response is received after the specified number of times, the assigned IP address is available. Otherwise, record the detected IP addresses as conflicting addresses and reselect IP addresses for allocation.

3. Select phase

If Multiple DHCP servers respond to a DHCP-OFFER packet to the DHCP client, the DHCP client accepts only the first DHCP-OFFER packet received. Then send the DHCP-REQUEST request message in broadcast mode, which contains option 54 (server identification option), that is, the IP address information of the DHCP server it selected.

The DHCP-REQUEST request message is sent in broadcast mode to notify all DHCP servers that it selects the IP address provided by the DHCP server identified in option 54, other DHCP servers can reuse the previously provided IP addresses.

4. validation phase

After receiving the DHCP-REQUEST request packet sent by the DHCP client, the DHCP server checks the MAC address carried in the DHCP-REQUEST packet to see if there is a corresponding lease record. If yes, a DHCP-ACK message is sent as a response notifying the DHCP client that it can use the assigned IP address.

After receiving the DHCP-ACK confirmation packet returned by the DHCP server, the DHCP Client sends the free ARP packet in broadcast mode to detect whether the host uses the IP address assigned by the server, if no response is received within the specified time, the client uses this address. Otherwise, the client sends a DHCP-DECLINE message to the DHCP server, notifies the DHCP server that the address is unavailable, and re-applies for an IP address.

If the DHCP server does not find the corresponding lease record after receiving the DHCP-REQUEST message, or the IP address cannot be assigned properly for some reason, the DHCP-NAK message is sent as a response, notifying the DHCP client that the appropriate IP address cannot be assigned. The DHCP client needs to resend the DHCP-DISCOVER message to request a new IP address.

2.3.2 reuse allocated IP addresses

The DHCP client does not need to send a DHCP-DISCOVER packet every time you log on to the network, but directly sends a DHCP-REQUEST request packet containing the previous assigned IP address, that is, option 50 in the packet (requested IP address option) enter the used IP address in the field. After receiving this packet, the DHCP server determines whether the DHCP client can use the requested address:

L if the requested address can be used, the DHCP server will reply to the DHCP-ACK validation message. After receiving the DHCP-ACK message, the DHCP client can continue to use this address for communication. 3.

Figure 3 DHCP client can reuse the assigned IP Address

L if the requested IP address cannot be assigned to the DHCP Client (for example, this IP address has been assigned to another DHCP client), the DHCP server will reply to the DHCP-NAK denial message. After receiving this packet, the DHCP Client must resend the DHCP-DISCOVER packet to request a new IP address. See Figure 4.

 

Figure 4 the DHCP client cannot reuse the assigned IP Address

2.3.3 update lease

The IP address assigned by the DHCP server to the DHCP Client generally has a lease term. Upon expiration, the DHCP server will reclaim the allocated IP address. If a DHCP Client wants to extend its IP lease, it must update its IP lease.

(1) When the IP Lease Term reaches half (T1), the DHCP client will automatically send a DHCP-REQUEST packet to the DHCP server in the form of unicast, request to update the IP address lease. If the DHCP-ACK message is received, the lease update is successful; if the DHCP-NAK message is received, the application process is re-initiated.

(2) When 87.5% (T2) of the lease term is reached, if the DHCP server does not receive a response, the DHCP client will automatically send a broadcast packet to the DHCP server updating its IP lease. If the DHCP-ACK message is received, the lease update is successful; if the DHCP-NAK message is received, the application process is re-initiated.

As shown in figure 5, when the lease reaches 87.5%, the broadcast sends a DHCP-REQUEST packet, the DHCP-ACK packet received by the DHCP server response, and the lease is updated successfully.

 

Figure 5 update an IP address lease

2.3.4 The DHCP Client actively releases the IP address

When the DHCP client no longer uses the assigned IP address, it sends a DHCP-RELEASE message to the DHCP server to notify the DHCP server to release the lease of the IP address. The DHCP server retains the configuration information of the DHCP client so that the client can reuse these parameters when applying for a new address.

2.3.5 obtain configuration information except IP addresses

After the DHCP Client obtains the IP address, if you need to obtain more detailed configuration information from the DHCP server, send a DHCP-INFORM packet to the DHCP server for a request. The DHCP client uses Option 55 to specify which network configuration parameters need to be obtained from the server.

After receiving the packet, the DHCP server allocates the network parameters required by the client through the DHCP-ACK packet.

 

2.4 DHCP relay process

The original DHCP protocol requires that the client and server can only work in the same subnet and cannot work across CIDR blocks. Therefore, a DHCP server must be set on all network segments for Dynamic Host Configuration, which is obviously economic.

The introduction of DHCP relay solves this problem. It undertakes relay services between DHCP clients and servers in different network segments, and forwards DHCP packets across network segments to the destination DHCP server, therefore, DHCP clients on different networks can use a single DHCP server.

Figure 6 DHCP relay process

The working process of DHCP relay is shown in Figure 6. The DHCP client sends a request packet to the DHCP server. After receiving the packet and processing it properly, the DHCP relay sends the packet to the specified DHCP server located in another network segment. Based on the necessary information provided in the request message, the server returns the configuration information to the client through DHCP relay to complete dynamic configuration of the client.

(1) After DHCP relay receives a DHCP-DISCOVER or DHCP-REQUEST packet, it will handle the following:

L to prevent DHCP packets from forming a loop, discard DHCP request packets whose hops field value is greater than the limited number of hops in the packet header. Otherwise, continue with the following operations.

L check the giaddr field. If the value is 0, set the giaddr field to the IP address of the interface that receives the request message. If the interface has multiple IP addresses, you can select one of them. This IP address will be used for all request messages received from this interface. If the giaddr field is not 0, this field is not modified.

L add the hops field to 1, indicating that it has undergone another DHCP relay.

L set the TTL of the Request Message to the default value of the DHCP relay device, instead of reducing the TTL of the original request message by 1. The Hops field can be used to solve the loop problem and hop limit problem of the relay packets.

L the destination address of the DHCP request packet is changed to the IP address of the DHCP server or the next DHCP relay. In this way, DHCP request packets are forwarded to the DHCP server or the next DHCP relay.

(2) the DHCP server allocates IP addresses and other parameters to the client based on the giaddr field, and sends the DHCP response message to the DHCP relay marked by the giaddr field. After receiving the DHCP response packet, the DHCP relay processes it as follows:

L DHCP relay assumes that all the response packets are sent to the directly connected DHCP client. The giaddr field is used to identify the interface directly connected to the client. If giaddr is not the address of the Local interface, DHCP relay discards the response packet.

L The broadcast flag of the DHCP relay check message. If the broadcast flag is 1, the DHCP response packet is broadcasted to the DHCP client. Otherwise, the DHCP response packet is broadcasted to the DHCP client. The destination address is yiaddr, And the link layer address is chaddr.

2.5
DHCP Application restrictions

DHCP has the following Disadvantages:

(1) When Multiple DHCP servers exist on the network, one DHCP server cannot find the IP addresses rented by other servers;

(2) the DHCP server cannot communicate with clients across network segments, unless packets are forwarded through DHCP relay.

3
DHCP extension 3.1 DHCP Security

The main function of DHCP security is to manage the user address table of DHCP relay (including dynamic addition, manual addition, manual deletion, and query ), in addition, it works with the ARP module to Prevent Users who obtain IP addresses abnormally from accessing the Internet. In this way, address planning and allocation can be effectively implemented to control users.

Figure 7 DHCP Security

7. The basic functions of DHCP security are as follows:

(1) Manage the list of valid user IP addresses

Make sure that all valid users are recorded in the user address table of DHCP relay.

When the client obtains an IP address from the DHCP server through DHCP relay, DHCP relay can automatically record the binding relationship between the Client IP address and the MAC address, and generate a dynamic user address table for DHCP relay. In addition, DHCP relay also supports static user Address Table configuration to meet the user's need to access the external network using a valid fixed IP address, that is, manually configure the binding relationship between the IP address and the MAC address on the DHCP relay.

DHCP relay also supports manual deletion and query of User table items.

(2) prohibit users with abnormal IP addresses from accessing the Internet.

This feature requires arp. For ARP requests that do not match the MAC address and IP address in the user address table, DHCP relay does not return an ARP response.

(3) Table item aging Function

Some layer-3 devices cannot process the DHCP-RELEASE packet sent by the DHCP Client (single broadcast directly to the hardware layer-3 forwarding, will not be sent to the CPU), so after the DHCP Client actively releases the IP address, the DHCP relay user address table still retains the user's MAC address and IP Address binding information, so that the user address table items cannot aging. To solve this problem, the device currently provides a handshake function to aging the DHCP user address table.

The handshake function is that DHCP relay simulates the DHCP client to regularly send the handshake request packet DHCP-REQUEST to the DHCP server. The packet content is constructed according to the contents of the user address table, however, the source MAC address uses the MAC address of the DHCP relay interface to distinguish the source MAC address from the normal DHCP-REQUEST packets. After receiving the DHCP-REQUEST packet, the server checks whether the requested IP address can be assigned, if it can be assigned, it responds to a DHCP-ACK packet, if not, it responds to a DHCP-NAK packet. After receiving the Server Response Message, DHCP relay determines:

L if a DHCP-ACK message is received, it indicates that the IP address in the User table item has been released, DHCP relay will delete this table item;

L if a DHCP-NAK message is received, it indicates that the IP address in the User table item has not been released by the user, and DHCP relay will continue to keep this table item.

For some DHCP servers, once the lease term expires, the handshake request packet of the relay is not responded. In this case, the device sets the maximum number of sent handshake request packets. If the DHCP relay still does not receive a response after the maximum number of DHCP-REQUEST messages is sent, it considers the lease has expired and deletes the table item.

3.2
DHCP snooping function 3.2.1 basic DHCP snooping listening Function

DHCP snooping is the Layer 2 listening function of the DHCP service. After the DHCP snooping function is enabled, the device can extract and record the IP address and MAC address information from the received DHCP-ACK and DHCP-REQUEST messages.

For security reasons, the security department needs to record the IP addresses used by users to access the Internet, and confirm the correspondence between the IP addresses applied by users and the MAC addresses of hosts used by users. DHCP snooping allows you to listen to DHCP-REQUEST messages and DHCP-ACK messages and record IP address information you get.

3.2.2 DHCP snooping trust Function

The Trust function of DHCP snooping can provide users with further security assurance.

The DHCP snooping Trust function can control the source of DHCP server response packets to prevent possible forgery or illegal DHCP servers from allocating IP addresses and other configuration information to other hosts.

The DHCP snooping Trust function divides ports into trust ports and untrusted ports:

L a trusted port is a port that is directly or indirectly connected to a valid DHCP server. The trusted port is forwarded to the received DHCP packet, ensuring that the DHCP Client obtains the correct IP address.

L untrusted port is a port that is not connected to a valid DHCP server. DHCP-ack, DHCP-NAK, and DHCP-OFFER packets that receive DHCP server responses from untrusted ports are discarded, preventing the DHCP client from obtaining the wrong IP address.

3.3 DHCP option82 Function

In the traditional DHCP Dynamic IP Address allocation mode, users of the same VLAN have the same permissions. Network administrators cannot effectively control specific users in the same VLAN. The normal DHCP relay proxy does not support option 82 and cannot distinguish different clients. In this way, applications that dynamically allocate IP addresses in combination with DHCP cannot control the client's access to network resources, this poses a severe challenge to network security control.

RFC 3046 defines DHCP relay agent information Option (option 82). It adds some option information to the DHCP request message so that the DHCP server can more accurately determine the user's location, so that different users can adopt different Address Allocation Policies. Option 82 contains two sub-options: Circuit ID (sub-option 1) and remote ID (sub-option 2 ).

Figure 8 principle of option82

As shown in figure 8, the procedure of option 82 is:

(1) Before a user fails to pass authentication or obtain a dynamic IP address, only authentication messages and DHCP packets can pass through the DHCP snooping/DHCP relay device.

(2) the client sends an authentication request to the authentication server and forwards the request to the authentication server through DHCP snooping/DHCP relay devices. The authentication server can manage user permission information.

(3) After the authentication server authenticates the user's validity, it notifies the client of the user's permissions through the authentication response message.

(4) A valid user who passes the authentication initiates an address request to the DHCP server based on the permissions granted by the authentication server, and carries the permission information in the option 82 option field.

(5) the DHCP server that supports the DHCP option 82 Address Allocation Policy assigns an IP address to the user based on the specific permission value in the option 82 Field.

By combining option 82 with the actual authentication system and DHCP servers that support option 82 Address Allocation Policies, the circuit ID and remote ID sub-options of option 82 can be used to assign different IP addresses to users based on different user permissions. On the one hand, you can perform more precise IP address management, and on the other hand, you can allow devices to perform "source IP address" policy routing, in this way, users with different IP addresses have different routing rules and different Internet access permissions.

Currently, the DHCP snooping and DHCP relay functions of our products support the option 82 function to add and remove user location information in DHCP packets.

3.4 Automatic Configuration

The automatic configuration function is used to automatically obtain and execute the configuration file when the device starts with an empty configuration.

When the device is started with an empty configuration, the system automatically sets the specified interface (such as VLAN Interface 1 or the first Ethernet Interface) of the device as a DHCP client, obtain the IP address from the DHCP server and the information required for obtaining the configuration file (for example, the IP address of the TFTP server, the name of the TFTP server, and the Startup File name ). If the information is obtained, the DHCP client can initiate a TFTP request to obtain the configuration file from the specified TFTP server. Then, the device uses the obtained configuration file for device initialization. If no information is obtained, the device uses an empty configuration file to initialize the device.

4 typical DHCP networking case 4.1 apply for address networking in this section

 

Figure 9 the DHCP client and the DHCP server are in the same network segment

The DHCP client and the DHCP server are in the same network segment and dynamically obtain IP addresses and other network parameters through DHCP.

Make sure that the IP address pool CIDR block on the DHCP server matches the IP address CIDR Block of the DHCP server.

4.2 cross-CIDR Block application address networking

Figure 10 the DHCP Client and DHCP server are not in the same network segment

The IP Address requested by the user for cross-network segments. The DHCP server and the DHCP client are not in the same LAN. The client uses DHCP relay to dynamically obtain the IP address and other network parameters through DHCP.

When networking, you must configure the IP address range of the DHCP relay interface to be consistent with that of the address pool of the DHCP server. Otherwise, the IP Address requested by the DHCP Client may not be in the network segment of the gateway, as a result, the DHCP client cannot communicate. At the same time, a route must be configured on the DHCP server to ensure that the DHCP relay can communicate with the DHCP server unicast.

Figure 11 option 82 typical networking applications

The DHCP client and the DHCP server are in the same network segment. The two communicate through DHCP snooping to ensure that the DHCP Client obtains the IP address from the valid DHCP server. You can also use DHCP snooping to add option 82 in the DHCP request message so that the DHCP server can assign an IP address to the DHCP server based on the location information of the DHCP client.

Note that all DHCP snooping ports are untrusted ports by default, and the port connecting to the server must be configured as a trusted port, otherwise, the DHCP server's response packets cannot be transmitted to the DHCP client.

Figure 12 automatic configuration of typical networking applications

When an empty configuration is started, the DHCP Client obtains the IP address, TFTP server address, and other information through the DHCP server. Then, it obtains and executes the configuration file from the TFTP server.

4.5 DHCP Application integrated networking

Figure 13 DHCP Application Group Network

As shown in Figure 13, the user dynamically acquires IP addresses in the form of DHCP across network segments, and improves security through DHCP snooping on the second layer.

5 Summary and prospects

The DHCP features supported by H3C comply with RFC 2131 and RFC 2132. Currently, it fully supports the basic DHCP and expansion functions described in RFC, including: DHCP Client/Bootp client, DHCP relay, DHCP server, DHCP security, DHCP snooping, and DHCP automatic configuration.

With the expansion of the network scale and the complexity of the network environment, the DHCP service is applied to more and more network environments. The DHCP solution of H3C has a complete product series, it can provide customers with a complete, flexible, and convenient networking configuration solution. Its main advantages include the following:

L complete functions, which can provide clients with a full range of functions such as DHCP clients and relay to servers;

L excellent service support and flexible networking solutions;

L good ease of use and configurability;

L can communicate well with other mainstream manufacturers in the industry, as well as Windows and Linux servers;

L convenient management, economic deployment, and low device overhead.

6 References

L RFC 951: Bootstrap Protocol (BOOTP)

L RFC 1497: BOOTP vendor information extensions

L RFC 2131: Dynamic Host Configuration Protocol (DHCP)

L RFC 2132: DHCP options and BOOTP vendor extensions

L RFC 3046: DHCP relay agent information Option