The switch uses DHCP Relay to configure the address-check function.

DHCP RelayProceedAddress-checkThe function configuration process is as follows:

1. Networking requirements

1. check the legality of the user address under the VLAN interface on the switch, and configure the security address table items of the DHCP relay, enable users with valid fixed IP addresses in the VLAN configured with DHCP Relay to pass the address legality check of DHCP security features;

2. SwitchA acts as the DHCP Server. SwitchB enables DHCP Relay. Enable address-check on SwitchB. the mac address of PC2 is 0015-c50d-20cf, And the IP address of PC2 is set to 192.168.1.3/24 manually.

2. Networking Diagram

 
Step 3

1. enable DHCP globally

[H3C] dhcp enable

2. Specify the IP address of the DHCP Server used by DHCP Server group 1

[H3C] dhcp-server 1 ip address 192.168.0.1

3. Configure the interface address from DHCP Relay to DHCP Server

[H3C] vlan 2

A [H3C-vlan2] port e1/2

[H3C] int vlan 2

[H3C-Vlan-interface2] ip address 192.168.0.2 255.255.255.0

4. Configure the DHCP Relay interface address to the PC

[H3C] vlan 3

[H3C-vlan3] port e1/3 e1/4

[H3C] int vlan 3

[H3C-Vlan-interface3] ip address 192.168.1.1 255.255.255.0

5. Enable relay for the specified VLAN Interface

[H3C-Vlan-interface3] dhcp select relay

6. Attach to DHCP Server group 1

[H3C-Vlan-interface3] dhcp-server 1

7. Enable the address-check function on the vswitch.

[H3C-Vlan-interface3] dhcp relay security address-check enable

Then the manually set PC2: 192.168.1.3 will not be able to access the Internet

8. Add PC2 to the security table

[H3C] dhcp relay security 192.168.1.3 0015-c50d-20cf static

In this way, pc2.

4. Key Points of Configuration

1. when the PC performs DHCP to obtain the IP address, the switch used as the DHCP Relay records the MAC address of the PC and the IP address assigned to the PC by the DHCP Server, create a dynamic DHCP Relay Security table. Therefore, you can use the DHCP Relay Security Command on the vswitch to manually add the IP address and MAC address table items of the PC. If no dynamically assigned PC address exists, you cannot access the Internet, this method prevents users from manually setting static IP addresses. You can also manually add the IP address and MAC address table of the PC to achieve static address binding;

2. Route accessibility must be ensured during configuration;

3. devices that support this function include: H3C 3600, H3C 5600, Quidway S3500, Quidway S3900, Quidway S5600, and Quidway S3526 series switches.