Alcatel 9000 Betriebsanweisung PDF herunterladen (Seite 353)

100

101

Configuring DHCP Relay Configuring DHCP Security Features

OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006 page 18-17

• The port from where the DHCP packet originated.

• The VLAN associated with the port from where the DHCP packet originated.

• The lease time for the assigned IP address.

• The binding entry type; dynamic or static (user-configured).

After extracting the above information and populating the binding table, the agent then forwards the

packet to the port from where the packet originated. Basically, the DHCP Snooping features prevents the

normal flooding of DHCP traffic. Instead, packets are delivered only to the appropriate client and server

ports.

Note that DHCP Snooping only applies to traffic that is relayed between VLANs. If a DHCP server and

client reside within the same VLAN domain, then DHCP Snooping is not applied to communications

between these devices.

DHCP Snooping Configuration Guidelines

Consider the following when configuring the DHCP Snooping feature:

• DHCP Snooping requires the use of the relay agent to process DHCP packets. As a result, DHCP

clients and servers must reside in different VLANs so that the relay agent is engaged to forward pack-

ets between the VLAN domains. See “Configuring BOOTP/DHCP Relay Parameters” on page 18-10

for information about how to configure the relay agent on the switch.

• Configure ports connected to DHCP servers within the network as trusted ports. See “Configuring the

Port Trust Mode” on page 18-18 for more information.

• Make sure that Option-82 data insertion is always enabled at the switch or VLAN level. See “Enabling

DHCP Snooping” on page 18-17 for more information.

• The DHCP sever must support the Option-82 feature or at a minimum retain and echo back the Option-

82 data field.

Enabling DHCP Snooping

There are two levels of operation available for the DHCP Snooping feature: switch level or VLAN level.

These two levels are exclusive of each other in that they both can not operate on the switch at the same

time. In addition, if the global DHCP relay agent information option (Option-82) is enabled for the switch,

then DHCP Snooping at any level is not available. See “Using the Relay Agent Information Option

(Option-82)” on page 18-13 for more information.

Note. DHCP Snooping drops server packets received on untrusted ports (ports that connect to devices

outside the network or firewall). It is important to configure ports connected to DHCP servers as trusted

ports so that traffic to/from the server is not dropped.

Switch-level DHCP Snooping

By default, DHCP Snooping is disabled for the switch. To enable this feature at the switch level, use the

ip helper dhcp-snooping command. For example:

-> ip helper dhcp-snooping enable

When DHCP Snooping is enabled at the switch level, all DHCP packets received on all switch ports are

screened/filtered by DHCP Snooping. By default, only client DHCP traffic is allowed on the ports, unless

1 2 ... 348 349 350 351 352 353 354 355 356 357 358 ... 701 702

Kommentare zu diesen Handbüchern

Keine Kommentare

Alcatel 9000 Betriebsanweisung Seite 353

Kommentare zu diesen Handbüchern

Verwandte Produkte und Handbücher für Software Alcatel 9000