DHCP Snooping实验

实验三：DHCP Snooping

1.SW1和SW2上创建VLAN 10，R1-R4划分到VLAN 10,网段为10.1.1.0/24

2.SW之间的Fa0/24-shutdown;Fa0/23指定成Trunk

3.R4模拟合法的DHCP服务器,在R4上完成DHCP Server的配置

4.R3模拟不合法的DHCP服务器,在R3上完成DHCP Server的配置

5.R1的接口IP设置成DHCP获得,并且通过show dhcplease查看DHCP Server

6.在SW1上启用DHCP Snooping,正确配置DHCP snooping,解决此问题.理解DHCP snooping的Trust和untrust的区别.在SW1上查看DHCP Snooping的binding表

7.理解Option82

8.做DHCP限速,SW1的Fa0/1接口每秒最多接收5个DHCP包

R1的配置

R1(config)#int f0/0

R1(config-if)#ip add dhcp

R1(config-if)#no sh

R3的配置

R3(config)#int f0/0

R3(config-if)#ip add 10.10.1.3 255.255.255.0

R3(config-if)#no sh

R3(config)#ip dhcp pool ccie

R3(dhcp-config)#network 10.1.1.0 255.255.255.0

R3(config)#ip dhcp excluded-address 10.1.1.1 10.1.1.50

R4的配置

R4(config)#int e0/0

R4(config-if)#ip add 10.10.1.4 255.255.255.0

R4(config-if)#no sh

R4(config)#ip dhcp pool wolf

R4(dhcp-config)#network 10.1.1.0 255.255.255.0

R4(config)#ip dhcp excluded-address 10.1.1.1 10.1.1.100

SW1的配置

SW1(config)# vlan 10

SW1(config)#int range f0/1 - 3

SW1(config-if)#switchport mode access

SW1(config-if)#switchport access vlan 10

SW1(config)#int  f0/24

SW1(config-if)#shut

SW1(config)#int  f0/23

SW1(config-if)#switchport trunk encapsulation dot1q

SW1(config-if)#switchport mode trunk

SW2的配置

SW2(config)# vlan 10

SW2(config)#int e0/4

SW2(config-if)#switchport mode access

SW2(config-if)#switchport access vlan 10

R1#sh dhcp lease

Temp IP addr: 10.1.1.51  for peer on Interface: FastEthernet0/0

Temp  sub net mask: 255.255.255.0

   DHCP Lease server: 10.1.1.3, state: 3 Bound

   DHCP transaction id: 12B7

   Lease: 86400 secs,  Renewal: 43200 secs,  Rebind: 75600 secs

   Next timer fires after: 11:59:37

   Retry count: 0   Client-ID: cisco-0002.4b1e.efe0-Fa0/0

#############################################################

SW1(config)# ip dhcp snooping   // 启用dhcp snooping功能

SW1(config)# ip dhcp snooping vlan 10

SW1(config)#int f0/23

SW1(config-if)#ip dhcp snooping trust

SW1(config)#no ip dhcp snooping information option  // 关闭option82

或R4(config)#ip dhcp snooping trust relay information trust-all // 在DHCP服务器上

   // 启用了DHCP snooping功能的交换机会在discovery消息中添加option82，路由器默认不信任 // 

SW1#sh ip dhcp snooping

Switch DHCP snooping is enabled

DHCP snooping is configured on following VLANs:

10

DHCP snooping is operational on following VLANs:

10

Smartlog is configured on following VLANs:

none

Smartlog is operational on following VLANs:

none

DHCP snooping is configured on the following L3 Interfaces:

Insertion of option 82 is enabled

   circuit-id default format: vlan-mod-port

   remote-id: 0026.997e.1280 (MAC)

Option 82 on untrusted port is not allowed

Verification of hwaddr field is enabled

Verification of giaddr field is enabled

DHCP snooping trust/rate is configured on the following Interfaces:

Interface                  Trusted    Allow option    Rate limit (pps)

----------------------    -------    ------------    ----------------   

FastEthernet0/23           yes        yes             unlimit

SW1#sh ip dhcp snooping binding 

MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface

------------------  ---------------  ----------  -------------  ----  --------------------

00:02:4B:1E:EF:E0   10.1.1.103       86108       dhcp-snooping   10    FastEthernet0/1

Total number of bindings: 1

SW1(config)#int f0/1

SW1(config-if)#ip dhcp snooping limit rate 5  // 限制一秒钟接收5个DHCP包