ASA防火墙上配置DHCP中继

ASA防火墙上配置DHCP中继

要求：R1作为DHCP server，在ASA防火墙上配置dhcp中继，使得client端动态获取地址

1、配置基本的IP地址，保证直连能通

R1(config)#int f0/0

R1(config-if)#ip add 12.1.1.1 255.255.255.0

R1(config-if)#no shut

ASA(config)#int g0

ASA(config-if)#nameif outside 将g0口命名为outside

INFO:Security level for "outside" set to 0 by default.

ASA(config-if)#security-level 100 将g0口的安全等级修改为100

ASA(config-if)#ip add 12.1.1.2 255.255.255.0

ASA(config-if)#no shut

ASA(config-if)#int g1

ASA(config-if)#nameif inside  将g1口命名为inside

INFO:Security level for "inside" set to 100 by default.

ASA(config-if)#ip add 10.1.1.1 255.255.255.0

ASA(config-if)#no shut

R2(config)#intf0/0

R2(config-if)#ip address dhcp  R2动态获取地址

2、R1上配置DHCPserver

R1(config)#ip dhcp pool meng  R1上配置DHCP server，将地址池命名为meng

R1(dhcp-config)#network10.1.1.0 /24 让R2在此地址段内获取地址

R1(dhcp-config)#default-router 10.1.1.1  默认网关指为防火墙与client相连的地址

R1(dhcp-config)#lease 1 租期为1天

R1(config)#ip dhcp excluded-address10.1.1.1 让R2从除网关地址之外的地址段中获取

3、ASA防火墙上配置Dhcprelay

ASA(config)#dhcprelay server12.1.1.1 outside 配置DHCPrelay server，server地址为防火墙与DHCPserver相连的地址，接口为防火墙上与DHCP server相连的接口

ASA(config)#dhcprelay enableinside 启用DHCPrelay，此接口与client相连的接口

此时，配置基本已完成，但由于R1没有到10.1.1.0/24网段的，R2还获取不到地址，所以要在R1上写一条静态

R1(config)#ip route 10.1.1.0 255.255.255.0 12.1.1.2

4、在R2上查看地址

R2# show ip int brife

Interface              IP-Address      OK? Method Status                Protocol

FastEthernet0/0        10.1.1.2        YES DHCP  获取的地址为10.1.1.2   up                    up     

5、可以用clear ip dhcp binding * 清除绑定的IP地址和mac地址

6、查看dhcpserver收到的信息

R1#sho ip dhcp server statistics

Memoryusage         15448

Addresspools        1

Databaseagents      0

Automaticbindings   1

Manualbindings      0

Expiredbindings     0

Malformedmessages   0

Securearp entries   0

Renewmessages       0

Workspacetimeouts   0

Static routes        0

Relaybindings       0

Relaybindings active        0

Relaybindings terminated    0

Relaybindings selecting     0

Message              Received

BOOTREQUEST          0

DHCPDISCOVER         6  收到的discovery 报文数

DHCPREQUEST          2  收到的request报文数

DHCPDECLINE          0

DHCPRELEASE          0

DHCPINFORM           0

DHCPVENDOR           0

BOOTREPLY            0

DHCPOFFER            0

DHCPACK              0

DHCPNAK              0

Message              Sent

BOOTREPLY            0

DHCPOFFER            6  返回的offer报文数

DHCPACK              2  返回的ack报文

DHCPNAK              0

Message              Forwarded

BOOTREQUEST          0

DHCPDISCOVER         0

DHCPREQUEST          0

DHCPDECLINE          0

DHCPRELEASE          0

DHCPINFORM           0

DHCPVENDOR           0

BOOTREPLY            0

DHCPOFFER            0

DHCPACK              0

DHCPNAK              0

DHCP-DPMStatistics

Offernotifications sent        0

Offercallbacks received        0

Classnamerequests sent         0

Classnamecallbacks received    0

7、查看dhcpserver上IP地址与mac地址绑定

R1#sho ip dhcp binding

Bindingsfrom all pools not associated with VRF:

IPaddress      Client-ID/              Lease expiration        Type       State      Interface

                Hardware address/

                User name

10.1.1.1        0063.6973.636f.2d63.    Nov 22 2015 10:16 PM    Automatic Active     Unknown

                6130.322e.3031.3530.

                2e30.3030.302d.4661.

                302f.30