DHCP SNOOPING

《DHCP SNOOPING》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、DHCPSnooping实验拓扑需求：1，client获取192.168.20.0/24网段前面地址。2，为了防止DHCP欺骗攻击，在交换机开启DHCPsnooping。初始化配置：SW1配置：sw1(config)#vlan2sw1(config-vlan)#namesw1(config-vlan)#nameSNOOPINGsw1(config-vlan)#exitsw1(config)#intrangfa0/1-3sw1(config-if-range)#switchporthostswitchportmodewillbesettoac

2、cessspanning-treeportfastwillbeenabledchannelgroupwillbedisabledsw1(config-if-range)#switchportaccessvlan2sw1(config-if-range)#endsw1#DHCP_SER配置：DHCP_SER(config)#interfacefa0/0DHCP_SER(config-if)#ipadd192.168.20.254255.255.255.0DHCP_SER(config-if)#noshuDHCP_SER(config-if)#

3、exitDHCP_SER(config)#ipdhcppoolCCIEDHCP_SER(dhcp-config)#network192.168.20.0/24DHCP_SER(dhcp-config)#default-router192.168.20.254DHCP_SER(dhcp-config)#exitDHCP_SER(config)#ipdhcpexcluded-address192.168.20.200192.168.20.254DHCP_SER(config)#DHCPsnooping配置：SW1配置：sw1(config)#i

4、pdhcpsnoopingsw1(config)#ipdhcpsnoopingvlan2//还须在vlan开启sw1(config)#interfacefa0/3sw1(config-if)#ipdhcpsnoopingtrust//定义dhcp服务器位置测试：Client1(config)#interfacefa0/0Client1(config-if)#noshutClient1(config-if)#ipaddressdhcp*Jan3103:08:13.451:%LINK-3-UPDOWN:InterfaceFastEthernet

5、0/0,changedstatetoup*Jan3103:08:14.451:%LINEPROTO-5-UPDOWN:LineprotocolonInterfaceFastEthernet0/0,changedstatetoupClient1(config-if)#可知Client没有拿到地址，在服务器上开启debug查看原因。DHCP_SER#debugipdhcpservereventsDHCPservereventdebuggingison.DHCP_SER#debugipdhcpserverpacketDHCPserverpacke

6、tdebuggingison.DHCP_SER#*Jan3103:03:09.659:DHCPD:inconsistentrelayinformation.*Jan3103:03:09.659:DHCPD:relayinformationoptionexists,butgiaddriszero.根据如上所示为relayinformation存在，但是自己却不trust。在三层交换机开启DHCPsnooping后，默认会插入82option，但是思科路由器却不trust，有两个解决办法，在SW1关闭option或者DHCPserver接口下t

7、rust。DHCP_SER(config)#intfa0/0DHCP_SER(config-if)#ipdhcprelayinformationtrustedDHCP_SER(config-if)#endDHCP_SER#Client1#*Jan3103:20:16.843:%SYS-5-CONFIG_I:Configuredfromconsolebyconsole*Jan3103:20:20.939:%DHCP-6-ADDRESS_ASSIGN:InterfaceFastEthernet0/0assignedDHCPaddress192.

8、168.20.1,mask255.255.255.0,hostnameClient1Client1#Client2通过关掉SW1option后拿地址：sw1(config)#no