华为ensp---DHCP SNOOPING实验

场景:企业内部有独立的DHCP服务器,但是需要跨三层分配地址给终端。

解决办法:三层交换机开启DHCP SNOOPING

拓扑图

在这里插入图片描述
交换机配置:
因为AR中没有192.168.20.0和192.168.40.0的路由表,所以在AR中要添加静态路由

[SW1]vlan batch 20 30 40  
[SW1]interface Vlanif20
[SW1]ip address 192.168.20.1 255.255.255.0
[SW1]dhcp select relay
[SW1]dhcp relay server-ip 192.168.30.254
[SW1]interface Vlanif30
[SW1]ip address 192.168.30.1 255.255.255.0
[SW1]interface Vlanif40
[SW1]ip address 192.168.40.1 255.255.255.0
[SW1]dhcp select relay
[SW1]dhcp relay server-ip 192.168.30.254
[SW1]interface GigabitEthernet0/0/1
[SW1]port link-type access
[SW1]port default vlan 20
[SW1]dhcp snooping enable
[SW1]interface GigabitEthernet0/0/2
[SW1]port link-type access
[SW1]port default vlan 30
[SW1]dhcp snooping trusted
[SW1]interface GigabitEthernet0/0/4
[SW1]port link-type access
[SW1]port default vlan 40
[SW1]dhcp snooping enable

DHCP服务器配置(AR代替)

[SW1]dhcp enable
[SW1]ip pool vlan20
[SW1]gateway-list 192.168.20.1 
[SW1]network 192.168.20.0 mask 255.255.255.0 
[SW1]excluded-ip-address 192.168.20.254 
[SW1]dns-list 8.8.8.8 
[SW1]ip pool vlan40
[SW1]gateway-list 192.168.40.1 
[SW1]network 192.168.40.0 mask 255.255.255.0 
[SW1]dns-list 8.8.8.8 
[SW1]interface GigabitEthernet0/0/0
[SW1]ip address 192.168.30.254 255.255.255.0 
[SW1]dhcp select global
[SW1]ip route-static 192.168.20.0 255.255.255.0 192.168.30.1
[SW1]ip route-static 192.168.40.0 255.255.255.0 192.168.30.1

结果:终端成功获得地址

在这里插入图片描述
在这里插入图片描述

解决IP地址冲突的完美方法--DHCP SNOOPING 使用的方法是采用DHCP方式为用户分配IP,然后限定这些用户只能使用动态IP的方式,如果改成静态IP的方式则不能连接上网络;也就是使用了DHCP SNOOPING功能。 例子: version 12.1 no service pad service timestamps debug uptime service timestamps log uptime no service password-encryption service compress-config ! hostname C4-2_4506 ! enable password xxxxxxx! clock timezone GMT 8 ip subnet-zero no ip domain-lookup ! ip dhcp snooping vlan 180-181 // 对哪些VLAN 进行限制 ip dhcp snooping ip arp inspection vlan 180-181 ip arp inspection validate src-mac dst-mac ip errdisable recovery cause udld errdisable recovery cause bpduguard errdisable recovery cause security-violation errdisable recovery cause channel-misconfig errdisable recovery cause pagp-flap errdisable recovery cause dtp-flap errdisable recovery cause link-flap errdisable recovery cause l2ptguard errdisable recovery cause psecure-violation errdisable recovery cause gbic-invalid errdisable recovery cause dhcp-rate-limit errdisable recovery cause unicast-flood errdisable recovery cause vmps errdisable recovery cause arp-inspection errdisable recovery interval 30 spanning-tree extend system-id ! ! interface GigabitEthernet2/1 // 对该端口接入的用户进行限制,可以下联交换机 ip arp inspection limit rate 100 arp timeout 2 ip dhcp snooping limit rate 100 ! interface GigabitEthernet2/2 ip arp inspection limit rate 100 arp timeout 2 ip dhcp snooping limit rate 100 ! interface GigabitEthernet2/3 ip arp inspection limit rate 100 arp timeout 2 ip dhcp snooping limit rate 100 ! interface GigabitEthernet2/4 ip arp inspection limit rate 100 arp timeout 2 ip dhcp snooping limit rate 100 --More-- 编者注:对不需要明确地址的所有人的时候是一个很好的解决办法。另外,可以查看www.cisco.com的 IP Source Guard Similar to DHCP snooping, this feature is enabled on a DHCP snooping untrusted Layer 2 port. Initially, all IP traffic on the port is blocked except for DHCP packets that are captured by the DHCP snooping process. When a client receives a valid IP address from the DHCP server, or when a static IP source binding is configured by the user, a per-port and VLAN Access Control List (PACL) is installed on the port. This process restricts the client IP traffic to those source IP addresses configured in the binding; any IP traffic with a source IP address other than that in the IP source binding will be filtered out. This filtering limits a host's ability to attack the network by claiming neighbor host's IP address.
EnSP(Enterprise Network Security Platform)是一个企业级网络安全平台,它通常用于大型网络环境中提供网络安全控制。DHCP Snooping是其的一项功能,它在DHCP(Dynamic Host Configuration Protocol)服务器上启用的一种安全机制。 DHCP Snooping主要用于防止未授权用户从非法设备获取IP地址,防止IP欺骗攻击。当DHCP Snooping开启后,交换机会对接收到的DHCP报文进行检查,只允许源自已知和信任的DHCP服务器的报文通过。以下是基本的DHCP Snooping配置步骤: 1. **启用DHCP Snooping**:在华为、Cisco等网络设备的命令行界面下,启用DHCP Snooping功能并为其分配一个全局VLAN ID。 ```bash [Huawei] dhcp snooping enable [Huawei] interface VLANif <vlan-id> [Huawei-VlanIf<vlan-id>] dhcp snooping enable ``` 2. **配置信任端口**:指定哪些接口作为信任接口,它们不会受到DHCP Snooping规则的限制。 ```bash [Huawei-VlanIf<interface-name>] dhcp snooping trusted interface ``` 3. **创建黑名单/白名单**:可以配置DHCP Snooping表来阻止或允许特定MAC地址或IP范围。 ```bash [Huawei-VlanIf<vlan-id>] dhcp snooping static-bind ip-address <ip> mac-address <mac> [Huawei-VlanIf<vlan-id>] dhcp snooping untrust-port-security enable ``` 4. **配置陷阱和日志**:设置违规操作后的响应策略,如发送告警信息,并记录事件日志便于审计。 5. **绑定终端和接口**:如果需要进一步精确控制,可以绑定具体的终端设备到接口上。 完成以上配置后,DHCP Snooping会在指定的VLAN内监控DHCP活动,保护网络免受恶意租户的影响。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值