pix-dhcp中继-tftp.doc

pix-dhcp中继-tftp2012/12/4QQ:673938155拓扑：R1配置：DHCP服务器Building configuration.Current configuration : 798 bytes!version 12.3service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R1!boot-start-markerboot-end-marker!no aaa new-modelip subnet-zero!ip cefno ip domain lookupip dhcp excluded-address 54ip dhcp bootp ignore! -More- *Mar 1 00:47:30.279: %SYS-5-CONFIG_I: Configured from console by consoleip dhcp pool kkk network default-router 54 !interface FastEthernet0/0 ip address duplex auto speed auto!interface FastEthernet0/1 no ip address shutdown duplex auto speed auto!no ip http serverip classlessip route 54 （必须具有回传的路由，不然只会收到发现的包，无法跟客户端交互信息）! !line con 0 exec-timeout 0 0 logging synchronous transport preferred all transport output allline aux 0 transport preferred all transport output allline vty 0 4!EndR2配置(DHCP Clients)Building configuration.Current configuration : 609 bytes!version 12.3service timestamps debug datetime msecservice timestamps log datetime msecno service password-encryption!hostname R2!boot-start-markerboot-end-marker!no aaa new-modelip subnet-zero!ip cefno ip domain lookup! !interface FastEthernet0/0 ip address dhcp duplex auto speed auto!interface FastEthernet0/1 no ip address shutdown duplex auto speed auto!no ip http serverip classless!line con 0 exec-timeout 0 0 logging synchronous transport preferred all transport output allline aux 0 transport preferred all transport output allline vty 0 4!endPiX 配置：pixfirewall# sh run : Saved:PIX Version 8.0(4) !hostname pixfirewallenable password 8Ry2YjIyt7RRXU24 encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Ethernet0 nameif outside security-level 0 ip address 54 !interface Ethernet1 nameif inside security-level 100 ip address 54 !interface Ethernet2 shutdown no nameif no security-level no ip address!interface Ethernet3 shutdown no nameif no security-level no ip address!interface Ethernet4 shutdown no nameif no security-level no ip address!ftp mode passiveaccess-list sean extended permit udp host any eq bootps access-list sean extended permit udp host any eq bootpc access-list sean extended permit icmp host any pager lines 24mtu inside 1500mtu outside 1500no failovericmp unreachable rate-limit 1 burst-size 1no asdm history enablearp timeout 14400access-group sean in interface outsidetimeout xlate 3:00:00timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolutedynamic-access-policy-record DfltAccessPolicyno snmp-server locationno snmp-server contactsnmp-server enable traps snmp authentication linkup linkdown coldstartcrypto ipsec security-association lifetime seconds 28800crypto ipsec security-association lifetime kilobytes 4608000telnet timeout 5ssh timeout 5console timeout 0dhcprelay server outsidedhcprelay enable insidedhcprelay setroute insidedhcprelay timeout 80threat-detection basic-threatthreat-detection statistics access-listno threat-detection statistics tcp-intercept!class-map inspection_default match default-inspection-traffic! !policy-map type inspect dns preset_dns_map parameters message-length maximum 512policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp !service-policy global_policy globalprompt hostname context Cryptochecksum:395f06b78c43ca973641d9c4d043737b总结：Dhcp 服务器必须具有回传的路由，不然无法将包返回给Dhcp 客户端如果服务器没有返回路由的情况：pixfirewall# sh dhcprelay statistics DHCP UDP Unreachable Errors: 0DHCP Other UDP Errors: 0Packets RelayedBOOTREQUEST 0DHCPDISCOVER 100DHCPREQUEST 1DHCPDECLINE 0DHCPRELEASE 0DHCPINFORM 0BOOTREPLY 0DHCPOFFER 1DHCPACK 1DHCPNAK 0如果有返回路由的情况：pixfirew