华为X7交换机DHCP SNOOPING强制终端自动获取地址接入网络应用

1、DHCP SNOOPING强制用户自动获取地址接入网络配置案例一、应该场景介绍客户要求内网用户必须强制性通过DHCP服务器获取IP地址，自己手工设置的IP地址无效不能接入网络，防止用户乱改IP引起网络风暴，同时也方便管理。客户网络比较小，就几台交换机，通过光纤连入另外地方的总部，交换机用的是S3700-28TP-EI，了解到客户需求时，我心里没底，从来没在华为的交换机上配置过，只是听说通过DHCP SNOOPING来实现，于是到处查资料，打电话，最后打电话询问厂家服务经理，还有800售后电话，他们都告诉我，电脑第一次接入网络必须通过DHCP服务器获取地址接入网络，手工设置的IP无法接入网络，但

2、是之后由于交换机已经学习到了此电脑的MAC，之后用手工配置相同网段的地址也可以接入网络；按照配置手册上DHCP SNOOPING的步骤调试，结果果然是和厂家说的一样。这时客户说不行要达到他们的要求，必须是每次都只能通过DHCP接入网络，正好客户认识一个做华为维保的工程师，打电话过去后，告诉我加了一条IP报文检查命令，然后做接入实验，真的就达到了客户提的要求，下面就详细介绍此案例配置过程。二、网络环境拓扑图接入交换机上配置2个VLAN，VLAN4、VLAN5；VLAN4配置级联地址接入总部，VLAN5是终端用户的业务VLAN；在业务VLAN5上配置DHCP中继。三、配置步骤1、开启DHCP SN

3、OOPING( VLAN的配置过程和DHCP中继配置省略Quidway dhcp enableQuidway dhcp snooping enable2、在业务端口上配置DHCP SNOOPING（级联端口不用做任何配置）Quidway interface Ethernet 0/0/2Quidway-Ethernet0/0/2 dhcp snooping enable3、在业务端口上配置IP报文检查功能Quidway-Ethernet0/0/2 ip source check user-bind enable这条命令式是检查dhcp snooping ip地址绑定表，和绑定表里面的IP地址匹配

4、的数据就转发访问网络，没有则丢弃，这个就是此案例中最关键的配置。4、主要配置完成，没有终端接入或者使用手工配置的IP接入时，使用display user-bind all查看绑ip地址定表项会显示以下内容<Quidway> display user-bind allbind-table:Flags:O - outer vlan ,I - inner vlan ,P - map vlanifname vsi O/I/P-vlan mac-address ip-address tp lease-Static binditem count: 0 Static binditem total

5、 count: 0就是说地址绑定表示空的，终端的IP是非法的，所有数据都会被丢弃，访问不了网络。5、将终端获取地址类型改成自动获取后，再查看绑定表项<Quidway> display user-bind allbind-table:Flags:O - outer vlan ,I - inner vlan ,P - map vlanifname vsi O/I/P-vlan mac-address ip-address tp lease-Ethernet0/0/2 - 5 /-/- 0001-0002-0003 S 0-Static binditem count:

6、1 Static binditem total count: 1这时候终端自动获取的地址自动加进DHCP SNOOPING绑定表里面，地址是合法的，数据转发。四、配置总结本案例实际上是结合dhcp snooping自动绑定和ip source check user-bind功能让自动获取的IP地址成为合法地址，手工设置的IP不会自动加进dhcp snooping绑定表里面成为非法地址，从而实现了终端必须通过自动获取地址才能接入网络的功能。五、配置文档此案例详细实施文档如下：!Software Version V100R005C01SPC100sysname Quidway#vlan batch

7、 4 to 5 200#stp enable#cluster enablentdp enablentdp hop 16ndp enable#dhcp enabledhcp snooping enable#undo http server enable#drop illegal-mac alarm#dhcp server group 1#dhcp server group 1dhcp-server 4 0 dhcp-server 1#aaaauthentication-scheme defaultauthorization-scheme defaulta

8、ccounting-scheme defaultdomain defaultdomain default_adminlocal-user admin password cipher 0_B4UQC-&C&"8CQ!local-user admin privilege level 3local-user admin service-type telnet terminal#interface Vlanif1ip address dhcp-alloc#interface Vlanif4#interface Vlanif5dhcp select relaydhcp rela

9、y server-select 1# interface Vlanif200#interface Ethernet0/0/1port link-type trunkport trunk allow-pass vlan 4 to 5 200ntdp enablendp enablebpdu enabledhcp snooping trusted#interface Ethernet0/0/2port link-type trunkport trunk allow-pass vlan 4 to 5 200ntdp enablendp enablebpdu enabledhcp snooping t

10、rusted#interface Ethernet0/0/3port link-type accessport default vlan 5ntdp enable ndp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/4port link-type accessport default vlan 5ntd

11、p enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/5port link-type accessport default vlan 5ntdp enablendp enable bpdu enabledhcp snooping enabledhcp snooping alarm dhcp

12、-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/6port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user

13、-bind enable#interface Ethernet0/0/7port link-type accessport default vlan 5ntdp enablendp enablebpdu enable dhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/8port link-type accessport default vla

14、n 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/9port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enable dhcp snooping alar

15、m dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/10port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source che

16、ck user-bind enable#interface Ethernet0/0/11port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/12port link-type accessport def

17、ault vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/13port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snoop

18、ing alarm dhcp-reply enable threshold 120port-isolate enable group 1 ip source check user-bind enable#interface Ethernet0/0/14port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip s

19、ource check user-bind enable#interface Ethernet0/0/15port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable #interface Ethernet0/0/16port link-type acce

20、ssport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/17port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enable

21、dhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable# interface Ethernet0/0/18port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable g

22、roup 1ip source check user-bind enable#interface Ethernet0/0/19port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/20 port link

23、-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/21port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snoop

24、ing enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/22port link-type access port default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-reply enable threshold 120port-isolate enable group 1ip source check user-bind enable#interface Ethernet0/0/23port link-type accessport default vlan 5ntdp enablendp enablebpdu enabledhcp snooping enabledhcp snooping alarm dhcp-repl