HP 6125G HP 6125G & 6125G/XG Blade Switches Layer 3 - IP Services Conf - Page 46

Configuring the DHCP relay agent security functions, Configuring address check

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 46 highlights

Configuring the DHCP relay agent security functions Configuring address check Address check can block illegal hosts from accessing external networks. With this feature enabled, the DHCP relay agent can dynamically record clients' IP-to-MAC bindings after they obtain IP addresses through DHCP. This feature also supports static bindings. You can also configure static IP-to-MAC bindings on the DHCP relay agent, so users can access external networks using fixed IP addresses. Upon receiving a packet from a host, the DHCP relay agent checks the source IP and MAC addresses in the packet against the recorded dynamic and static bindings. If no match is found, the DHCP relay agent does not learn the ARP entry of the host, and will not forward any reply to the host, so the host cannot access external networks via the DHCP relay agent. Configuration guidelines Follow these guidelines when you create a static binding and enable address check: • The dhcp relay address-check enable command can be executed only on VLAN interfaces. • Before enabling address check on an interface, you must enable the DHCP service, and enable the DHCP relay agent on the interface. Otherwise, the address check configuration is ineffective. • The dhcp relay address-check enable command only checks IP and MAC addresses but not interfaces. • When using the dhcp relay security static command to bind an interface to a static binding entry, make sure that the interface is configured as a DHCP relay agent. Otherwise, address entry conflicts may occur. Configuration procedure To create a static binding and enable address check: Step 1. Enter system view. 2. Create a static binding. 3. Enter interface view. 4. Enable address check. Command Remarks system-view N/A dhcp relay security static ip-address mac-address [ interface interface-type interface-number ] Optional. No static binding is created by default. interface interface-type interface-number N/A dhcp relay address-check enable Disabled by default. Configuring periodic refresh of dynamic client entries A DHCP client unicasts a DHCP-RELEASE message to the DHCP server to release its IP address. The DHCP relay agent simply conveys the message to the DHCP server and does not remove the IP-to-MAC entry of the client. When this feature is enabled, the DHCP relay agent uses the IP address of a client and the MAC address of the DHCP relay interface to send a DHCP-REQUEST message to the DHCP server at specified intervals. 38

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
38
Configuring the DHCP relay agent security
functions
Configuring address check
Address check can block illegal hosts from accessing external networks.
With this feature enabled, the DHCP relay agent can dynamically record clients' IP-to-MAC bindings
after they obtain IP addresses through DHCP. This feature also supports static bindings. You can also
configure static IP-to-MAC bindings on the DHCP relay agent, so users can access external networks
using fixed IP addresses.
Upon receiving a packet from a host, the DHCP relay agent checks the source IP and MAC addresses in
the packet against the recorded dynamic and static bindings. If no match is found, the DHCP relay agent
does not learn the ARP entry of the host, and will not forward any reply to the host, so the host cannot
access external networks via the DHCP relay agent.
Configuration guidelines
Follow these guidelines when you create a static binding and enable address check:
•
The
dhcp relay address-check enable
command can be executed only on VLAN interfaces.
•
Before enabling address check on an interface, you must enable the DHCP service, and enable the
DHCP relay agent on the interface. Otherwise, the address check configuration is ineffective.
•
The
dhcp relay address-check enable
command only checks IP and MAC addresses but not
interfaces.
•
When using the
dhcp relay security static
command to bind an interface to a static binding entry,
make sure that the interface is configured as a DHCP relay agent. Otherwise, address entry
conflicts may occur.
Configuration procedure
To create a static binding and enable address check:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Create a static binding.
dhcp relay security static
ip-address
mac-address
[
interface
interface-type
interface-number
]
Optional.
No static binding is created by
default.
3.
Enter interface view.
interface
interface-type
interface-number
N/A
4.
Enable address check.
dhcp relay address-check
enable
Disabled by default.
Configuring periodic refresh of dynamic client entries
A DHCP client unicasts a DHCP-RELEASE message to the DHCP server to release its IP address. The
DHCP relay agent simply conveys the message to the DHCP server and does not remove the IP-to-MAC
entry of the client.
When this feature is enabled, the DHCP relay agent uses the IP address of a client and the MAC address
of the DHCP relay interface to send a DHCP-REQUEST message to the DHCP server at specified intervals.