HP 6120XG HP ProCurve Series 6120 Blade Switches Multicast and Routing Guide - Page 103

Multinetted VLANs, Relay Agent Management of DHCP Server Response Packets.

Page 103 highlights

IP Routing Features Configuring DHCP Relay With validation enabled, the relay agent applies stricter rules to variations in the Option 82 field(s) of incoming server responses to determine whether to forward the response to a downstream device or to drop the response due to invalid (or missing) Option 82 information. Table 3-5, below, describes relay agent management of DHCP server responses with optional validation enabled and disabled Table 3-5. Relay Agent Management of DHCP Server Response Packets. Response Packet Content Option 82 Validation Enabled on the Configuration Relay Agent Validation Disabled (The Default) Valid DHCP server response packet without an Option 82 field. append, replace, or drop1 keep2 Drop the server response packet. Forward server response packet to a downstream device. Forward server response Forward server response packet to a downstream device. packet to a downstream device. The server response packet append carries data indicating a given routing switch is the primary relay agent for the original client replace or drop1 request, but the associated Option 82 field in the response keep2 contains a Remote ID and Circuit ID combination that did not originate with the given relay agent. Drop the server response packet. Forward server response packet to a downstream device. Drop the server response packet. Drop the server response packet. Forward server response Forward server response packet to a downstream device. packet to a downstream device. The server response packet append carries data indicating a given routing switch is the primary relay agent for the original client replace or drop1 request, but the associated Option 82 field in the response keep2 contains a Remote ID that did not originate with the relay agent. Drop the server response packet. Forward server response packet to a downstream device. Drop the server response packet. Drop the server response packet. Forward server response Forward server response packet to a downstream device. packet to a downstream device. All other server response packets3 append, keep2, Forward server response Forward server response replace, or drop1 packet to a downstream device. packet to a downstream device. 1Drop is the recommended choice because it protects against an unauthorized client inserting its own Option 82 field for an incoming request. 2A routing switch with DHCP Option 82 enabled with the keep option forwards all DHCP server response packets except those that are not valid for either Option 82 DHCP operation (compliant with RFC 3046) or DHCP operation without Option 82 support (compliant with RFC 2131). 3A routing switch with DHCP Option 82 enabled drops an inbound server response packet if the packet does not have any device identified as the primary relay agent (giaddr = null; refer to RFC 2131). Multinetted VLANs On a multinetted VLAN, each interface can form an Option 82 policy boundary within that VLAN if the routing switch is configured to use IP for the remote ID suboption. That is, if the routing switch is configured with IP as the remote 3-57

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122

IP Routing Features
Configuring DHCP Relay
With validation enabled, the relay agent applies stricter rules to variations in
the Option 82 field(s) of incoming server responses to determine whether to
forward the response to a downstream device or to drop the response due to
invalid (or missing) Option 82 information. Table 3-5, below, describes relay
agent management of DHCP server responses with optional validation
enabled and disabled
Table 3-5.
Relay Agent Management of DHCP Server Response Packets.
Response Packet Content
Option 82
Configuration
Validation Enabled on the
Relay Agent
Validation Disabled
(The Default)
Valid DHCP server response
packet without an Option 82
field.
append
,
replace
,
or
drop
1
Drop the server response
packet.
Forward server response
packet to a downstream device.
keep
2
Forward server response
packet to a downstream device.
Forward server response
packet to a downstream device.
The server response packet
carries data indicating a given
routing switch is the primary relay
agent for the original client
request, but the associated
Option 82 field in the response
contains a
Remote ID
and
Circuit
ID
combination that did not
originate with the given relay
agent.
append
Drop the server response
packet.
Forward server response
packet to a downstream device.
replace
or
drop
1
Drop the server response
packet.
Drop the server response
packet.
keep
2
Forward server response
packet to a downstream device.
Forward server response
packet to a downstream device.
The server response packet
carries data indicating a given
routing switch is the primary relay
agent for the original client
request, but the associated
Option 82 field in the response
contains a
Remote ID
that did not
originate with the relay agent.
append
Drop the server response
packet.
Forward server response
packet to a downstream device.
replace
or
drop
1
Drop the server response
packet.
Drop the server response
packet.
keep
2
Forward server response
packet to a downstream device.
Forward server response
packet to a downstream device.
All other server response
packets
3
append
,
keep
2
,
replace
, or
drop
1
Forward server response
packet to a downstream device.
Forward server response
packet to a downstream device.
1
Drop is the recommended choice because it protects against an unauthorized client inserting its own Option 82 field for ±
an incoming request.±
2
A routing switch with DHCP Option 82 enabled with the
keep
option forwards all DHCP server response packets except ±
those that are not valid for either Option 82 DHCP operation (compliant with RFC 3046) or DHCP operation without Option ±
82 support (compliant with RFC 2131).±
3
A routing switch with DHCP Option 82 enabled drops an inbound server response packet if the packet does not have ±
any device identified as the primary relay agent (
giaddr
= null; refer to RFC 2131).±
Multinetted VLANs
On a multinetted VLAN, each interface can form an Option 82 policy boundary
within that VLAN if the routing switch is configured to use IP for the remote
ID suboption. That is, if the routing switch is configured with IP as the remote
3-57