華為DHCP Snooping配置實例

1、DHCP Snooping配置介紹DHCP Snooping的原理和配置方法，并給出配置舉例。配置DHCP Snooping的攻擊防范功能示例組網(wǎng)需求如圖9-13所示，SwitchA與SwitchB為接入設備，SwitchC為DHCP Relay。Client1與Client2分別通過GE0/0/1與GE0/0/2接入SwitchA，Client3通過GE0/0/1接入SwitchB，其中Client1與Client3通過DHCP方式獲取IPv4地址，而Client2使用靜態(tài)配置的IPv4地址。網(wǎng)絡中存在非法用戶的攻擊導致合法用戶不能正常獲取IP地址，管理員希望能夠防止網(wǎng)絡中針對DHCP的攻擊

2、，為DHCP用戶提供更優(yōu)質(zhì)的服務。圖9-13 配置DHCP Snooping的攻擊防范功能組網(wǎng)圖 配置思路采用如下的思路在SwitchC上進行配置。1. 使能DHCP Snooping功能并配置設備僅處理DHCPv4報文。 2. 配置接口的信任狀態(tài)，以保證客戶端從合法的服務器獲取IP地址。 3. 使能ARP與DHCP Snooping的聯(lián)動功能，保證DHCP用戶在異常下線時實時更新綁定表。 4. 使能根據(jù)DHCP Snooping綁定表生成接口的靜態(tài)MAC表項功能，以防止非DHCP用戶攻擊。 5. 使能對DHCP報文進行綁定表匹配檢查的功能，防止仿冒DHCP報文攻擊。 6. 配置DHCP報文上

3、送DHCP報文處理單元的最大允許速率，防止DHCP報文泛洪攻擊。 7. 配置允許接入的最大用戶數(shù)以及使能檢測DHCP Request報文幀頭MAC與DHCP數(shù)據(jù)區(qū)中CHADDR字段是否一致功能，防止DHCP Server服務拒絕攻擊。 操作步驟1. 使能DHCP Snooping功能。 # 使能全局DHCP Snooping功能并配置設備僅處理DHCPv4報文。<HUAWEI> system-viewHUAWEI sysname SwitchCSwitchC dhcp enableSwitchC dhcp snooping enable ipv4# 使能用戶側接口的DHCP Sno

4、oping功能。以GE0/0/1接口為例，GE0/0/2的配置相同，此處省略。SwitchC interface gigabitethernet 0/0/1SwitchC-GigabitEthernet0/0/1 dhcp snooping enableSwitchC-GigabitEthernet0/0/1 quit2. 配置接口的信任狀態(tài)：將連接DHCP Server的接口狀態(tài)配置為“Trusted”。 3. SwitchC interface gigabitethernet 0/0/34. SwitchC-GigabitEthernet0/0/3 dhcp snooping truste

5、dSwitchC-GigabitEthernet0/0/3 quit5. 使能ARP與DHCP Snooping的聯(lián)動功能。 SwitchC arp dhcp-snooping-detect enable6. 使能根據(jù)DHCP Snooping綁定表生成接口的靜態(tài)MAC表項功能。 # 在用戶側接口進行配置。以GE0/0/1接口為例，GE0/0/2的配置相同，此處省略。SwitchC interface gigabitethernet 0/0/1SwitchC-GigabitEthernet0/0/1 dhcp snooping sticky-macSwitchC-GigabitEthernet

6、0/0/1 quit7. 使能對DHCP報文進行綁定表匹配檢查的功能。 # 在用戶側接口進行配置。以GE0/0/1接口為例，GE0/0/2的配置相同，此處省略。SwitchC interface gigabitethernet 0/0/1SwitchC-GigabitEthernet0/0/1 dhcp snooping check dhcp-request enableSwitchC-GigabitEthernet0/0/1 quit8. 配置DHCP報文上送DHCP報文處理單元的最大允許速率為90pps。 9. SwitchC dhcp snooping check dhcp-rate e

7、nableSwitchC dhcp snooping check dhcp-rate 9010. 使能檢測DHCP Request報文中GIADDR字段是否非零的功能。 # 在用戶側接口進行配置。以GE0/0/1接口為例，GE0/0/2的配置相同，此處省略。SwitchC interface gigabitethernet 0/0/1SwitchC-GigabitEthernet0/0/1 dhcp snooping check dhcp-giaddr enableSwitchC-GigabitEthernet0/0/1 quit11. 配置接口允許接入的最大用戶數(shù)并使能對CHADDR字段檢查

8、功能。 # 在用戶側接口進行配置。以GE0/0/1接口為例，GE0/0/2的配置相同，此處省略。SwitchC interface gigabitethernet 0/0/1SwitchC-GigabitEthernet0/0/1 dhcp snooping max-user-number 20SwitchC-GigabitEthernet0/0/1 dhcp snooping check dhcp-chaddr enableSwitchC-GigabitEthernet0/0/1 quit12. 配置丟棄報文告警和報文限速告警功能。 # 使能丟棄報文告警功能，并配置丟棄報文告警閾值。以GE0

9、/0/1接口為例，GE0/0/2的配置相同，此處省略。SwitchC interface gigabitethernet 0/0/1SwitchC-GigabitEthernet0/0/1 dhcp snooping alarm dhcp-chaddr enableSwitchC-GigabitEthernet0/0/1 dhcp snooping alarm dhcp-request enableSwitchC-GigabitEthernet0/0/1 dhcp snooping alarm dhcp-reply enableSwitchC-GigabitEthernet0/0/1 dhcp

10、 snooping alarm dhcp-chaddr threshold 120SwitchC-GigabitEthernet0/0/1 dhcp snooping alarm dhcp-request threshold 120SwitchC-GigabitEthernet0/0/1 dhcp snooping alarm dhcp-reply threshold 120SwitchC-GigabitEthernet0/0/1 quit# 使能報文限速告警功能，并配置報文限速告警閾值。SwitchC dhcp snooping alarm dhcp-rate enableSwitchC d

11、hcp snooping alarm dhcp-rate threshold 50013. 驗證配置結果 # 執(zhí)行命令display dhcp snooping configuration查看DHCP Snooping的配置信息。SwitchC display dhcp snooping configuration# dhcp snooping enable ipv4 dhcp snooping check dhcp-rate enable dhcp snooping check dhcp-rate 90 dhcp snooping alarm dhcp-rate enable dhcp sn

12、ooping alarm dhcp-rate threshold 500 arp dhcp-snooping-detect enable # interface GigabitEthernet0/0/1 dhcp snooping enable dhcp snooping check dhcp-giaddr enable dhcp snooping check dhcp-request enable dhcp snooping alarm dhcp-request enable dhcp snooping alarm dhcp-request threshold 120 dhcp snoopi

13、ng check dhcp-chaddr enable dhcp snooping alarm dhcp-chaddr enable dhcp snooping alarm dhcp-chaddr threshold 120 dhcp snooping alarm dhcp-reply enable dhcp snooping alarm dhcp-reply threshold 120 dhcp snooping max-user-number 20# interface GigabitEthernet0/0/2 dhcp snooping enable dhcp snooping chec

14、k dhcp-giaddr enable dhcp snooping check dhcp-request enable dhcp snooping alarm dhcp-request enable dhcp snooping alarm dhcp-request threshold 120 dhcp snooping check dhcp-chaddr enable dhcp snooping alarm dhcp-chaddr enable dhcp snooping alarm dhcp-chaddr threshold 120 dhcp snooping alarm dhcp-rep

15、ly enable dhcp snooping alarm dhcp-reply threshold 120 dhcp snooping max-user-number 20# interface GigabitEthernet0/0/3 dhcp snooping trusted # # 執(zhí)行命令display dhcp snooping interface查看接口下的DHCP Snooping運行信息。SwitchC display dhcp snooping interface gigabitethernet 0/0/1 DHCP snooping running information

16、 for interface GigabitEthernet0/0/1 : DHCP snooping : Enable Trusted interface : No Dhcp user max number : 20 Current dhcp and nd user number : 0 Check dhcp-giaddr : Enable Check dhcp-chaddr : Enable Alarm dhcp-chaddr : Enable Alarm dhcp-chaddr threshold : 120 Discarded dhcp packets for check chaddr

17、 : 0 Check dhcp-request : Enable Alarm dhcp-request : Enable Alarm dhcp-request threshold : 120 Discarded dhcp packets for check request : 0 Check dhcp-rate : Disable (default) Alarm dhcp-rate : Disable (default) Alarm dhcp-rate threshold : 500 Discarded dhcp packets for rate limit : 0 Alarm dhcp-re

18、ply : Enable Alarm dhcp-reply threshold : 120 Discarded dhcp packets for check reply : 0 SwitchC display dhcp snooping interface gigabitethernet 0/0/3 DHCP snooping running information for interface GigabitEthernet0/0/3 : DHCP snooping : Disable (default) Trusted interface : Yes Dhcp user max number

19、 : 1024 (default) Current dhcp and nd user number : 0 Check dhcp-giaddr : Disable (default) Check dhcp-chaddr : Disable (default) Alarm dhcp-chaddr : Disable (default) Check dhcp-request : Disable (default) Alarm dhcp-request : Disable (default) Check dhcp-rate : Disable (default) Alarm dhcp-rate :

20、Disable (default) Alarm dhcp-rate threshold : 500 Discarded dhcp packets for rate limit : 0 Alarm dhcp-reply : Disable (default) 配置文件# SwitchC的配置文件# sysname SwitchC# dhcp enable # dhcp snooping enable ipv4 dhcp snooping check dhcp-rate enable dhcp snooping check dhcp-rate 90 dhcp snooping alarm dhcp

21、-rate enable dhcp snooping alarm dhcp-rate threshold 500 arp dhcp-snooping-detect enable #interface GigabitEthernet0/0/1 dhcp snooping sticky-mac dhcp snooping enable dhcp snooping check dhcp-giaddr enable dhcp snooping check dhcp-request enable dhcp snooping alarm dhcp-request enable dhcp snooping alarm dhcp-request threshold 120 dhcp snooping check dhcp-chaddr enable