DHCPSnooping实验
成都创新互联公司基于成都重庆香港及美国等地区分布式IDC机房数据中心构建的电信大带宽，联通大带宽，移动大带宽，多线BGP大带宽租用,是为众多客户提供专业成都服务器托管报价，主机托管价格性价比高，为金融证券行业服务器托管，ai人工智能服务器托管提供bgp线路100M独享，G口带宽及机柜租用的专业成都idc公司。
实验三：DHCP Snooping
1.SW1和SW2上创建VLAN 10，R1-R4划分到VLAN 10,网段为10.1.1.0/24
2.SW之间的Fa0/24-shutdown;Fa0/23指定成Trunk
3.R4模拟合法的DHCP服务器,在R4上完成DHCP Server的配置
4.R3模拟不合法的DHCP服务器,在R3上完成DHCP Server的配置
5.R1的接口IP设置成DHCP获得,并且通过show dhcplease查看DHCP Server
6.在SW1上启用DHCP Snooping,正确配置DHCP snooping,解决此问题.理解DHCP snooping的Trust和untrust的区别.在SW1上查看DHCP Snooping的binding表
7.理解Option82
8.做DHCP限速,SW1的Fa0/1接口每秒最多接收5个DHCP包
R1的配置
R1(config)#int f0/0
R1(config-if)#ip add dhcp
R1(config-if)#no sh
R3的配置
R3(config)#int f0/0
R3(config-if)#ip add 10.10.1.3 255.255.255.0
R3(config-if)#no sh
R3(config)#ip dhcp pool ccie
R3(dhcp-config)#network 10.1.1.0 255.255.255.0
R3(config)#ip dhcp excluded-address 10.1.1.1 10.1.1.50
R4的配置
R4(config)#int e0/0
R4(config-if)#ip add 10.10.1.4 255.255.255.0
R4(config-if)#no sh
R4(config)#ip dhcp pool wolf
R4(dhcp-config)#network 10.1.1.0 255.255.255.0
R4(config)#ip dhcp excluded-address 10.1.1.1 10.1.1.100
SW1的配置
SW1(config)# vlan 10
SW1(config)#int range f0/1 - 3
SW1(config-if)#switchport mode access
SW1(config-if)#switchport access vlan 10
SW1(config)#int f0/24
SW1(config-if)#shut
SW1(config)#int f0/23
SW1(config-if)#switchport trunk encapsulation dot1q
SW1(config-if)#switchport mode trunk
SW2的配置
SW2(config)# vlan 10
SW2(config)#int e0/4
SW2(config-if)#switchport mode access
SW2(config-if)#switchport access vlan 10
R1#sh dhcp lease
Temp IP addr: 10.1.1.51 for peer on Interface: FastEthernet0/0
Temp sub net mask: 255.255.255.0
DHCP Lease server: 10.1.1.3, state: 3 Bound
DHCP transaction id: 12B7
Lease: 86400 secs, Renewal: 43200 secs, Rebind: 75600 secs
Next timer fires after: 11:59:37
Retry count: 0 Client-ID: cisco-0002.4b1e.efe0-Fa0/0
#############################################################
SW1(config)# ip dhcp snooping // 启用dhcp snooping功能
SW1(config)# ip dhcp snooping vlan 10
SW1(config)#int f0/23
SW1(config-if)#ip dhcp snooping trust
SW1(config)#no ip dhcp snooping information option // 关闭option82
或R4(config)#ip dhcp snooping trust relay information trust-all // 在DHCP服务器上
// 启用了DHCP snooping功能的交换机会在discovery消息中添加option82，路由器默认不信任 //
SW1#sh ip dhcp snooping
Switch DHCP snooping is enabled
DHCP snooping is configured on following VLANs:
10
DHCP snooping is operational on following VLANs:
10
Smartlog is configured on following VLANs:
none
Smartlog is operational on following VLANs:
none
DHCP snooping is configured on the following L3 Interfaces:
Insertion of option 82 is enabled
circuit-id default format: vlan-mod-port
remote-id: 0026.997e.1280 (MAC)
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:
Interface Trusted Allow option Rate limit (pps)
---------------------- ------- ------------ ----------------
FastEthernet0/23 yes yes unlimit
SW1#sh ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type VLAN Interface
------------------ --------------- ---------- ------------- ---- --------------------
00:02:4B:1E:EF:E0 10.1.1.103 86108 dhcp-snooping 10 FastEthernet0/1
Total number of bindings: 1
SW1(config)#int f0/1
SW1(config-if)#ip dhcp snooping limit rate 5 // 限制一秒钟接收5个DHCP包
当前文章：DHCPSnooping实验
文章路径：http://ybzwz.com/article/jcechg.html
