1.DHCP原理和实验拓扑
1.1.DHCP原理
DHCP一共有四个阶段：DHCP Discover 、DHCP Offer、DHCP Request、DHCP ACK
DHCP Discover：发送DHCP Discover消息，寻找DHCP Server，表示自己需要获取一个IP地址
DHCP Offer：响应所收到的DHCP Discover消息，把准备提供的IP地址携带在DHCP Offer消息中，并将此消息发送给客户端
DHCP Request：在所有offer中，选择接收到的第一个Offer，并向相应的服务器发送DHCP Request消息
DHCP ACK：如果接收到了DHCP Ack消息，表示客户端可以使用分配的IP地址
1.2.实验拓扑
次数分为了4个DHCP服务器场景
交换机上通过接口池方式配置DHCP服务器
交换机上通过全局地址池方式配置DHCP服务器
路由器上通过接口池方式配置DHCP服务器
路由器上通过全局地址池方式配置DHCP中继
2.基于交换机的DHCP
需要在全局模式中开启DHCP
[LSW1]dhcp enable
2.1.基于接口地址池的DHCP
基于接口池的DHCP配置
[LSW1]dhcp enable
[LSW1]interface Vlanif 5
[LSW1-Vlanif5]
[LSW1-Vlanif5]dhcp select interface
[LSW1-Vlanif5]dhcp server lease day 1
[LSW1-Vlanif5]dhcp server excluded-ip-address 192.168.5.2 192.168.5.20
[LSW1-Vlanif5]dhcp server dns-list 223.6.6.6
[LSW1-Vlanif5]quit
验证DHCP地址获取
PC4>ipconfig
Link local IPv6 address...........: fe80::5689:98ff:fe72:2f77
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.5.254
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.5.1
Physical address..................: 54-89-98-72-2F-77
DNS server........................: 223.6.6.6
PC4>
查看DHCP分配情况
Pool-name : vlanif5
Pool-No : 0
Lease : 1 Days 0 Hours 0 Minutes
Domain-name : -
DNS-server0 : 223.6.6.6
NBNS-server0 : -
Netbios-type : -
Position : Interface Status : Unlocked
Gateway-0 : 192.168.5.1
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
192.168.5.1 192.168.5.254 253 1 233(0) 0 19
-----------------------------------------------------------------------------
Network section :
--------------------------------------------------------------------------
Index IP MAC Lease Status
--------------------------------------------------------------------------
253 192.168.5.254 5489-9872-2f77 119 Used
--------------------------------------------------------------------------
2.2.基于全局地址池的DHCP
基于全局地址池的DHCP的配置
[LSW1]dhcp enable
[LSW1]ip pool vlan4
[LSW1-ip-pool-vlan4]
[LSW1-ip-pool-vlan4]network 192.168.4.0 mask 255.255.255.0
[LSW1-ip-pool-vlan4]
[LSW1-ip-pool-vlan4]gateway-list 192.168.4.1
[LSW1-ip-pool-vlan4]dns-list 223.6.6.6
[LSW1-ip-pool-vlan4]
[LSW1-ip-pool-vlan4]lease day 1
[LSW1-ip-pool-vlan4]excluded-ip-address 192.168.4.2 192.168.4.20
[LSW1-Vlanif5]quit
[LSW1]interface Vlanif 4
[LSW1-Vlanif4]
[LSW1-Vlanif4]dhcp select global
验证DHCP地址获取
PC3>ipconfig
Link local IPv6 address...........: fe80::5689:98ff:fe36:3c8d
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.4.254
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.4.1
Physical address..................: 54-89-98-36-3C-8D
DNS server........................: 223.6.6.6
PC3>
查看DHCP分配情况
Pool-name : vlan4
Pool-No : 1
Lease : 1 Days 0 Hours 0 Minutes
Domain-name : -
DNS-server0 : 223.6.6.6
NBNS-server0 : -
Netbios-type : -
Position : Local Status : Unlocked
Gateway-0 : 192.168.4.1
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
192.168.4.1 192.168.4.254 253 1 233(0) 0 19
-----------------------------------------------------------------------------
Network section :
--------------------------------------------------------------------------
Index IP MAC Lease Status
--------------------------------------------------------------------------
253 192.168.4.254 5489-9836-3c8d 127 Used
--------------------------------------------------------------------------
3.基于AR路由器的DHCP
配置基于接口的DHCP
[AR1]dhcp enable
[AR1]interface GigabitEthernet 0/0/1
[AR1-GigabitEthernet0/0/1]
[AR1-GigabitEthernet0/0/1]dhcp select interface
[AR1-GigabitEthernet0/0/1]dhcp server lease day 1
[AR1-GigabitEthernet0/0/1]dhcp server dns-list 223.6.6.6
[AR1-GigabitEthernet0/0/1]dhcp server excluded-ip-address 192.168.1.2 192.168.1.20
[AR1-GigabitEthernet0/0/1]quit
验证DHCP地址获取
PC1>ipconfig
Link local IPv6 address...........: fe80::5689:98ff:fe51:36e
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.1.254
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.1.1
Physical address..................: 54-89-98-51-03-6E
DNS server........................: 223.6.6.6
PC1>
DHCP分配情况
Pool-name : GigabitEthernet0/0/1
Pool-No : 0
Lease : 1 Days 0 Hours 0 Minutes
Domain-name : -
DNS-server0 : 223.6.6.6
NBNS-server0 : -
Netbios-type : -
Position : Interface Status : Unlocked
Gateway-0 : 192.168.1.1
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
192.168.1.1 192.168.1.254 253 1 233(0) 0 19
-----------------------------------------------------------------------------
Network section :
--------------------------------------------------------------------------
Index IP MAC Lease Status
--------------------------------------------------------------------------
253 192.168.1.254 5489-9851-036e 900 Used
--------------------------------------------------------------------------
4.基于AR路由器的DHCP中继
在AR1上配置DHCP地址池
[AR1]ip pool vlan3
[AR1-ip-pool-vlan3]
[AR1-ip-pool-vlan3]network 192.168.3.0 mask 255.255.255.0
[AR1-ip-pool-vlan3]gateway-list 192.168.3.1
[AR1-ip-pool-vlan3]dns-list 223.6.6.6
[AR1-ip-pool-vlan3]excluded-ip-address 192.168.3.2 192.168.3.20
[AR1-ip-pool-vlan3]lease day 1
[AR1-ip-pool-vlan3]quit
[AR1]interface GigabitEthernet 0/0/0
[AR1-GigabitEthernet0/0/0]
[AR1-GigabitEthernet0/0/0]dhcp select global
[AR1-GigabitEthernet0/0/0]quit
在AR2上配置DHCP中继
[AR2]dhcp enable
[AR2]interface GigabitEthernet 0/0/1
[AR2-GigabitEthernet0/0/1]dhcp select relay
[AR2-GigabitEthernet0/0/1]
[AR2-GigabitEthernet0/0/1]dhcp relay server-ip 192.168.2.1
[AR2-GigabitEthernet0/0/1]quit
验证DHCP地址获取
PC2>ipconfig
Link local IPv6 address...........: fe80::5689:98ff:fe98:546e
IPv6 address......................: :: / 128
IPv6 gateway......................: ::
IPv4 address......................: 192.168.3.254
Subnet mask.......................: 255.255.255.0
Gateway...........................: 192.168.3.1
Physical address..................: 54-89-98-98-54-6E
DNS server........................: 223.6.6.6
PC2>
DHCP分配情况
Pool-name : vlan3
Pool-No : 1
Lease : 1 Days 0 Hours 0 Minutes
Domain-name : -
DNS-server0 : 223.6.6.6
NBNS-server0 : -
Netbios-type : -
Position : Local Status : Unlocked
Gateway-0 : 192.168.3.1
Mask : 255.255.255.0
VPN instance : --
-----------------------------------------------------------------------------
Start End Total Used Idle(Expired) Conflict Disable
-----------------------------------------------------------------------------
192.168.3.1 192.168.3.254 253 1 233(0) 0 19
-----------------------------------------------------------------------------
Network section :
--------------------------------------------------------------------------
Index IP MAC Lease Status
--------------------------------------------------------------------------
253 192.168.3.254 5489-9898-546e 1838 Used
--------------------------------------------------------------------------
5.DHCP服务器安全设计的要点
5.1.DHCP Snooping
交换机通过监听 DHCP 消息来构建和维护一个 DHCP 绑定表。这个表记录了 MAC 地址、IP 地址、租约时间以及连接的端口等信息。通过检查 DHCP 消息是否符合绑定表中的信息，来防止非法的 DHCP 服务器接入网络和恶意客户端获取非法 IP 地址。
[Huawei] dhcp snooping enable
[Huawei] interface gigabitethernet 0/0/1
[Huawei - GigabitEthernet0/0/1] dhcp snooping trust
5.2.租约时间管理
合理设置IP地址的租约时间，可以在一定程度上提高网络的安全性，较短的租约时间可以使 IP 地址更快地被回收重新分配，减少 IP 地址被恶意占用的时间；同时，也可以方便网络管理员及时发现异常的 IP 地址使用情况。推荐的租约时间可以设置成1天，或者12小时，方便释放IP地址
5.3.信任端口与非信任端口设置
在支持 DHCP Snooping 的网络环境中，交换机端口被分为信任端口和非信任端口。信任端口通常是连接合法 DHCP 服务器的端口，允许所有的 DHCP 消息通过；非信任端口连接客户端，只允许合法的 DHCP 请求消息（如 Discover、Request）通过，而对于非法的 DHCP 服务器发出的 Offer、ACK 等消息则会被阻止。
5.4.DHCP分配日志记录
记录DHCP的分配情况，方便安全溯源和追踪。