DHCP

DHCP支持配置两种地址池，包括全局地址池和接口地址池

DHCP 接口地址池配置

DHCP 全局地址池配置

DHCP 中继

DHCP Snooping   #用于二层设备   #将可信的DHCP服务器的接口设置为“信任”接口， 从而防止PC从非法的DHCP服务器获取地址

DHCP 接口地址池配置

[Huawei]dhcp enable

[Huawei]interface GigabitEthernet0/0/0

[Huawei-GigabitEthernet0/0/0]ip address 192.168.10.254 24

[Huawei-GigabitEthernet0/0/0]dhcp select interface

[Huawei-GigabitEthernet0/0/0]dhcp server excluded-ip-address 192.168.10.250  192.168.10.253

[Huawei-GigabitEthernet0/0/0]dhcp server lease day 2

[Huawei-GigabitEthernet0/0/0]dhcp server dns-list 8.8.8.8

[Huawei]dis cu

#

dhcp enable

#

interface GigabitEthernet0/0/0

 ip address 192.168.10.254 255.255.255.0

 dhcp select interface

 dhcp server excluded-ip-address 192.168.10.250 192.168.10.253

 dhcp server lease day 2 hour 0 minute 0

 dhcp server dns-list 8.8.8.8

#

DHCP支持配置两种地址池，包括全局地址池和接口地址池。

dhcp enable命令用来使能DHCP功能。在配置DHCP服务器时，必须先执行dhcp enable命令，才能配置DHCP的其他功能并生效。

dhcp select interface命令用来关联接口和接口地址池，为连接到接口的主机提供配置信息。在本示例中，接口GigabitEthernet 0/0/0被加入接口地址池中。

dhcp server dns-list命令用来指定接口地址池下的DNS服务器地址。

dhcp server excluded-ip-address命令用来配置接口地址池中不参与自动分配的IP地址范围。

dhcp server lease命令用来配置DHCP服务器接口地址池中IP地址的租用有效期限功能。缺省情况下，接口地址池中IP地址的租用有效期限为1天。

DHCP 全局地址池配置

[Huawei]dhcp enable

[Huawei]interface GigabitEthernet0/0/0

[Huawei-GigabitEthernet0/0/0]ip address 192.168.10.254 24

[Huawei-GigabitEthernet0/0/0]dhcp select global

[Huawei]ip pool IPPOOL

[Huawei-ip-pool-IPPOOL]gateway-list 192.168.10.254

[Huawei-ip-pool-IPPOOL]network 192.168.1.0 mask 255.255.255.0

[Huawei-ip-pool-IPPOOL]excluded-ip-address 192.168.1.250 192.168.1.253

[Huawei-ip-pool-IPPOOL] lease day 2

[Huawei]dis cu

#

ip pool IPPOOL

 gateway-list 192.168.1.254

 network 192.168.10.0 mask 255.255.255.0

excluded-ip-address 192.168.10.250 192.168.10.253

lease day 2 hour 0 minute 0

 #

interface GigabitEthernet0/0/0

ip address 192.168.10.254 255.255.255.0

dhcp select global

#

ip pool命令用来创建全局地址池。

network命令用来配置全局地址池下可分配的网段地址。

gateway-list命令用来配置DHCP服务器全局地址池的出口网关地址。

lease命令用来配置DHCP全局地址池下的地址租期。缺省情况下，IP地址租期是1天。

dhcp select global命令用来使能接口的DHCP服务器功能。

DHCP 中继

 

DHCP Server 

sysname  DHCP server

#

dhcp enable

#

ip pool Vlan10

 gateway-list 192.168.10.1

 network 192.168.10.0 mask 255.255.255.0

 excluded-ip-address 192.168.10.250 192.168.10.254

 lease day 2 hour 0 minute 0

 dns-list 8.8.8.8

#

ip pool Vlan20

 gateway-list 192.168.20.1

 network 192.168.20.0 mask 255.255.255.0

 excluded-ip-address 192.168.20.250 192.168.20.254

 lease day 2 hour 0 minute 0

 dns-list 8.8.8.8

#

ip pool Vlan30

 gateway-list 192.168.30.1

 network 192.168.30.0 mask 255.255.255.0

 excluded-ip-address 192.168.30.250 192.168.30.254

 lease day 2 hour 0 minute 0

 dns-list 8.8.8.8

#

#

interface GigabitEthernet0/0/0

 ip address 192.168.100.254 255.255.255.0

 dhcp select global

#

ip route-static 0.0.0.0 0.0.0.0 192.168.100.1

SWITCH

sysname switch

#

vlan batch 10 20 30 100

#

interface Vlanif10

 ip address 192.168.10.1 255.255.255.0

 dhcp select relay

 dhcp relay server-ip 192.168.100.254

#

interface Vlanif20

 ip address 192.168.20.1 255.255.255.0

 dhcp select relay

 dhcp relay server-ip 192.168.100.254

#

interface Vlanif30

 ip address 192.168.30.1 255.255.255.0

 dhcp select relay

 dhcp relay server-ip 192.168.100.254

#

interface Vlanif100

 ip address 192.168.100.1 255.255.255.0

#

interface GigabitEthernet0/0/1

 port link-type access

 port default vlan 10

#

interface GigabitEthernet0/0/2

 port link-type access

 port default vlan 20

#

interface GigabitEthernet0/0/3

 port link-type access

 port default vlan 30

#

interface GigabitEthernet0/0/4

 port link-type access

 port default vlan 100

DHCP snoonpipng 使用  场景

 

如果客户端获取到 非法的DHCP服务 将无法上网

接入层交换机:

#

dhcp enable

dhcp snooping enable

dhcp snooping enable vlan 10           #针对某一个Vlan启用

#

interface  GigabitEthernet  0/0/3       #将上联接口设为信任接口

dhcp snooping trusted