一、实验拓扑
二、实验需求
- 要求PC1和PC2通过DHCP方式从DHCP服务器获取到相应网段的IP地址及其他配置信息
- 同时还要求它们之间可以互通,并防止后来设备私接导致DHCP获取错误
三、实验配置
DHCP-Server1
[DHCP-Server1]vlan 10 20 #创建相应VLAN
[DHCP-Server1]dhcp enable #使能DHCP功能
[DHCP-Server1]dhcp server ip-pool vlan10 #创建并配置名为vlan10的DHCP地址池
[DHCP-Server1-dhcp-pool-vlan10]network 192.168.1.0 24 #配置用于分配的网段
[DHCP-Server1-dhcp-pool-vlan10]gateway 192.168.1.254 #配置网关
[DHCP-Server1-dhcp-pool-vlan10]dns 8.8.8.8 #配置dns地址
[DHCP-Server1-dhcp-pool-vlan10]expired day 2 #配置地址租期
[DHCP-Server1-dhcp-pool-vlan10]forbidden-ip 192.168.1.254 #网关地址不允许自动分配
[DHCP-Server1]dhcp server ip-pool vlan20
[DHCP-Server1-dhcp-pool-vlan20]network 192.168.2.0 mask 255.255.255.0
[DHCP-Server1-dhcp-pool-vlan20]gateway-list 192.168.2.254
[DHCP-Server1-dhcp-pool-vlan20]dns-list 8.8.8.8
[DHCP-Server1-dhcp-pool-vlan20]expired day 2
[DHCP-Server1-dhcp-pool-vlan20]forbidden-ip 192.168.2.254
[DHCP-Server1]int vlan 10
[DHCP-Server1-Vlan-interface10]ip add 192.168.1.254 24 #在相应vlan上配置网关即可
[DHCP-Server1-Vlan-interface10]int vlan 20
[DHCP-Server1-Vlan-interface20]ip add 192.168.2.254 24
[DHCP-Server1]int g1/0/1
[DHCP-Server1-GigabitEthernet1/0/1]p l t
[DHCP-Server1-GigabitEthernet1/0/1]p t per v 10 20
SW
[SW]vlan 10 20
[SW]int g1/0/1
[SW-GigabitEthernet1/0/1]p l t
[SW-GigabitEthernet1/0/1]p t per v 10 20
[SW-GigabitEthernet1/0/1]int g1/0/2
[SW-GigabitEthernet1/0/2]p a v 10
[SW-GigabitEthernet1/0/2]int g1/0/3
[SW-GigabitEthernet1/0/3]p a v 20
[SW]dhcp snooping enable #开启DHCP Snooping功能
[SW-GigabitEthernet1/0/1]dhcp snooping trust #端口默认为不信任,配置为信任接口。否则收到OFFER、ACK会丢弃,将无法获取地址
四、实验效果
- 获取过程及效果
- DHCP Snooping功能效果
在SW连接服务器的上行接口上配置DHCP Snooping功能,可以有效防止私接现象。