Overview Show
The Dynamic Host Configuration Protocol (DHCP) is used for configuring hosts with IP address and other configuration parameters without user intervention. The protocol is composed of three components:
The DHCP client sends broadcast request packets to the network; the DHCP servers respond with broadcast packets that offer IP parameters, such as an IP address for the client. After the client chooses the IP parameters, communication between the client and server is by unicast packets. HP routing switches provide the DHCP relay agent to enable communication from a DHCP server to DHCP clients on subnets other than the one the server resides on. The DHCP relay agent transfers DHCP messages from DHCP clients located on a subnet without a DHCP server to other subnets. It also relays answers from DHCP servers to DHCP clients. The DHCP relay agent is transparent to both the client and the server. Neither side is aware of the communications that pass through the DHCP relay agent. As DHCP clients broadcast requests, the DHCP relay agent receives the packets and forwards them to the DHCP server. During this process, the DHCP relay agent increases the hop count by one before forwarding the DHCP message to the server. A DHCP server includes the hop count from the DHCP request that it receives in the response that it returns to the client. DHCP packet forwardingThe DHCP relay agent on the routing switch forwards DHCP client packets to all DHCP servers that are configured in the table administrated for each VLAN. Unicast forwardingThe packets are forwarded using unicast forwarding if the IP address of the DHCP server is a specific host address. The DHCP relay agent sets the destination IP address of the packet to the IP address of the DHCP server and forwards the message. Broadcast forwardingThe packets are forwarded using broadcast forwarding if the IP address of the DHCP server is a subnet address or IP broadcast address (255.255.255.255.) The DHCP relay agent sets the DHCP server IP address to broadcast IP address and is forwarded to all VLANs with configured IP interfaces (except the source VLAN.) Prerequisites for DHCP relay operationFor the DHCP relay agent to work on the switch, you must complete the following steps:
Enabling DHCP relayThe DHCP relay function is enabled by default on an HP routing switch. However, if DHCP has been disabled, you can re-enable it by entering the following command at the global configuration level: HP Switch(config)# dhcp-relay To disable the DHCP relay function, enter the no form of the command: HP Switch(config)# no dhcp-relay Configuring an IP helper addressTo add the IP address of a DHCP server for a specified VLAN on a routing switch, enter the ip helper-address command at the VLAN configuration level as in the following example:
HP Switch(config)# vlan 1 HP Switch(vlan-1)# ip helper-address < ip-addr> To remove the DHCP server helper address, enter the no form of the command: HP Switch(vlan-1)# no ip helper-address < ip-addr> Operating notes
Verifying the DHCP relay configurationViewing the DHCP relay settingUse the show config command (or show running for the running-config file) to display the current DHCP relay setting.
Displaying startup configuration with DHCP relay disabled HP Switch# show config Startup configuration: ; J9726A Configuration Editor; Created on release #xx.15.xx hostname “HP Switch” cdp run module 1 type J9726A ip default-gateway 18.30.240.1 snmp-server community “public” Unrestricted vlan 1 name “DEFAULT_VLAN” untagged A1 ip address 18.30.240.180 255.255.248.0 no untagged A2-A24 exit no dhcp-relay
Viewing DHCP helper addressesTo display the list of currently configured IP Helper addresses for a specified VLAN on the switch, enter the show ip helper-address vlan command. Syntax:
The following command lists the currently configured IP Helper addresses for VLAN 1. Displaying IP helper addresses HP Switch(config)# show ip helper-address vlan 1 IP Helper Addresses IP Helper Address ----------------- 10.28.227.97 10.29.227.53DHCP Option 82Option 82 is called the relay agent information option and is inserted by the DHCP relay agent when forwarding client-originated DHCP packets to a DHCP server. Servers recognizing the relay agent information option may use the information to implement IP address or other parameter assignment policies. The DHCP server echoes the option back verbatim to the relay agent in server-to-client replies, and the relay agent strips the option before forwarding the reply to the client. The relay agent information option is organized as a single DHCP option that contains one or more suboptions that convey information known by the relay agent. The initial suboptions are defined for a relay agent that is co-located in a public circuit access unit. These include a circuit ID for the incoming circuit and a remote ID that provides a trusted identifier for the remote high-speed modem. The routing switch can operate as a DHCP relay agent to enable communication between a client and a DHCP server on a different subnet. Without Option 82, DHCP operation modifies client IP address request packets to the extent needed to forward the packets to a DHCP server. Option 82 enhances this operation by enabling the routing switch to append an Option 82 field to such client requests. This field includes two suboptions for identifying the routing switch (by MAC address or IP address) and the routing switch port the client is using to access the network. A DHCP server with Option 82 capability can read the appended field and use this data as criteria for selecting the IP addressing it will return to the client through the usual DHCP server response packet. This operation provides several advantages over DHCP without Option 82:
It is not necessary for all relay agents on the path between a DHCP client and the server to support Option 82, and a relay agent without Option 82 should forward DHCP packets regardless of whether they include Option 82 fields. However, Option 82 relay agents should be positioned at the DHCP policy boundaries in a network to provide maximum support and security for the IP addressing policies configured in the server. Option 82 server supportTo apply DHCP Option 82, the routing switch must operate in conjunction with a server that supports Option 82. (DHCP servers that do not support Option 82 typically ignore Option 82 fields.) Also, the routing switch applies Option 82 functionality only to client request packets being routed to a DHCP server. DHCP relay with Option 82 does not apply to switched (non-routed) client requests. For information on configuring policies on a server running DHCP Option 82, see the documentation provided for that application. Example of a DHCP Option 82 application General DHCP Option 82 requirements and operationRequirementsDHCP Option 82 operation is configured at the global config level and requires the following:
General DHCP-relay operation with Option 82Typically, the first (primary) Option 82 relay agent to receive a client's DHCP request packet appends an Option 82 field to the packet and forwards it toward the DHCP server identified by the IP helper address configured on the VLAN in which the client packet was received. Other, upstream relay agents used to forward the packet may append their own Option 82 fields, replace the Option 82 fields they find in the packet, forward the packet without adding another field, or drop the packet. (Intermediate next-hop routing switches without Option 82 capability can be used to forward—route—client request packets with Option 82 fields.) Response packets from an Option 82 server are routed back to the primary relay agent (routing switch) and include an IP addressing assignment for the requesting client and an exact copy of the Option 82 data the server received with the client request. The relay agent strips off the Option 82 data and forwards the response packet out the port indicated in the response as the Circuit ID (client access port.) Under certain validation conditions described later in this section, a relay agent detecting invalid Option 82 data in a response packet may drop the packet. Example of DHCP Option 82 operation in a network with a non-compliant relay agent Option 82 field contentThe remote ID and circuit ID subfields comprise the Option 82 field a relay agent appends to client requests. A DHCP server configured to apply a different IP addressing policy to different areas of a network uses the values in these subfields to determine which DHCP policy to apply to a given client request. Remote IDRemote ID is a configurable subfield that identifies a policy area that comprises either the routing switch as a whole (by using the routing switch MAC address) or an individual VLAN configured on the routing switch (by using the IP address of the VLAN receiving the client request.)
To view the MAC address for a given routing switch, execute the show system-information command in the CLI. Using the CLI to view the switch MAC address HP Switch(config)# show system information Status and Counters - General System Information System Name : HP Switch System Contact : System Location : MAC Age Time (sec) : 300 Time Zone : 0 Daylight Time Rule : None Software revision : xx.15.xx Base MAC Addr : 0026f1-152e10 ROM Version : xx.15.xx Serial Number : CN9458Q011 Allow V1 Modules : Yes Up Time : 68 mins Memory - Total : 58,720,256 CPU Util (%) : 5 Free : 39,500,456 IP Mgmt - Pkts Rx : 28,959 Packet - Total : 3022 Pkts Tx : 1340 Buffers Free : 2902 Lowest : 2742 Missed : 0Circuit IDCircuit ID is a nonconfigurable subfield that identifies the port number of the physical port through which the routing switch received a given DHCP client request and is necessary to identify if you want to configure an Option 82 DHCP server to use the Circuit ID to select a DHCP policy to assign to clients connected to the port. This number is the identity of the inbound port. On HP fixed-port switches, the port number used for the circuit ID is always the same as the physical port number shown on the front of the switch. On HP chassis switches, where a dedicated, sequential block of internal port numbers are reserved for each slot, regardless of whether a slot is occupied, the circuit ID for a given port is the sequential index number for that port position in the slot. (To view the index number assignments for ports in the routing switch, use the walkmib ifname command.) For example, the Circuit ID for port 11 on an HP switch is “11”. Using walkmib to determine the Circuit ID for a port on an HP chassis HP Switch(config)# walkmib ifname ifName.1 = 1 ifName.2 = 2 ifName.3 = 3 ifName.4 = 4 ifName.5 = 5 ifName.6 = 6 ifName.7 = 7 ifName.8 = 8 ifName.9 = 9 ifName.10 = 10 ifName.11 = 11 ifName.12 = 12For example, suppose you want port 10 on a given relay agent to support no more than five DHCP clients simultaneously. You can configure the server to allow only five IP addressing assignments at any one time for the circuit ID (port) and remote ID (MAC address) corresponding to port 10 on the selected relay agent. Similarly, if you want to define specific ranges of addresses for clients on different ports in the same VLAN, you can configure the server with the range of IP addresses allowed for each circuit ID (port) associated with the remote ID (IP address) for the selected VLAN. Forwarding policiesDHCP Option 82 on HP switches offers four forwarding policies, with an optional validation of server responses for three of the policy types (append, replace, or drop.) Configuration options for managing DHCP client request packets
Multiple Option 82 relay agents in a client request pathWhere the client is one router hop away from the DHCP server, only the Option 82 field from the first (and only) relay agent is used to determine the policy boundary for the server response. Where there are multiple Option 82 router hops between the client and the server, you can use different configuration options on different relay agents to achieve the results you want. This includes configuring the relay agents so that the client request arrives at the server with either one Option 82 field or multiple fields. (Using multiple Option 82 fields assumes that the server supports multiple fields and is configured to assign IP addressing policies based on the content of multiple fields.) Example configured to allow only the primary relay agent to contribute an Option 82 field The above combination allows for detection and dropping of client requests with spurious Option 82 fields. If none are found, the drop policy on the first relay agent adds an Option 82 field, which is then kept unchanged over the next two relay agent hops ("B" and "C".) The server can then enforce an IP addressing policy based on the Option 82 field generated by the edge relay agent ("A".) In this example, the DHCP policy boundary is at relay agent 1. Example configured to allow multiple relay agents to contribute an Option 82 field This is an enhancement of the previous example. In this case, each hop for an accepted client request adds a new Option 82 field to the request. A DHCP server capable of using multiple Option 82 fields can be configured to use this approach to keep a more detailed control over leased IP addresses. In this example, the primary DHCP policy boundary is at relay agent "A," but more global policy boundaries can exist at relay agents "B" and "C." Example allowing only an upstream relay agent to contribute an Option 82 field Like the first example, above, this configuration drops client requests with spurious Option 82 fields from clients on the edge relay agent. However, in this case, only the Option 82 field from the last relay agent is retained for use by the DHCP server. In this case the DHCP policy boundary is at relay agent "C." In the previous two examples the boundary was with relay "A." Validation of server response packetsA valid Option 82 server response to a client request packet includes a copy of the Option 82 fields the server received with the request. With validation disabled, most variations of Option 82 information are allowed, and the corresponding server response packets are forwarded. Server response validation is an option you can specify when configuring Option 82 DHCP for append, replace, or drop operation. See Forwarding policies. Enabling validation on the routing switch can enhance protection against DHCP server responses that are either from untrusted sources or are carrying invalid Option 82 information. With validation enabled, the relay agent applies stricter rules to variations in the Option 82 fields of incoming server responses to determine whether to forward the response to a downstream device or to drop the response due to invalid (or missing) Option 82 information. Relay agent management of DHCP server response packets describes relay agent management of DHCP server responses with optional validation enabled and disabled. Relay agent management of DHCP server response packets
Multinetted VLANsOn a multinetted VLAN, each interface can form an Option 82 policy boundary within that VLAN if the routing switch is configured to use IP for the remote ID suboption. That is, if the routing switch is configured with IP as the remote ID option and a DHCP client request packet is received on a multinetted VLAN, the IP address used in the Option 82 field will identify the subnet on which the packet was received instead of the IP address for the VLAN. This enables an Option 82 DHCP server to support more narrowly defined DHCP policy boundaries instead of defining the boundaries at the VLAN or whole routing switch levels. If the MAC address option (the default) is configured instead, the routing switch MAC address will be used regardless of which subnet was the source of the client request. (The MAC address is the same for all VLANs configured on the routing switch.) All request packets from DHCP clients in the different subnets in the VLAN must be able to reach any DHCP server identified by the IP helper addresses configured on that VLAN. Configuring Option 82For information on Option 82, see the sections beginning with DHCP Option 82. To configure DHCP Option 82 on a routing switch, enter the dhcp-relay option 82 command. Syntax:
Example of Option 82 configurationIn the routing switch shown below, option 82 has been configured with mgmt-vlan for the remote ID. HP Switch(config)# dhcp-relay option 82 append mgmt-vlan The resulting effect on DHCP operation for clients X, Y, and Z is shown in DHCP operation for the topology in Figure 11. DHCP Option 82 when using the management VLAN as the remote ID sub-option DHCP operation for the topology in DHCP Option 82 when using the management VLAN as the remote ID sub-option
Operating notes
What is Relay Agent in DHCP?A DHCP relay agent is a host or router that forwards DHCP packets between clients and servers. Network administrators can use the DHCP Relay service of the SD-WAN appliances to relay requests and replies between local DHCP Clients and a remote DHCP Server.
Where is DHCP relay agent configure?To configure DHCP relay, from Fireware Web UI: Select Network > Interfaces.. Select a trusted, optional, or custom interface and click Configure.. From the drop-down list at the bottom of the page, select Use DHCP Relay.. In the DHCP Server text box, type the IP address of a DHCP server and click Add.. Which of the following services does DHCP provide?DHCP provides the following benefits. Reliable IP address configuration. DHCP minimizes configuration errors caused by manual IP address configuration, such as typographical errors, or address conflicts caused by the assignment of an IP address to more than one computer at the same time. Reduced network administration.
What is DHCP relay and when would you use it?DHCP is a client server protocol that automatically provides IP hosts with IP addresses and other related configuration information. A DHCP relay (agent) is a host that forwards DHCP packets between clients and servers that are not on the same physical subnet.
|