DHCP中继+单臂路由+SNOOPING防范非法取得ip

根据DHCP Server全局地址池分配客户端ip并保留各网段200以后的地址备用

dis cu

[V200R003C00]

#

sysname AR1

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

router id 4.4.4.4

#

set cpu-usage threshold 80 restore 75

#

dhcp enable

#

aaa

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default

domain default_admin

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

#

interface GigabitEthernet0/0/0.10 开启子接口作为vlan10网关

dot1q termination vid 10 关联802.1Q的tag流量

ip address 192.168.10.254 255.255.255.0 配置接口ip

arp broadcast enable 允许该接口接收广播arp报文

dhcp select relay 使能中继

dhcp relay server-ip 172.16.10.6 使能中继服务器ip

#

interface GigabitEthernet0/0/0.20

dot1q termination vid 20

ip address 192.168.20.254 255.255.255.0

arp broadcast enable

dhcp select relay

dhcp relay server-ip 172.16.10.6

#

interface GigabitEthernet0/0/0.30

dot1q termination vid 30

ip address 192.168.30.254 255.255.255.0

arp broadcast enable

dhcp select relay

dhcp relay server-ip 172.16.10.6

#

interface GigabitEthernet0/0/1

ip address 12.0.0.1 255.255.255.0

dhcp select relay

dhcp relay server-ip 172.16.10.6

dhcp select global

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

ip address 4.4.4.4 255.255.255.255

#

ospf 1 router-id 4.4.4.4

area 0.0.0.0

network 4.4.4.4 0.0.0.0 宣告自身网段

network 12.0.0.1 0.0.0.0

network 192.168.10.254 0.0.0.0

network 192.168.20.254 0.0.0.0

network 192.168.30.254 0.0.0.0

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

AR2：dis cu

[V200R003C00]

#

sysname AR2

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

router id 5.5.5.5

#

set cpu-usage threshold 80 restore 75

#

dhcp enable

#

aaa

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default

domain default_admin

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 12.0.0.5 255.255.255.0

#

interface GigabitEthernet0/0/1

ip address 172.16.10.5 255.255.255.0

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

ip address 5.5.5.5 255.255.255.255

#

ospf 1 router-id 5.5.5.5

area 0.0.0.0

network 5.5.5.5 0.0.0.0

network 12.0.0.5 0.0.0.0

network 172.16.10.5 0.0.0.0

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

AR3:dis cu

[V200R003C00]

#

sysname AR3

#

snmp-agent local-engineid 800007DB03000000000000

snmp-agent

#

clock timezone China-Standard-Time minus 08:00:00

#

portal local-server load portalpage.zip

#

drop illegal-mac alarm

#

router id 6.6.6.6

#

set cpu-usage threshold 80 restore 75

#

dhcp enable

dhcp check dhcp-rate enable 开启dhcp速率检测

dhcp check dhcp-rate 90 检测收到dhcp请求包的速率最大为90个/s，默认100个/s，防止dhcp泛红洪攻击

#

dhcp server ping packet 10

dhcp server ping timeout 100 分发ip前先检测ip是否被使用dhcp服务器向该ip10 包，速率100ms

#

ip pool vlan10 创建vlan10 地址池

gateway-list 192.168.10.254 配置网关

network 192.168.10.0 mask 255.255.255.0 分发的网段

excluded-ip-address 192.168.10.200 192.168.10.253 排除分发的地址

lease day 0 hour 8 minute 0 DHCP租期时间

dns-list 114.114.114.114 dns

#

ip pool vlan20

gateway-list 192.168.20.254

network 192.168.20.0 mask 255.255.255.0

excluded-ip-address 192.168.20.200 192.168.20.253

lease day 0 hour 8 minute 0

dns-list 114.114.114.114

#

ip pool vlan30

gateway-list 192.168.30.254

network 192.168.30.0 mask 255.255.255.0

excluded-ip-address 192.168.30.200 192.168.30.253

lease day 0 hour 8 minute 0

dns-list 114.114.114.114

#

aaa

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default

domain default_admin

local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$

local-user admin service-type http

#

firewall zone Local

priority 15

#

interface GigabitEthernet0/0/0

ip address 172.16.10.6 255.255.255.0

dhcp select global

#

interface GigabitEthernet0/0/1

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

interface LoopBack0

ip address 6.6.6.6 255.255.255.255

#

ospf 1 router-id 6.6.6.6

area 0.0.0.0

network 6.6.6.6 0.0.0.0

network 172.16.10.6 0.0.0.0

#

user-interface con 0

authentication-mode password

user-interface vty 0 4

user-interface vty 16 20

#

wlan ac

#

return

dis cu

#

sysname SW1

#

vlan batch 10 20 30 创建vlan10 20 30

#

cluster enable

ntdp enable

ndp enable

#

drop illegal-mac alarm

#

dhcp enable

#

dhcp snooping enable 开启snooping检测功能

#

diffserv domain default

#

drop-profile default

#

aaa

authentication-scheme default

authorization-scheme default

accounting-scheme default

domain default

domain default_admin

local-user admin password simple admin

local-user admin service-type http

#

interface Vlanif1

#

interface Vlanif10

#

interface MEth0/0/1

#

interface Ethernet0/0/1

port link-type access

port default vlan 10

dhcp snooping enable 在连接PC端的接口设置不信任dhcp-offer报文，防止非法dhcp

#

interface Ethernet0/0/2

port link-type access

port default vlan 20

dhcp snooping enable

#

interface Ethernet0/0/3

port link-type access

port default vlan 30

dhcp snooping enable 在连接PC端的接口设置不信任dhcp-offer报文，防止非法dhcp

#

interface Ethernet0/0/4

#

interface Ethernet0/0/5

#

interface Ethernet0/0/6

#

interface Ethernet0/0/7

#

interface Ethernet0/0/8

#

interface Ethernet0/0/9

#

interface Ethernet0/0/10

#

interface Ethernet0/0/11

#

interface Ethernet0/0/12

#

interface Ethernet0/0/13

#

interface Ethernet0/0/14

#

interface Ethernet0/0/15

#

interface Ethernet0/0/16

#

interface Ethernet0/0/17

#

interface Ethernet0/0/18

#

interface Ethernet0/0/19

#

interface Ethernet0/0/20

#

interface Ethernet0/0/21

#

interface Ethernet0/0/22

#

interface GigabitEthernet0/0/1

port link-type trunk

port trunk allow-pass vlan 2 to 4094

dhcp snooping trusted 开启信任接口，表示只信任连接DHCP服务器接口过来的DHCP OFFER报文

#

interface GigabitEthernet0/0/2

#

interface NULL0

#

user-interface con 0

user-interface vty 0 4

#

return

实验结果

关键词：DHCP中继+单臂路由+SNOOPING防范非法取得ip