华为DHCPSnooping配置实例Word文档下载推荐.docx
- 文档编号:16793608
- 上传时间:2022-11-26
- 格式:DOCX
- 页数:8
- 大小:29.99KB
华为DHCPSnooping配置实例Word文档下载推荐.docx
《华为DHCPSnooping配置实例Word文档下载推荐.docx》由会员分享,可在线阅读,更多相关《华为DHCPSnooping配置实例Word文档下载推荐.docx(8页珍藏版)》请在冰豆网上搜索。
2.配置接口的信任状态,以包管客户端从合法的办事器获取IP地址。
3.使能ARP与DHCPSnooping的联动功能,包管DHCP用户在异常下线时实时更新绑定表。
4.使能根据DHCPSnooping绑定表生成接口的静态MAC表项功能,以避免非DHCP用户攻击。
5.使能对DHCP报文进行绑定表匹配检查的功能,避免仿冒DHCP报文攻击。
6.配置DHCP报文上送DHCP报文处理单位的最年夜允许速率,避免DHCP报文泛洪攻击。
7.配置允许接入的最年夜用户数以及使能检测DHCPRequest报文帧头MAC与DHCP数据区中CHADDR字段是否一致功能,避免DHCPServer办事拒绝攻击。
操纵步调
1.使能DHCPSnooping功能。
#使能全局DHCPSnooping功能并配置设备仅处理DHCPv4报文。
<
HUAWEI>
systemview
[HUAWEI]sysnameSwitchC
[SwitchC]dhcpenable
[SwitchC]dhcpsnoopingenableipv4
#使能用户侧接口的DHCPSnooping功能。
以GE0/0/1接口为例,GE0/0/2的配置相同,此处省略。
[SwitchC]interfacegigabitethernet0/0/1
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingenable
[SwitchCGigabitEthernet0/0/1]quit
2.配置接口的信任状态:
将连接DHCPServer的接口状态配置为“Trusted”。
3.[SwitchC]interfacegigabitethernet0/0/3
4.[SwitchCGigabitEthernet0/0/3]dhcpsnoopingtrusted
[SwitchCGigabitEthernet0/0/3]quit
5.使能ARP与DHCPSnooping的联动功能。
[SwitchC]arpdhcpsnoopingdetectenable
6.使能根据DHCPSnooping绑定表生成接口的静态MAC表项功能。
#在用户侧接口进行配置。
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingstickymac
7.使能对DHCP报文进行绑定表匹配检查的功能。
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingcheckdhcprequestenable
8.配置DHCP报文上送DHCP报文处理单位的最年夜允许速率为90pps。
9.[SwitchC]dhcpsnoopingcheckdhcprateenable
[SwitchC]dhcpsnoopingcheckdhcprate90
10.使能检测DHCPRequest报文中GIADDR字段是否非零的功能。
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingcheckdhcpgiaddrenable
11.配置接口允许接入的最年夜用户数并使能对CHADDR字段检查功能。
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingmaxusernumber20
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingcheckdhcpchaddrenable
12.配置抛弃报文告警和报文限速告警功能。
#使能抛弃报文告警功能,并配置抛弃报文告警阈值。
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingalarmdhcpchaddrenable
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingalarmdhcprequestenable
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingalarmdhcpreplyenable
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingalarmdhcpchaddrthreshold120
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingalarmdhcprequestthreshold120
[SwitchCGigabitEthernet0/0/1]dhcpsnoopingalarmdhcpreplythreshold120
#使能报文限速告警功能,并配置报文限速告警阈值。
[SwitchC]dhcpsnoopingalarmdhcprateenable
[SwitchC]dhcpsnoopingalarmdhcpratethreshold500
13.验证配置结果
#执行命令displaydhcpsnoopingconfiguration检查DHCPSnooping的配置信息。
[SwitchC]displaydhcpsnoopingconfiguration
#
dhcpsnoopingenableipv4
dhcpsnoopingcheckdhcprateenable
dhcpsnoopingcheckdhcprate90
dhcpsnoopingalarmdhcprateenable
dhcpsnoopingalarmdhcpratethreshold500
arpdhcpsnoopingdetectenable
interfaceGigabitEthernet0/0/1
dhcpsnoopingenable
dhcpsnoopingcheckdhcpgiaddrenable
dhcpsnoopingcheckdhcprequestenable
dhcpsnoopingalarmdhcprequestenable
dhcpsnoopingalarmdhcprequestthreshold120
dhcpsnoopingcheckdhcpchaddrenable
dhcpsnoopingalarmdhcpchaddrenable
dhcpsnoopingalarmdhcpchaddrthreshold120
dhcpsnoopingalarmdhcpreplyenable
dhcpsnoopingalarmdhcpreplythreshold120
dhcpsnoopingmaxusernumber20
interfaceGigabitEthernet0/0/2
interfaceGigabitEthernet0/0/3
dhcpsnoopingtrusted
#执行命令displaydhcpsnoopinginterface检查接口下的DHCPSnooping运行信息。
[SwitchC]displaydhcpsnoopinginterfacegigabitethernet0/0/1
DHCPsnoopingrunninginformationforinterfaceGigabitEthernet0/0/1:
DHCPsnooping:
Enable
Trustedinterface:
No
Dhcpusermaxnumber:
20
Currentdhcpandndusernumber:
0
Checkdhcpgiaddr:
Checkdhcpchaddr:
Alarmdhcpchaddr:
Alarmdhcpchaddrthreshold:
120
Discardeddhcppacketsforcheckchaddr:
Checkdhcprequest:
Alarmdhcprequest:
Alarmdhcprequestthreshold:
Discardeddhcppacketsforcheckrequest:
Checkdhcprate:
Disable(default)
Alarmdhcprate:
Alarmdhcpratethreshold:
500
Discardeddhcppacketsforratelimit:
Alarmdhcpreply:
Alarmdhcpreplythreshold:
Discardeddhcppacketsforcheckreply:
[SwitchC]displaydhcpsnoopinginterfacegigabitethernet0/0/3
DHCPsnoopingrunninginformationforinterfaceGigabitEthernet0/0/3:
Yes
1024(default)
配置文件
#SwitchC的配置文件
sysnameSwitchC
dhcpenable
dhcpsnoopingcheckdhcprateenable
#
interfaceGigabitEthernet0/0/1
dhcpsnoopingstickymac
dhcpsnoopingmaxusernumber20
interfaceGigabitEthernet0/0/2
dhcpsnoopingalarmdhcpreplythreshold120
interfaceGigabitEthernet0/0/3
dhcpsnoopingtrusted
return
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- 华为 DHCPSnooping 配置 实例