华为DHCPSnooping配置实例Word文件下载.docx

华为DHCPSnooping配置实例Word文件下载.docx

《华为DHCPSnooping配置实例Word文件下载.docx》由会员分享，可在线阅读，更多相关《华为DHCPSnooping配置实例Word文件下载.docx（12页珍藏版）》请在冰豆网上搜索。

4.使能根据DHCPSnooping绑定表生成接口的静态MAC表

项功能，以避免非DHCP用户攻击。

5.使能对DHCP报文进行绑定表匹配检查的功能，避免仿

冒DHCP报文攻击。

6.配置DHCP报文上送DHCP报文处理单位的最年夜允许速

率，避免DHCP报文泛洪攻击。

7.配置允许接入的最年夜用户数以及使能检测DHCP

Request报文帧头MAC与DHCP数据区屮CHADDR字段是否一致功能，避免DHCPServer办事拒绝攻击。

操纵步调

1.使能DHCPSnooping功能。

#使能全局DHCPSnooping功能并配置设备仅处理

DHCPv4报文。

<

HUAWEI>

systemview

[HUAWEI]sysnameSwitchC

[SwitchC]dhcpenable

[SwitchC]dhcpsnoopingenableipv4

#使能用户侧接口的DHCPSnooping功能。

以GE0/0/1接口为例，GE0/0/2的配置相同，此处省略。

[SwitchC]interfacegigabitethernet0/0/1

[SwitchCGigabitEthernetO/0/1]dhcpsnoopingenable

[SwitchCGigabitEthernetO/O/1]quit

2.配置接口的信任状态：

将连接DHCPServer的接口状态

配置为"

Trusted”。

3.[SwitchC]interfacegigabitethernet0/0/3

4.[SwitchCGigabitEthernet0/0/3]dhcpsnooping

trusted

[SwitchCGigabitEthernetO/0/3]quit

5.使能ARP与DHCPSnooping的联动功能。

[SwitchC]arpdhcpsnoopingdetectenable

6.使能根据DHCPSnooping绑定表生成接口的静态MAC表

项功能。

#在用户侧接口进行配置。

以GE0/0/1接口为例，GE0/0/2的配置相同，此处省略。

[SwitchC]interfacegigabitethernet0/0/1[SwitchCGigabitEthernetO/0/1]dhcpsnoopingstickymac

[SwitchCGigabitEthernetO/0/1]quit

7.使能对DHCP报文进行绑定表匹配检查的功能。

[SwitchCGigabitEthernetO/0/1]dhcpsnoopingcheckdhcprequestenable

8.配置DHCP报文上送DHCP报文处理单位的最年夜允许速

率为90ppso

9.[SwitchC]dhcpsnoopingcheckdhcprateenable[SwitchC]dhcpsnoopingcheckdhcprate90

10.

11.

使能检测DHCPRequest报文屮GIADDR字段是否非零的功能。

[SwitchC]interfacegigabitethernet0/0/1[SwitchCGigabitEthernetO/0/1]dhcpsnoopingcheckdhcpgiaddrenable[SwitchCGigabitEthernetO/O/1]quit

配置接口允许接入的最年夜用户数并使能对CHADDR字段检查功能。

以GE0/0/1接口为例,

GE0/0/2的配置相同，此处省略。

[SwitchC]interfacegigabitethernet0/0/1[SwitchCGigabitEthernetO/0/1]dhcpsnoopingmaxusernumber20

[SwitchCGigabitEthernetO/0/1]dhcpsnoopingcheckdhcpchaddrenable

12.

配置抛弃报文告警和报文限速告警功能。

#使能抛弃报文告警功能，并配置抛弃报文告警阈值。

以GE0/0/1接口为例，GE0/0/2的配置相同，此处省略。

LSwitchCGigabitEthernetO/O/1]

dhcpsnooping

alarmdhcpchaddrenable

alarmdhcprequestenable

[SwitchCGigabitEthernetO/0/1]

alarmdhcpreplyenable

alarmdhcpchaddrthreshold120

[SwitchCGigabitEthernetO/0/1]dhcpsnooping

alarmdhcprequestthreshold120

alarmdhcpreplythreshold120[SwitchCGigabitEthernetO/0/1]quit

#使能报文限速告警功能，并配置报文限速告警阈值。

[SwitchC]dhcpsnoopingalarmdhcprateenable

[SwitchC]dhcpsnoopingalarmdhcpratethreshold

13.验证配置结果

#执行命令displaydhcpsnoopingconfiguration检查DHCPSnooping的配置信息。

[SwitchC]displaydhcpsnoopingconfiguration

dhcpsnoopingdhcpsnoopingdhcpsnoopingdhcpsnoopingdhcpsnooping

enableipv4checkdhcpratecheckdhcpratealarmdhcpratealarmdhcprate

enable

90

threshold500

arpdhcpsnoopingdetectenable

interfaceGigabitEthernetO/0/1

dhcp

snooping

check

dhcpgiaddrenable

dhcprequestenable

alarm

dhcprequestthreshold120

dhcpchaddrenable

dhcpchaddrthreshold120

snoopingalarmdhcpreplyenable

snoopingalarmdhcpreplythreshold120

snoopingmaxusernumber20

interfaceGigabitEthernetO/0/2

dhcpreplyenable

dhcpreplythreshold120

snoopingmaxusernumber20interfaceGigabitEthernetO/0/3

dhcpsnoopingtrusted

#执行命令displaydhcpsnoopinginterface检查接口下的DHCPSnooping运行信息。

[SwitchC]displaydhcpsnoopinginterfacegigabitethernet0/0/1

DHCPsnoopingrunninginformationforinterface

GigabitEthernetO/0/1:

DHCPsnooping:

Enable

:

No

Trustedinterface

Dhcpusermaxnumber:

20

Currentdhcpandndusernumber:

0

Checkdhcpgiaddr:

Checkdhcpchaddr:

Alarmdhcpchaddr:

Alarmdhcpchaddrthreshold:

120

Discardeddhcppacketsforcheckchaddr:

Checkdhcprequest:

Alarmdhcprequest

Alarmdhcprequestthreshold:

Discardeddhcppacketsforcheckrequest:

Checkdhcprate:

Disable（defauIt）

Alarmdhcprate:

Alarmdhcpratethreshold:

500

Discardeddhcppacketsforratelimit:

Alarmdhcpreply:

Alarmdhcpreplythreshold:

Discardeddhcppacketsforcheckreply:

0[SwitchC]displaydhcpsnoopinginterfacegigabitethernet0/0/3

DHCPsnoopingrunninginformationforinterface

GigabitEthernetO/O/3:

Yes

Dhcpusermaxnumber

（defauIt）

Currentdhcpandndusernumber

Checkdhcpgiaddr

Checkdhcpchaddr

Alarmdhcpchaddr

Checkdhcprequest

Checkdhcprate

Alarmdhcprate

Alarmdhcpratethreshold

Discardeddhcppacketsfor:

ratelimit

Alarmdhcpreply

1024

500

Disable（default）

配置文件

#SwitchC的配置文件

#

sysnameSwitchC

#dhcpenable

#dhcpsnoopingenableipv4

dhcpsnoopingcheckdhcprateenable

dhcpsnoopingcheckdhcprate90

dhcpsnoopingalarmdhcprateenable

dhcpsnoopingalarmdhcpratethreshold500

#interfaceGigabitEthernetO/0/1

stickymac

checkdhcpgiaddrenable

checkdhcprequestenable

snoopingalarmdhcprequestenable

snoopingalarmdhcprequestthreshold120

checkdhcpchaddrenable

dhcprequest

threshold120

interfaceGigabitEthernetO/0/3

return

时间:

2021.03.12