H3C 交换机跨网段动态分配IP地址典型配置举例

H3CS5130-EI跨网段动态分配IP地址典型配置举例Copyright©2014杭州华三通信技术有限公司版权所有，保留一切权利。非经本公司书面许可，任何单位和个人不得擅自摘抄、复制本文档内容的部分或全部，并不得以任何形式传播。本文档中的信息可能变动，恕不另行通知。i目录1简介······················································································································································1 2配置前提···············································································································································1 3跨网段动态分配IP地址配置举例···········································································································1 3.1组网需求···············································································································································1 3.2配置思路···············································································································································2 3.3使用版本···············································································································································2 3.4配置步骤···············································································································································2 3.5验证配置···············································································································································5 3.6配置文件···············································································································································5 4相关资料···············································································································································7 11简介本文档介绍了通过DHCP服务器和DHCP中继为用户动态分配IP地址的配置举例。2配置前提本文档中的配置均是在实验室环境下进行的配置和验证，配置前设备的所有参数均采用出厂时的缺省配置。如果您已经对设备进行了配置，为了保证配置效果，请确认现有配置和以下举例中的配置不冲突。本文假设您已了解DHCP相关特性。3跨网段动态分配IP地址配置举例3.1组网需求如图1所示，公司总部和分支机构处于不同的网段，网关DeviceA充当DHCP服务器，要求：•为总部分配10.1.1.2～10.1.1.100之间的IP地址；•为分支机构分配10.1.3.2～10.1.3.100之间的IP地址，其中10.1.3.2～10.1.3.48之间的IP地址分配给分支机构1，10.1.3.49～10.1.3.100之间的IP地址分配给分支机构2；•指定DNS服务器的固定IP地址为10.1.1.3/24，TFTP服务器的固定IP地址为10.1.1.4/24；•分配DNS服务器、TFTP服务器和网关等配置信息。网关DeviceB充当DHCP中继，要求：•通过配置DHCP中继功能，使得DHCP服务器能够为分支机构分配IP地址、DNS服务器、TFTP服务器和网关等配置信息；•防止分支机构中存在非法主机配置静态IP地址访问网络；•为每个区域分配特定范围内的IP地址。图1跨网段动态分配IP地址配置组网图设备接口IP地址设备接口IP地址DeviceADHCPserverTFTPserver10.1.1.4/24DNSserver10.1.1.3/24headquartersDeviceBDHCPrelayVlan-int3GE1/0/1Vlan-int3GE1/0/3branch1branch2Vlan-int3GE1/0/1Vlan-int2GE1/0/2Vlan-int2GE1/0/22DeviceAVlan-int310.1.1.1/24DeviceBVlan-int310.1.3.1/24Vlan-int210.1.2.1/24Vlan-int210.1.2.2/243.2配置思路•DHCPServer分配IP地址时，不能将DNSServer和TFTPServer的IP地址分配出去，所以需要将这两台服务器的IP地址配置为不参与自动分配的IP地址。•启用DHCP中继的用户地址表项记录功能，通过与IPSourceGuard配合，实现只允许匹配用户地址表项中绑定关系的报文通过DHCP中继。•配置DHCP中继支持Option82功能，并在DHCP服务器上配置根据Option82的分配策略，从而实现为每个区域分配特定范围内的IP地址。3.3使用版本本举例是在S5130EI_E-CMW710-R3106版本上进行配置和验证的软件版本。3.4配置步骤1.DeviceA的配置#配置VLAN接口2的IP地址。<DeviceA>system-view[DeviceA]vlan2[DeviceA-vlan2]portGigabitEthernet1/0/2[DeviceA-vlan2]quit[DeviceA]interfaceVlan-interface2[DeviceA-Vlan-interface2]ipaddress10.1.2.124[DeviceA-Vlan-interface2]quit#配置VLAN接口3的IP地址。[DeviceA]vlan3[DeviceA-vlan3]portGigabitEthernet1/0/1[DeviceA-vlan3]quit[DeviceA]interfaceVlan-interface3[DeviceA-Vlan-interface3]ipaddress10.1.1.124[DeviceA-Vlan-interface3]quit#使能DHCP服务。[DeviceA]dhcpenable#配置VLAN接口2工作在DHCP服务器模式。[DeviceA]interfacevlan-interface2[DeviceA-Vlan-interface2]dhcpselectserver[DeviceA-Vlan-interface2]quit#配置VLAN接口3工作在DHCP服务器模式。[DeviceA]interfacevlan-interface33[DeviceA-Vlan-interface3]dhcpselectserver[DeviceA-Vlan-interface3]quit#配置DHCP地址池1。[DeviceA]dhcpserverip-pool1#配置地址池动态分配的主网段和IP地址范围。[DeviceA-dhcp-pool-1]network10.1.1.0mask255.255.255.0[DeviceA-dhcp-pool-1]addressrange10.1.1.210.1.1.100#配置DHCP客户端使用的DNS服务器地址、TFTP服务器地址、域名后缀和网关地址。[DeviceA-dhcp-pool-1]dns-list10.1.1.3[DeviceA-dhcp-pool-1]tftp-serverip-address10.1.1.4[DeviceA-dhcp-pool-1]domain-namecom[DeviceA-dhcp-pool-1]gateway-list10.1.1.1#配置DHCP地址池中不参与自动分配的IP地址。[DeviceA-dhcp-pool-1]forbidden-ip10.1.1.310.1.1.4[DeviceA-dhcp-pool-1]quit#配置VLAN接口3引用地址池1。[DeviceA]interfaceVlan-interface3[DeviceA-Vlan-interface3]dhcpserverapplyip-pool1[DeviceA-Vlan-interface3]quit#为使Option82功能正常使用，需要在DHCP服务器和DHCP中继上都进行相应配置。如下为DHCP服务器上的相关配置：#创建DHCP用户类aa，匹配请求报文中包含Option82选项，并且该选项的第5字节到第6字节为0x0001（表示连接端口为GE1/0/1）的客户端。[DeviceA]dhcpclassaa[DeviceA-dhcp-class-aa]if-matchoption82hex0001offset4length2[DeviceA-dhcp-class-aa]quit#创建DHCP用户类bb，匹配请求报文中包含Option82选项，并且该选项的第5字节到第6字节为0x0003（表示连接端口为GE1/0/3）的客户端。[DeviceA]dhcpclassbb[DeviceA-dhcp-class-bb]if-matchoption82hex0003offset4length2[DeviceA-dhcp-class-bb]quit#配置DHCP地址池2。[DeviceA]dhcpserverip-pool2#配置地址池动态分配的主网段。[DeviceA-dhcp-pool-2]network10.1.3.0mask255.255.255.0#配置DHCP地址池为DHCP用户类aa动态分配的IP地址范围。[DeviceA-dhcp-pool-2]classaarange10.1.3.210.1.3.48#配置DHCP地址池为DHCP用户类bb动态分配的IP地址范围。[DeviceA-dhcp-pool-2]classbbrange10.1.3.4910.1.3.100#配置DHCP客户端使用的DNS服务器地址、TFTP服务器地址、域名后缀和网关地址。4[DeviceA-dhcp-pool-2]tftp-serverip-address10.1.1.4[DeviceA-dhcp-pool-2]dns-list10.1.1.3[DeviceA-dhcp-pool-2]domain-namecom[DeviceA-dhcp-pool-2]gateway-list10.1.3.1[DeviceA-dhcp-pool-2]quit#配置VLAN接口2引用地址池2。[DeviceA]interfaceVlan-interface2[DeviceA-Vlan-interface2]dhcpserverapplyip-pool2[DeviceA-Vlan-interface2]quit#配置到10.1.3.0网段的静态路由。[DeviceA]iproute-static10.1.3.02410.1.2.22.DeviceB的配置#配置VLAN接口2的IP地址。<DeviceB>system-view[DeviceB]vlan2[DeviceB-vlan2]portGigabitEthernet1/0/2[DeviceB-vlan2]quit[DeviceB]interfaceVlan-interface2[DeviceB-Vlan-interface2]ipaddress10.1.2.224[DeviceB-Vlan-interface2]quit#配置VLAN接口3的IP地址。[DeviceB]vlan3[DeviceB-vlan3]portGigabitEthernet1/0/1[DeviceB-vlan3]portGigabitEthernet1/0/3[DeviceB-vlan3]quit[DeviceB]interfaceVlan-interface3[DeviceB-Vlan-interface3]ipaddress10.1.3.124[DeviceB-Vlan-interface3]quit#使能DHCP服务。[DeviceB]dhcpenable#配置VLAN接口3工作在DHCP中继模式。[DeviceB]interfacevlan-interface3[DeviceB-Vlan-interface3]dhcpselectrelay#指定DHCP服务器的地址。[DeviceB-Vlan-interface3]dhcprelayserver-address10.1.2.1#为使Option82功能正常使用，需要在DHCP服务器和DHCP中继上都进行相应配置。如下为DHCP中继上的相关配置：#使能DHCP中继支持Option82功能。[DeviceB-Vlan-interface3]dhcprelayinformationenable[DeviceB-Vlan-interface3]quit5#开启DHCP中继用户地址表项记录功能。[DeviceB]dhcprelayclient-informationrecord#配置IPv4动态绑定功能。[DeviceB]interfacevlan-interface3[DeviceB-Vlan-interface3]ipverifysourceip-addressmac-address[DeviceB-Vlan-interface3]quit#配置到10.1.1.0网段的静态路由。[DeviceB]iproute-static10.1.1.02410.1.2.13.5验证配置#显示IP地址10.1.3.3的DHCP地址绑定信息，可以查看到该地址已经被分配出去。<DeviceA>displaydhcpserverip-in-useip10.1.3.3IPaddressClientidentifier/LeaseexpirationTypeHardwareaddress10.1.3.30033-6365-352e-6136-Jan200:34:022011Auto(C)6466-2e65-3133-392d-5465-6e2d-4769-6761-6269-7445-7468-6572-6e65-7431-2f30-2f35-31#在分支机构1中的某一用户PC上输入如下命令，可查看申请到的IP地址。按照同样的方式，可以确认分支机构2中的用户也得到指定范围内的地址。C:\DocumentsandSettings\aa>ipconfigWindowsIPConfigurationEthernetadapteraa:Connection-specificDNSSuffix.:domain-namecomIPAddress............:10.1.3.3SubnetMask...........:255.255.255.0IPAddress............:fe80::20f:3dff:fe80:2b38%4DefaultGateway.........:10.1.3.1#假设分支机构2里的非法用户配置了一个10.1.3.87的IP地址，会发现无法访问TFTP服务器。3.6配置文件(1)DeviceA#dhcpenable#vlan2to3#6dhcpclassaaif-matchoption82hex0001offset4length2#dhcpclassbbif-matchoption82hex0003offset4length2#dhcpserverip-pool1network10.1.1.0mask255.255.255.0addressrange10.1.1.210.1.1.100dns-list10.1.1.3domain-namecomforbidden-ip10.1.1.3forbidden-ip10.1.1.4gateway-list10.1.1.1tftp-serverip-address10.1.1.4#dhcpserverip-pool2network10.1.3.0mask255.255.255.0classaarange10.1.3.210.1.3.48classbbrange10.1.3.4910.1.3.100dns-list10.1.1.3domain-namecomgateway-list10.1.3.1tftp-serverip-address10.1.1.4#interfaceVlan-interface2ipaddress10.1.2.1255.255.255.0dhcpserverapplyip-pool2#interfaceVlan-interface3ipaddress10.1.1.1255.255.255.0dhcpserverapplyip-pool1#interfaceGigabitEthernet1/0/1portaccessvlan3#interfaceGigabitEthernet1/0/2portaccessvlan2#iproute-static10.1.3.02410.1.2.2#(2)DeviceB#dhcpenabledhcprelayclient-informationrecord#vlan2to37#interfaceVlan-interface2ipaddress10.1.2.2255.255.255.0#interfaceVlan-interface3ipaddress10.1.3.1255.255.255.0dhcpselectrelaydhcprelayinformationenabledhcprelayserver-address10.1.2.1ipverifysourceip-addressmac-address#interfaceGigabitEthernet1/0/1portaccessvlan3#interfaceGigabitEthernet1/0/2portaccessvlan2#interfaceGigabitEthernet1/0/3portaccessvlan3#iproute-static10.1.1.02410.1.2.1#4相关资料•H3CS5130-EI系列以太网交换机三层技术-IP业务配置指导-Release3106•H3CS5130-EI系列以太网交换机三层技术-IP业务命令参考-Release3106 1简介 2配置前提 3跨网段动态分配IP地址配置举例 3.1组网需求 3.2配置思路 3.3使用版本 3.4配置步骤 1.DeviceA的配置 2.DeviceB的配置 3.5验证配置 3.6配置文件 4相关资料