DHCP中继+单臂路由+SNOOPING防范非法取得ip
根据DHCP Server全局地址池分配客户端ip并保留各网段200以后的地址备用
[V200R003C00]
#
sysname AR1
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
drop illegal-mac alarm
#
router id 4.4.4.4
#
set cpu-usage threshold 80 restore 75
#
dhcp enable
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
#
interface GigabitEthernet0/0/0.10 开启子接口作为vlan10网关
dot1q termination vid 10 关联802.1Q的tag流量
ip address 192.168.10.254 255.255.255.0 配置接口ip
arp broadcast enable 允许该接口接收广播arp报文
dhcp select relay 使能中继
dhcp relay server-ip 172.16.10.6 使能中继服务器ip
#
interface GigabitEthernet0/0/0.20
dot1q termination vid 20
ip address 192.168.20.254 255.255.255.0
arp broadcast enable
dhcp select relay
dhcp relay server-ip 172.16.10.6
#
interface GigabitEthernet0/0/0.30
dot1q termination vid 30
ip address 192.168.30.254 255.255.255.0
arp broadcast enable
dhcp select relay
dhcp relay server-ip 172.16.10.6
#
interface GigabitEthernet0/0/1
ip address 12.0.0.1 255.255.255.0
dhcp select relay
dhcp relay server-ip 172.16.10.6
dhcp select global
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 4.4.4.4 255.255.255.255
#
ospf 1 router-id 4.4.4.4
area 0.0.0.0
network 4.4.4.4 0.0.0.0 宣告自身网段
network 12.0.0.1 0.0.0.0
network 192.168.10.254 0.0.0.0
network 192.168.20.254 0.0.0.0
network 192.168.30.254 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
AR2：
[V200R003C00]
#
sysname AR2
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
drop illegal-mac alarm
#
router id 5.5.5.5
#
set cpu-usage threshold 80 restore 75
#
dhcp enable
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 12.0.0.5 255.255.255.0
#
interface GigabitEthernet0/0/1
ip address 172.16.10.5 255.255.255.0
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 5.5.5.5 255.255.255.255
#
ospf 1 router-id 5.5.5.5
area 0.0.0.0
network 5.5.5.5 0.0.0.0
network 12.0.0.5 0.0.0.0
network 172.16.10.5 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
AR3:
[V200R003C00]
#
sysname AR3
#
snmp-agent local-engineid 800007DB03000000000000
snmp-agent
#
clock timezone China-Standard-Time minus 08:00:00
#
portal local-server load portalpage.zip
#
drop illegal-mac alarm
#
router id 6.6.6.6
#
set cpu-usage threshold 80 restore 75
#
dhcp enable
dhcp check dhcp-rate enable 开启dhcp速率检测
dhcp check dhcp-rate 90 检测收到dhcp请求包的速率最大为90个/s，默认100个/s，防止dhcp泛红洪攻击
#
dhcp server ping packet 10
dhcp server ping timeout 100 分发ip前先检测ip是否被使用dhcp服务器向该ip10 包，速率100ms
#
ip pool vlan10 创建vlan10 地址池
gateway-list 192.168.10.254 配置网关
network 192.168.10.0 mask 255.255.255.0 分发的网段
excluded-ip-address 192.168.10.200 192.168.10.253 排除分发的地址
lease day 0 hour 8 minute 0 DHCP租期时间
dns-list 114.114.114.114 dns
#
ip pool vlan20
gateway-list 192.168.20.254
network 192.168.20.0 mask 255.255.255.0
excluded-ip-address 192.168.20.200 192.168.20.253
lease day 0 hour 8 minute 0
dns-list 114.114.114.114
#
ip pool vlan30
gateway-list 192.168.30.254
network 192.168.30.0 mask 255.255.255.0
excluded-ip-address 192.168.30.200 192.168.30.253
lease day 0 hour 8 minute 0
dns-list 114.114.114.114
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password cipher %$%$K8m.Nt84DZ}e#<0`8bmE3Uw}%$%$
local-user admin service-type http
#
firewall zone Local
priority 15
#
interface GigabitEthernet0/0/0
ip address 172.16.10.6 255.255.255.0
dhcp select global
#
interface GigabitEthernet0/0/1
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
interface LoopBack0
ip address 6.6.6.6 255.255.255.255
#
ospf 1 router-id 6.6.6.6
area 0.0.0.0
network 6.6.6.6 0.0.0.0
network 172.16.10.6 0.0.0.0
#
user-interface con 0
authentication-mode password
user-interface vty 0 4
user-interface vty 16 20
#
wlan ac
#
return
#
sysname SW1
#
vlan batch 10 20 30 创建vlan10 20 30
#
cluster enable
ntdp enable
ndp enable
#
drop illegal-mac alarm
#
dhcp enable
#
dhcp snooping enable 开启snooping检测功能
#
diffserv domain default
#
drop-profile default
#
aaa
authentication-scheme default
authorization-scheme default
accounting-scheme default
domain default
domain default_admin
local-user admin password simple admin
local-user admin service-type http
#
interface Vlanif1
#
interface Vlanif10
#
interface MEth0/0/1
#
interface Ethernet0/0/1
port link-type access
port default vlan 10
dhcp snooping enable 在连接PC端的接口设置不信任dhcp-offer报文，防止非法dhcp
#
interface Ethernet0/0/2
port link-type access
port default vlan 20
dhcp snooping enable
#
interface Ethernet0/0/3
port link-type access
port default vlan 30
dhcp snooping enable 在连接PC端的接口设置不信任dhcp-offer报文，防止非法dhcp
#
interface Ethernet0/0/4
#
interface Ethernet0/0/5
#
interface Ethernet0/0/6
#
interface Ethernet0/0/7
#
interface Ethernet0/0/8
#
interface Ethernet0/0/9
#
interface Ethernet0/0/10
#
interface Ethernet0/0/11
#
interface Ethernet0/0/12
#
interface Ethernet0/0/13
#
interface Ethernet0/0/14
#
interface Ethernet0/0/15
#
interface Ethernet0/0/16
#
interface Ethernet0/0/17
#
interface Ethernet0/0/18
#
interface Ethernet0/0/19
#
interface Ethernet0/0/20
#
interface Ethernet0/0/21
#
interface Ethernet0/0/22
#
interface GigabitEthernet0/0/1
port link-type trunk
port trunk allow-pass vlan 2 to 4094
dhcp snooping trusted 开启信任接口，表示只信任连接DHCP服务器接口过来的DHCP OFFER报文
#
interface GigabitEthernet0/0/2
#
interface NULL0
#
user-interface con 0
user-interface vty 0 4
#
return
实验结果
……