Всем доброго времени суток.
Помогите пожалуйста настроить DHCP Opt.82 на SuperVlan.
В данный момент используем технологию vlan-to-peer.
Хотим перейти на SuperVlan + Opt.82
Оттестировали схему (vlan-to-peer) ISC-DHCP-->L3(Summit x460-24T)-->L2(SNR-S2960-24G) без SuperVlan, все отлично завилось.
В данный момент бьемся над схемой ISC-DHCP -->L3(Summit x460-24T)-->L3(SNR-S3750G-24S-E)-->L2(SNR-S2960-24G) с использованием SuperVlan.
В текущей конфигурации которая у нас получилась, на абонентском коммутаторе L2, получить адрес DHCP можно только один раз и только на одном порту. На остальных портах IP не получаем, при этом при снятии tcpdump видно что опция передается.
ISC-DHCP
option domain-name "172.16.0.2, 172.16.1.2 ";
default-lease-time 2400;
max-lease-time 2400;
authoritative;
log-facility local7;
local-address 10.10.0.2;
subnet 10.10.0.0 netmask 255.255.255.252 {
}
# Logging for debug begin
if exists agent.remote-id and exists agent.circuit-id {
log(info, "--------------------------------------------------------------------------");
log(info, concat("Lease for IP: ", binary-to-ascii(10, 8, ".", leased-address)));
log(info, concat("Lease for MAC: ", binary-to-ascii (16, 8, ":", suffix(hardware, 6))));
log(info, concat("Remote ID: ", binary-to-ascii(16, 8, ":", substring(option agent.remote-id, 2, 6)), " ", "Circuit ID:
if binary-to-ascii(16, 8, "", substring(option agent.remote-id, 2, 1)) = "0" {
set switch-mac = concat("0", binary-to-ascii(16, 8, "", suffix(option agent.remote-id, 1)), ":", binary-to-ascii(16, 8,
} else {
set switch-mac = binary-to-ascii(16, 8, ":", substring(option agent.remote-id, 2, 6));
}
set switch-addr = binary-to-ascii(10, 8, ".", packet(24, 4));
set switch-port = binary-to-ascii(10, 8, "", substring(option agent.circuit-id, 5, 1));
set switch-port-vlan = binary-to-ascii(10, 8, "", substring(option agent.circuit-id, 2, 2));
log(info, concat("Lease from: ", binary-to-ascii(10, 8, ".", leased-address), " via IP: ", switch-addr, " (MAC: ", switc
log(info, "--------------------------------------------------------------------------");
}
#shared-network fxp0 { include "/usr/local/etc/ng4.conf"; }
include "/usr/local/etc/dhcp/test.conf";
test.conf
class "test-sw01-p01" {
match if
binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "1";
}
class "test-sw01-p02" {
match if
binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "2";
}
class "office-sw01-p03" {
match if
binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "3";
}
class "test-sw01-p04" {
match if
binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "4";
}
class "test-sw01-p05" {
match if
binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "5";
}
subnet 172.16.14.0 netmask 255.255.255.0 {
dynamic-bootp-lease-length 180;
max-lease-time 2400;
default-lease-time 2400;
option routers 172.16.14.1;
option domain-name-servers 172.16.0.2, 172.16.1.2;
option subnet-mask 255.255.255.0;
pool { range 172.16.14.2; allow members of "office-sw01-p01"; }
pool { range 172.16.14.6; allow members of "office-sw01-p02"; }
pool { range 172.16.14.10; allow members of "office-sw01-p03"; }
pool { range 172.16.14.14; allow members of "office-sw01-p04"; }
pool { range 172.16.14.18; allow members of "office-sw01-p05"; }
}
L3(Summit x460-24T)
#
# Module ipSecurity configuration.
#
configure trusted-servers vlan vlan80 add server 10.10.0.2 trust-for dhcp-server
#
# Module netTools configuration.
#
configure bootprelay add 10.10.0.2 vr VR-Default
configure bootprelay dhcp-agent information policy keep vr VR-Default
enable bootprelay vlan Default
enable bootprelay vlan vlan515 (Vlan управления для 2-го L3 коммутатора)
L3(SNR-S3750G-24S-E)
service dhcp
ip forward-protocol udp bootps
ip dhcp snooping enable
ip dhcp snooping information option subscriber-id format hex
vlan 4
name supervlan
supervlan
subvlan 3374-3378
Interface Ethernet1/0/11 (порт подключения L2 коммутатора)
switchport mode hybrid
switchport hybrid allowed vlan 3374-3378 tag
switchport hybrid allowed vlan 1 untag
ip dhcp snooping trust
Interface Ethernet1/0/25 ( порт подключения к L3(Summit x460-24T))
description Uplink
switchport mode hybrid
switchport hybrid allowed vlan 1 untag
ip dhcp snooping trust
interface Vlan4
ip address 172.16.14.1 255.255.255.0
!forward protocol udp 67(active)!
ip helper-address 10.10.0.2
L2(SNR-S2960-24G)
service dhcp
ip dhcp snooping enable
ip dhcp snooping binding enable
ip dhcp snooping information enable
ip dhcp snooping information option subscriber-id format hex
firewall enable
ip access-list extended drop
deny tcp any-source s-port 135 any-destination
deny tcp any-source s-port 139 any-destination
deny tcp any-source s-port 445 any-destination
deny udp any-source s-port 1900 any-destination
permit tcp any-source any-destination
permit udp any-source any-destination
permit icmp any-source any-destination
deny tcp any-source s-port 137 any-destination
deny tcp any-source s-port 138 any-destination
deny tcp any-source s-port 2869 any-destination
deny udp any-source s-port 135 any-destination
deny udp any-source s-port 137 any-destination
deny udp any-source s-port 138 any-destination
deny udp any-source s-port 139 any-destination
deny udp any-source s-port 445 any-destination
deny udp any-source s-port 2869 any-destination
exit
Interface Ethernet1/1
switchport access vlan 3374
ip access-group drop in
am port
am ip-pool 172.16.14.2 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/2
switchport access vlan 3375
ip access-group drop in
am port
am ip-pool 172.16.14.6 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/3
switchport access vlan 3376
ip access-group drop in
am port
am ip-pool 172.16.14.10 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/4
switchport access vlan 3377
ip access-group drop in
am port
am ip-pool 172.16.14.14 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/5
switchport access vlan 3378
ip access-group drop in
am port
am ip-pool 172.16.14.18 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
Interface Ethernet1/28 (порт подключения к L3(SNR-S3750G-24S-E))
switchport mode hybrid
switchport hybrid allowed vlan 3374-3378 tag
switchport hybrid allowed vlan 1 untag
ip dhcp snooping trust
DUMP при подключении к порту на котором уже не получаем ip-address.
14:18:04.355508 IP 172.16.14.1.bootps > dhcp.meoz.bootps: BOOTP/DHCP, Request from 00:14:22:c0:51:dd (oui Unknown), length 315
14:18:04.371498 IP dhcp.meoz.bootps > 172.16.14.1.bootps: BOOTP/DHCP, Reply, length 324
14:18:04.452698 IP dhcp.meoz.61789 > host.ru.domain: 41807+ PTR? 1.14.16.172.in-addr.arpa. (42)
14:18:04.472622 IP host.ru.domain > dhcp.meoz.61789: 41807 NXDomain 0/0/0 (42)
Такая же ситуация (на одном порту получаем ip, на остальных нет), если мы поднимаем SubVlan на L3(Summit x460-24T) и подключаем к нему L2 коммутатор.
Помогите разобраться.
За ранее спасибо.
