Jump to content

SuperVlan + DHCP Opt.82

naker_1
 Share

Recommended Posts

naker_1

naker_1

Posted
Posted

Всем доброго времени суток.

 

Помогите пожалуйста настроить DHCP Opt.82 на SuperVlan.

В данный момент используем технологию vlan-to-peer.

Хотим перейти на SuperVlan + Opt.82

Оттестировали схему (vlan-to-peer) ISC-DHCP-->L3(Summit x460-24T)-->L2(SNR-S2960-24G) без SuperVlan, все отлично завилось.

В данный момент бьемся над схемой ISC-DHCP -->L3(Summit x460-24T)-->L3(SNR-S3750G-24S-E)-->L2(SNR-S2960-24G) с использованием SuperVlan.

В текущей конфигурации которая у нас получилась, на абонентском коммутаторе L2, получить адрес DHCP можно только один раз и только на одном порту. На остальных портах IP не получаем, при этом при снятии tcpdump видно что опция передается.

 

ISC-DHCP

 
option domain-name "172.16.0.2, 172.16.1.2 ";
default-lease-time 2400;
max-lease-time 2400;
authoritative;
log-facility local7;
local-address 10.10.0.2;

subnet 10.10.0.0 netmask 255.255.255.252 {
}


# Logging for debug begin
if exists agent.remote-id and exists agent.circuit-id {
   log(info, "--------------------------------------------------------------------------");
   log(info, concat("Lease for IP:  ", binary-to-ascii(10, 8, ".", leased-address)));
   log(info, concat("Lease for MAC: ", binary-to-ascii (16, 8, ":", suffix(hardware, 6))));
   log(info, concat("Remote ID:     ", binary-to-ascii(16, 8, ":", substring(option agent.remote-id, 2, 6)), " ", "Circuit ID:
   if binary-to-ascii(16, 8, "", substring(option agent.remote-id, 2, 1)) = "0" {
       set switch-mac = concat("0", binary-to-ascii(16, 8, "", suffix(option agent.remote-id, 1)), ":", binary-to-ascii(16, 8,
   } else {
       set switch-mac = binary-to-ascii(16, 8, ":", substring(option agent.remote-id, 2, 6));
   }
   set switch-addr = binary-to-ascii(10, 8, ".", packet(24, 4));
   set switch-port = binary-to-ascii(10, 8, "", substring(option agent.circuit-id, 5, 1));
   set switch-port-vlan = binary-to-ascii(10, 8, "", substring(option agent.circuit-id, 2, 2));
   log(info, concat("Lease from:    ", binary-to-ascii(10, 8, ".", leased-address), " via IP: ", switch-addr, " (MAC: ", switc
   log(info, "--------------------------------------------------------------------------");

}

#shared-network fxp0 { include "/usr/local/etc/ng4.conf"; }
include "/usr/local/etc/dhcp/test.conf";

 

test.conf

class "test-sw01-p01" {
               match if
                   binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
                   and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "1";
}

class "test-sw01-p02" {
               match if
                   binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
                   and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "2";
}

class "office-sw01-p03" {
               match if
                   binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
                   and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "3";
}

class "test-sw01-p04" {
               match if
                   binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
                   and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "4";
}

class "test-sw01-p05" {
               match if
                   binary-to-ascii(16, 8, ":", suffix(option agent.remote-id, 6)) = "f8:f0:82:10:60:7a"
                   and binary-to-ascii(10, 8, "", suffix(option agent.circuit-id, 1)) = "5";
}

subnet 172.16.14.0 netmask 255.255.255.0 {
       dynamic-bootp-lease-length 180;
       max-lease-time 2400;
       default-lease-time 2400;
       option routers 172.16.14.1;
       option domain-name-servers 172.16.0.2, 172.16.1.2;
       option subnet-mask 255.255.255.0;
       pool { range 172.16.14.2; allow members of "office-sw01-p01"; }
       pool { range 172.16.14.6; allow members of "office-sw01-p02"; }
       pool { range 172.16.14.10; allow members of "office-sw01-p03"; }
       pool { range 172.16.14.14; allow members of "office-sw01-p04"; }
       pool { range 172.16.14.18; allow members of "office-sw01-p05"; }
}

 

L3(Summit x460-24T)

#
# Module ipSecurity configuration.
#
configure trusted-servers vlan vlan80 add server 10.10.0.2 trust-for dhcp-server

#
# Module netTools configuration.
#
configure bootprelay add 10.10.0.2 vr VR-Default
configure bootprelay dhcp-agent information policy keep vr VR-Default
enable bootprelay vlan Default
enable bootprelay vlan vlan515 (Vlan управления для 2-го L3 коммутатора)

 

L3(SNR-S3750G-24S-E)

service dhcp
ip forward-protocol udp bootps
ip dhcp snooping enable
ip dhcp snooping information option subscriber-id format hex

vlan 4
name supervlan
supervlan
subvlan 3374-3378

Interface Ethernet1/0/11 (порт подключения L2 коммутатора)
switchport mode hybrid
switchport hybrid allowed vlan 3374-3378 tag
switchport hybrid allowed vlan 1 untag
ip dhcp snooping trust

Interface Ethernet1/0/25 ( порт подключения к L3(Summit x460-24T))
description Uplink
switchport mode hybrid
switchport hybrid allowed vlan 1 untag
ip dhcp snooping trust

interface Vlan4
ip address 172.16.14.1 255.255.255.0
 !forward protocol udp 67(active)!
ip helper-address 10.10.0.2

 

L2(SNR-S2960-24G)

service dhcp
ip dhcp snooping enable
ip dhcp snooping binding enable
ip dhcp snooping information enable
ip dhcp snooping information option subscriber-id format hex

firewall enable
ip access-list extended drop
 deny tcp any-source s-port 135 any-destination
 deny tcp any-source s-port 139 any-destination
 deny tcp any-source s-port 445 any-destination
 deny udp any-source s-port 1900 any-destination
 permit tcp any-source any-destination
 permit udp any-source any-destination
 permit icmp any-source any-destination
 deny tcp any-source s-port 137 any-destination
 deny tcp any-source s-port 138 any-destination
 deny tcp any-source s-port 2869 any-destination
 deny udp any-source s-port 135 any-destination
 deny udp any-source s-port 137 any-destination
 deny udp any-source s-port 138 any-destination
 deny udp any-source s-port 139 any-destination
 deny udp any-source s-port 445 any-destination
 deny udp any-source s-port 2869 any-destination
 exit

Interface Ethernet1/1
switchport access vlan 3374
ip access-group drop in
am port
am ip-pool 172.16.14.2 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/2
switchport access vlan 3375
ip access-group drop in
am port
am ip-pool 172.16.14.6 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/3
switchport access vlan 3376
ip access-group drop in
am port
am ip-pool 172.16.14.10 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/4
switchport access vlan 3377
ip access-group drop in
am port
am ip-pool 172.16.14.14 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1
!
Interface Ethernet1/5
switchport access vlan 3378
ip access-group drop in
am port
am ip-pool 172.16.14.18 1
ip dhcp snooping binding user-control
ip dhcp snooping binding user-control max-user 1

Interface Ethernet1/28 (порт подключения к L3(SNR-S3750G-24S-E))
switchport mode hybrid
switchport hybrid allowed vlan 3374-3378 tag
switchport hybrid allowed vlan 1 untag
ip dhcp snooping trust

 

DUMP при подключении к порту на котором уже не получаем ip-address.

14:18:04.355508 IP 172.16.14.1.bootps > dhcp.meoz.bootps: BOOTP/DHCP, Request from 00:14:22:c0:51:dd (oui Unknown), length 315
14:18:04.371498 IP dhcp.meoz.bootps > 172.16.14.1.bootps: BOOTP/DHCP, Reply, length 324
14:18:04.452698 IP dhcp.meoz.61789 > host.ru.domain: 41807+ PTR? 1.14.16.172.in-addr.arpa. (42)
14:18:04.472622 IP host.ru.domain > dhcp.meoz.61789: 41807 NXDomain 0/0/0 (42)

 

Такая же ситуация (на одном порту получаем ip, на остальных нет), если мы поднимаем SubVlan на L3(Summit x460-24T) и подключаем к нему L2 коммутатор.

 

Помогите разобраться.

За ранее спасибо.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
 Share
Go to topic listing
×
×
  • Create New...
На сайте используются файлы cookie и сервисы аналитики для корректной работы форума и улучшения качества обслуживания. Продолжая использовать сайт, вы соглашаетесь с использованием файлов cookie и с Политикой конфиденциальности.