如果您喜歡這裡的內容,記得分享到您的Facebook和Twitter上面所有的朋友們吧!

2009年4月30日 星期四

怎麼會忽然 "動態取得" 一個怪怪的 IP 位址? (DHCP Snooping)

其實就是有人在你的網段中, 不小心打開了 DHCP Server 功能. 最常見的原因, 就是因為網路孔位不足, 有人自己去電子商場買了 "寬頻分享器" (Cheap, SOHO, Broadband Router). 通常他們的 DHCP 服務預設都是打開的, 而且都是 192.168.1.0/24 這個網段. 所以這些怪怪的 IP 位址, 通常都是長得這個模樣: 192.168.1.X.

而且整個網段, 通常會"部分取得正確, 部分取得錯誤". 我相信很多網管工作者都有遇到過這種窘境.

如何防範, 其實在各位的 Cisco 2950 以上的 Switch 就支援的 DHCP Snooping 功能, 正是為了解決這個問題而來的! 打開以後, 不管再有誰做這種事, 也不會發生錯誤取得IP位址的問題!

DHCP Snooping 的原理簡單的來說, Switch 會監看 DHCP 的活動, 就是只允許指定的部分 Switch Port 放行 DHCP伺服器的回應封包, 其他的一律不准. 所以只會取得指定 Server 回應的 DHCP 內容.

注意: 有一點很重要, 如果 DHCP Server 不是接在本 Switch 時, Uplink port 請務必要允許 DHCP Server 回應, 不然整台 Switch 上的 PC 都會收不到動態的 IP位址資訊!

另外, 因為設定過程會影響 DHCP 運作, 建議最好是在下班時間再啟動這個功能!

以下是典型的設定:
! Global, 啟動 DHCP Snooping, 這行一定要
 ip dhcp snooping

! 假設只對 VLAN 100 和 VLAN 200 作 DHCP 設限, 這行也一定要
 ip dhcp snooping vlan 100 200

! DHCP Server 埠, 或是 Uplink, 這點很重要, 不然會全部都收不到!
 interface GigabitEthernet0/1
  ip dhcp trust

! 一般使用者埠, 這是預設值, 可以不用下
 interface FastEthernet 0/1
  no ip dhcp trust

[Reference]
DHCP Snooping Configuration Guidelines section of Configuring DHCP Features, on Cisco.com


如果您喜歡這篇文章,不考慮試試Email訂閱嗎?


Related Posts with Thumbnails

8 則留言:

  1. 請教您,如果我在介面下這指令是有何用意?
    Switch(config-if)#ip dhcp snooping vlan 1

    回覆刪除
  2. 這命令應該是在 Global, 不是在 Interface 下. 您下完這個命令就會立刻回到 Switch (config)# 下, 表示這就是 Global 的命令.

    這個命令代表在 VLAN 1 下啟動 DHCP Snooping: 也就是監控 VLAN 1 的 DHCP 活動. 這命令後方所指名的每個 VLAN 都是會被監控的.

    因為監控 VLAN 的 DHCP 活動會佔硬體資源, 所以 IOS 不會自動在所有的 VLAN 上頭啟動這個功能, 只有管理者指名的 VLAN 才會監控.

    請參考!

    回覆刪除
  3. 洪老師你好:

    為什麼我在我的 router 3845 上
    sh int status 與 sh ip int brief 所看到的介面會不相同呢?? (sh int status 沒看到Giga port ??)

    3845#sh int status
    Port Name Status Vlan Duplex Speed Type
    Fa0/0/0 disabled 1 auto auto Unknown
    Fa0/0/1 6509:7/33 connected trunk a-full a-100 Unknown
    Fa0/0/2 6509:7/31 disabled 15 auto auto Unknown
    Fa0/0/3 notconnect 1 auto auto Unknown

    3845#sh ip int brie
    Interface IP-Address OK? Method Status Protocol
    GigabitEthernet0/0 192.168.53.100 YES NVRAM up up
    GigabitEthernet0/1 192.168.250.6 YES NVRAM up up
    FastEthernet0/0/0 unassigned YES unset administratively down down
    FastEthernet0/0/1 unassigned YES unset up up
    FastEthernet0/0/2 unassigned YES unset administratively down down
    FastEthernet0/0/3 unassigned YES unset up down
    Serial0/2/0 unassigned YES NVRAM administratively down down
    Serial0/2/0.100 192.168.250.2 YES NVRAM administratively down down
    Vlan1 unassigned YES NVRAM administratively down down
    Vlan15 192.168.15.250 YES NVRAM up up
    Vlan65 192.168.65.250 YES NVRAM up up
    Vlan114 192.168.14.250 YES NVRAM up up
    Loopback0 192.168.53.254 YES NVRAM up up
    Loopback1 192.168.53.190 YES NVRAM up up
    3845#
    3845#
    3845#
    3845#sh ver
    3845#sh version
    Cisco IOS Software, 3800 Software (C3845-IPVOICE-M), Version 12.3(11)T5, RELEASE SOFTWARE (fc1)
    Technical Support: http://www.cisco.com/techsupport
    Copyright (c) 1986-2005 by Cisco Systems, Inc.
    Compiled Sat 02-Apr-05 15:14 by yiyan
    ROM: System Bootstrap, Version 12.3(11r)T1, RELEASE SOFTWARE (fc1)
    3845 uptime is 226 days, 2 hours, 31 minutes
    System returned to ROM by power-on
    System restarted at 11:32:02 CST Fri Nov 20 2009
    System image file is "flash:c3845-ipvoice-mz.123-11.T5.bin"
    Cisco 3845 (revision 1.0) with 221184K/40960K bytes of memory.
    Processor board ID FHK0748F6GQ
    4 FastEthernet interfaces
    2 Gigabit Ethernet interfaces
    1 Serial(sync/async) interface
    1 Channelized T1/PRI port
    DRAM configuration is 64 bits wide with parity enabled.
    479K bytes of NVRAM.
    62592K bytes of ATA System CompactFlash (Read/Write)
    Configuration register is 0x2102

    回覆刪除
  4. 您提到的四個 FastEthernet 埠應該都是 Layer 2 Switch ports (應該就是 "WIC-4ESW" 或是 "HWIC-4ESW" 吧?). "show interfaces status" 命令只會顯示 Layer 2 Switch ports.

    有關 "show interfaces status" 命令:
    show interfaces status

    有關 Layer 2 switch ports:
    4-Port Ethernet Switch Configuration Notes for the Cisco 1700 Series Routers

    回覆刪除
  5. 請教您
    我手上有一台 cisco WS-C2924M-XL switch
    但是卻無法建立 vlan ??

    在 Privileged EXEC Mode 下無法使用 vlan database 方式,另外在Global Configuration Mode 也無法使用 vlan XXX 方式 ~~不曉得是出了什麼狀況??
    還是有別的方式呢?
    謝謝!!


    2924#sh ver
    2924#sh version
    Cisco Internetwork Operating System Software
    IOS (tm) C2900XL Software (C2900XL-H2-M), Version 11.2(8.2)SA6, MAINTENANCE INTERIM SOFTWARE
    Copyright (c) 1986-1999 by cisco Systems, Inc.
    Compiled Wed 23-Jun-99 17:56 by boba
    Image text-base: 0x00003000, data-base: 0x0020DB0C

    ROM: Bootstrap program is C2900XL boot loader

    2924 uptime is 6 weeks, 3 days, 17 hours, 56 minutes
    System restarted by power-on
    System image file is "flash:c2900XL-h2-mz-112.8.2-SA6.bin", booted via


    cisco WS-C2924M-XL (PowerPC403GA) processor (revision 0x11) with 8192K/1024K bytes of memory.
    Processor board ID 0x10, with hardware revision 0x03
    Last reset from power-on

    Processor is running Standard Edition Software
    Cluster member switch capable
    24 Ethernet/IEEE 802.3 interface(s)

    32K bytes of flash-simulated non-volatile configuration memory.
    Base ethernet MAC Address: 00:30:80:D7:6D:C0
    Motherboard assembly number: 73-3425-09
    Power supply part number: 34-0920-01
    Motherboard serial number: FAA03379A6X
    Power supply serial number: NONE
    Model revision number: A0
    Model number: WS-C2924M-XL-A
    System serial number: FAA0339G1KX
    Configuration register is 0xF

    回覆刪除
  6. 我查了一下應該有支援才是: IOS Release 11.2(8)SA6當中的Configuring VLANs提到以下畫面:

    Switch# vlan database
    Switch(vlan)# vlan 0003 name marketing
    VLAN 3 added:
    Name: marketing
    Switch(vlan)# exit
    APPLY completed.
    Exiting....

    Switch#

    是否也可以擷取一下您遇到的錯誤畫面呢?

    回覆刪除
  7. 我的畫面如下~似乎沒有這個指令

    2924#vlan database
    ^
    % Invalid input detected at '^' marker.

    2924#?
    Exec commands:
    <1-99> Session number to resume
    access-enable Create a temporary Access-List entry
    access-template Create a temporary Access-List entry
    archive manage archive files
    cd Change current directory
    clear Reset functions
    clock Manage the system clock
    configure Enter configuration mode
    connect Open a terminal connection
    copy Copy from one file to another
    debug Debugging functions (see also 'undebug')
    delete Delete a file
    dir List files on a filesystem
    disable Turn off privileged commands
    disconnect Disconnect an existing network connection
    enable Turn on privileged commands
    exit Exit from the EXEC
    format Format a filesystem
    fsck Fsck a filesystem
    help Description of the interactive help system
    hw-module Commands to manipulate a module in a specified slot
    lock Lock the terminal
    login Log in as a particular user
    logout Exit from the EXEC
    mkdir Create new directory
    more Display the contents of a file
    name-connection Name an existing network connection
    no Disable debugging functions
    ping Send echo messages
    pwd Display current working directory
    rcommand run command on remote switch
    reload Halt and perform a cold restart
    rename Rename a file
    resume Resume an active network connection
    rmdir Remove existing directory
    rsh Execute a remote command
    send Send a message to other tty lines
    session Start remote console session
    setup Run the SETUP command facility
    show Show running system information
    systat Display information about terminal lines
    telnet Open a telnet connection
    terminal Set terminal line parameters
    test Test subsystems, memory, and interfaces
    traceroute Trace route to destination
    tunnel Open a tunnel connection
    undebug Disable debugging functions (see also 'debug')
    where List active connections
    write Write running configuration to memory, network, or terminal

    2924#

    回覆刪除
  8. 我用過 "WS-C2924M-XL-EN"(Enterprise Edition), 確實是可以使用 "vlan database" 設定 VLAN. 您的型號是 "WS-C2924M-XL-A", 我倒是沒用過. 也許我找到的文件不適用您的狀況.

    還有一招可以試, 找更新版的 IOS 版本升級看看. 不過有升級失敗無法開機的風險, 並不建議!

    如果網友有 "WS-C2924M-XL-A" 而且可以使用 "vlan database" 功能的, 請幫忙補充了!

    回覆刪除

小技巧:也可以 匿名 留言!

經典熱門文章