2-5To do… Use the command… RemarksCorrelate the DHCP servergroup with the current interfacedhcp relay server-selectgroup-idRequiredBy default, no interface iscorrelated with any DHCPserver group.z You can specify up to twenty DHCP server groups on the relay agent and eight DHCP serveraddresses for each DHCP server group.z The IP addresses of DHCP servers and those of relay agent’s interfaces cannot be on the samesubnet. Otherwise, the client cannot obtain an IP address.z A DHCP server group can correlate with one or multiple DHCP relay agent interfaces, while a relayagent interface can only correlate with one DHCP server group. Using the dhcp relayserver-select command repeatedly overwrites the previous configuration. However, if thespecified DHCP server group does not exist, the interface still uses the previous correlation.z The group-id argument in the dhcp relay server-select command was specified by the dhcprelay server-group command.Configuring the DHCP Relay Agent Security FunctionsCreating static bindings and enable IP address checkFor avoidance of invalid IP address configuration, you can configure the DHCP relay agent to checkwhether a requesting client’s IP and MAC addresses match a binding (dynamic or static) on the DHCPrelay agent.With this feature enabled, the DHCP relay agent can dynamically record clients’ IP-to-MAC bindingsafter clients get IP addresses. It also supports static bindings, that is, you can manually configureIP-to-MAC bindings on the DHCP relay agent, so that users can access external networks using fixedIP addresses.Upon receiving an ARP packet, the DHCP relay agent matches the sender’s IP and MAC addresses inthe packet against the bindings (both dynamic and static). If no match is found, the DHCP relay agentdoes not learn the ARP entry, and thus the sending host cannot access external networks via the DHCPrelay agent.Follow these steps to create a static binding and enable IP address check:To do… Use the command… RemarksEnter system view system-view —Create a static bindingdhcp relay security static ip-addressmac-address [ interface interface-typeinterface-number ]OptionalNo static binding is createdby default.Enter interface view interface interface-typeinterface-number —Enable invalid IPaddress checkdhcp relay address-check { disable |enable }RequiredDisabled by default.
