H3C S3600 Series Operation Manual

Also see for H3C S3600 Series: Datasheet Installation manual Command manual Operation manual Command manual

Contents

H3C S3600 Series Operation Manual Manual pdf 47 page image

Operation Manual – DHCPH3C S3600 Series Ethernet Switches-Release 1510 Chapter 3 DHCP Relay Configuration3-6Note:z You can configure up to eight external DHCP server IP addresses in a DHCP servergroup.z You can map multiple VLAN interfaces to one DHCP server group. But one VLANinterface can be mapped to only one DHCP server group.z If you execute the dhcp-server groupNo command repeatedly, the newconfiguration overwrites the previous one.z You need to configure the group number specified in the dhcp-server groupNocommand in VLAN interface view by using the command dhcp-server groupNo ipip-address&<1-8> in advance.3.2.4 Configuring DHCP Relay SecurityI. Configuring address checkingWhen a DHCP client obtain an IP address from a DHCP server with the help of a DHCPrelay, the DHCP relay creates an entry (dynamic entry) in the user address table totrack the IP-MAC address binding information about the DHCP client. You can alsoconfigure user address entries manually (static entries) to bind an IP address and aMAC address statically.The purpose of the address checking function on DHCP relay is to preventunauthorized users from statically configuring IP addresses to access externalnetworks. With this function enabled, a DHCP relay inhibits a user from accessingexternal networks if the IP address configured on the user end and the MAC address ofthe user end do not match any entries (including the entries dynamically tracked by theDHCP relay and the manually configured static entries) in the user address table on theDHCP relay.Table 3-4 Configure address checkingOperation Command DescriptionEnter system view system-view —Create a DHCP useraddress entrymanuallydhcp-security staticip-address mac-addressOptionalBy default, no DHCP useraddress entry is configured.(Only S3600-EI seriesswitches among S3600 seriesswitches support thisconfiguration.)Enter interface view interface interface-typeinterface-number —