Настройка dhcp relay на роутере cisco

A DHCP relay agent
is any host that forwards DHCP packets between clients and servers. Relay
agents are used to forward requests and replies between clients and servers
when they are not on the same physical subnet. Relay agent forwarding is
distinct from the normal forwarding of an IP device, where IP datagrams are
switched between networks somewhat transparently. By contrast, relay agents
receive DHCP messages and then generate a new DHCP message to send out on
another interface. The relay agent sets the gateway IP address (giaddr field of
the DHCP packet) and, if configured, adds the relay agent information option
(option82) in the packet and forwards it to the DHCP server. The reply from the
server is forwarded back to the client after removing option 82.

The DHCP relay
agent supports the use of unnumbered interfaces. An unnumbered interface can
“borrow” the IP address of another interface already configured on the device,
which conserves network and address space. For DHCP clients connected though
the unnumbered interfaces, the DHCP relay agent automatically adds a static
host route once the DHCP client obtains an address, specifying the unnumbered
interface as the outbound interface. The route is automatically removed once
the lease time expires or when the client releases the address.

DHCP clients need to use User Datagram Protocol (UDP) broadcasts to send their initial DHCPDISCOVER messages because they don’t have information about the network to which they are attached. If the client is on a network segment that does not include a server, UDP broadcasts normally are not forwarded because most routers are configured to not forward broadcast traffic.

You can remedy this situation by configuring the interface of your router that is receiving the broadcasts to forward certain classes of broadcasts to a helper address. You can use more than one helper address per interface.

When a router forwards these address assignment/parameter requests, it is acting as a DHCP relay agent. The Cisco router implementation of the DHCP relay agent is provided via the
ip
helper-address interface configuration command.

In the figure below, the DHCP client broadcasts a request for an IP address and additional configuration parameters on its local LAN. Router B, acting as a DHCP relay agent, picks up the broadcast and generates a new DHCP message to send out on another interface. As part of this DHCP message, the relay agent inserts the IP address of the interface containing the
ip
helper-address command into the gateway IP address (giaddr) field of the DHCP packet. This IP address enables the DHCP server to determine which subnet should receive the offer and identify the appropriate IP address range to offer. The DHCP relay agent sends the local broadcast, via IP unicast, to the DHCP server address 172.16.1.2 specified by the
ip
helper-address interface configuration command.

Figure 1. Forwarding UDP Broadcasts to a DHCP Server Using a Helper Address

Automatic DHCP address allocation is typically based on an IP address, whether it be the gateway IP address (giaddr field of the DHCP packet) or the incoming interface IP address. In some networks, it is necessary to use additional information to further determine which IP addresses to allocate. By using the relay agent information option (option 82), the Cisco IOS XE relay agent can include additional information about itself when forwarding client-originated DHCP packets to a DHCP server.

Cisco IOS XE supports this functionality by using the
ip
dhcp
relay
information
option command. The relay agent will automatically add the circuit identifier suboption and the remote ID suboption to the relay agent information option and forward them to the DHCP server.

The DHCP server can use this information to assign IP addresses, perform access control, and set quality of service (QoS) and security policies (or other parameter-assignment policies) for each subscriber of a service provider network.

The figure below shows how the relay agent information option is inserted into the DHCP packet as follows:

1. The DHCP client generates a DHCP request and broadcasts it on the network.

2. The DHCP relay agent intercepts the broadcast DHCP request packet and inserts the relay agent information option (option 82) in the packet. The relay agent information option contains the related suboptions.

3. The DHCP relay agent unicasts the DHCP packet to the DHCP server.

4. The DHCP server receives the packet and uses the suboptions to assign IP addresses and other configuration parameters and forwards them back to the client.

5. The relay agent strips off the suboption fields of the packet while forwarding to the client.

Figure 2. Relay Agent Information Option Operation

Relay Agent Information Reforwarding Policy

DHCP relay support for Multiprotocol Label Switching (MPLS) Virtual Private Networks (VPNs) enables a network administrator to conserve address space by allowing overlapping addresses. The relay agent can support multiple clients on different VPNs, and many of these clients from different VPNs can share the same IP address.

Configuring VPNs involves an adjustment to the usual DHCP host IP address designation. VPNs use private address spaces that might not be unique across the Internet.

In some environments, a relay agent resides in a network element that also has access to one or more MPLS VPNs. A DHCP server that provides service to DHCP clients on those different VPNs must locate the VPN in which each client resides. The network element that contains the relay agent typically captures the VPN association of the DHCP client and includes this information in the relay agent information option of the DHCP packet.

DHCP relay support for MPLS VPNs allows the relay agent to forward this necessary VPN-related information to the DHCP server using the following three suboptions of the DHCP relay agent information option:

• VPN identifier

• Subnet selection

• Server identifier override

The VPN identifier suboption is used by the relay agent to tell the DHCP server the VPN for every DHCP request it passes on to the DHCP server, and it is also used to properly forward any DHCP reply that the DHCP server sends back to the relay agent. The VPN identifier suboption contains the VPN ID configured on the incoming interface to which the client is connected. If you configure the VRF name but not the VPN ID, the VRF name is used as the VPN identifier suboption. If the interface is in global routing space, the VPN suboptions are not added.

The subnet selection suboption allows the separation of the subnet where the client resides from the IP address used to communicate with the relay agent. In typical DHCP processing, the gateway address specifies both the subnet on which a DHCP client resides and the IP address that the server can use to communicate with the relay agent. Situations exist where the relay agent needs to specify the subnet on which a DHCP client resides that is different from the IP address the server can use to communicate with the relay agent. The subnet selection suboption is included in the relay agent information option and passed on to the DHCP server. The gateway address is changed to the outgoing interface of the relay agent toward the DHCP server. The DHCP server uses this gateway address to send reply packets back to the relay agent.

The server identifier override suboption value is copied in the reply packet from the DHCP server instead of the normal server ID address. The server identifier override suboption contains the incoming interface IP address, which is the IP address on the relay agent that is accessible from the client. Using this information, the DHCP client sends all renew and release packets to the relay agent. The relay agent adds all of the VPN suboptions and then forwards the renew and release packets to the original DHCP server.

After adding these suboptions to the DHCP relay agent information option, the gateway address is changed to the outgoing interface of the relay agent toward the DHCP server. When the packets are returned from the DHCP server, the relay agent removes the relay agent information options and forwards the packets to the DHCP client on the correct VPN.

The figure below shows a VPN scenario where the DHCP relay agent and DHCP server can recognize the VPN that each client resides within. DHCP client 1 is part of VPN green and DHCP client 2 is part of VPN red and both have the same private IP address 192.168.1.0/24. Because the clients have the same IP address, the DHCP relay agent and DHCP server use the VPN identifier, subnet selection, and server identifier override suboptions of the relay agent information option to distinguish the correct VPN of the client.

Figure 3. Virtual Private Network DHCP Configuration

When two relay agents are relaying messages between the DHCP client and
DHCP server, the second relay agent (closer to the server), by default,
replaces the first option 82 information with its own option 82. The remote ID
and circuit ID information from the first relay agent is lost. In some
deployment scenarios, it is necessary to maintain the initial option 82 from
the first relay agent, in addition to the option 82 from the second relay
agent. For example, an Intelligent Service Gateway (ISG) acting as a second
relay agent is connected to a Layer 2 device. The Layer 2 device connects to
the household and identifies the household with its own option 82.

The DHCP Relay Option 82 Encapsulation feature allows the second relay
agent to encapsulate option 82 information in a received message from the first
relay agent if it is also configured to add its own option 82 information. This
configuration allows the DHCP server to use option 82 information from both
relay agents. The DHCP server can use the VPN information from the second relay
agent along with the option 82 information from the first relay agent to send
correct address assignments and other configuration parameters for the client
devices based on the VRF, option 60, and encapsulated option 82. The reply
message from the DHCP server to the DHCP client traverses the same path as the
request messages through the two relay agents to the DHCP client.

Figure 4 shows the processing that occurs on the two relay agents and
the DHCP server when this feature is configured:

1. The DHCP client generates a
   DHCP message (including option 60) and broadcasts it on the network.

2. The first DHCP relay agent
   intercepts the broadcast DHCP request packet and inserts its own option 82 in
   the packet.

3. The relay agent
   automatically adds the circuit ID suboption and the remote ID suboption to
   option 82 and forwards them to the second relay agent.

4. The second relay agent
   encapsulates the first relay agent’s option 82 and inserts its own option 82.

5. The gateway IP address
   (giaddr) is set to the incoming interface on the second relay agent and the
   original giaddr from the first relay agent is encapsulated.

6. The second DHCP relay agent
   unicasts the DHCP packet to the DHCP server.

7. The DHCP server receives
   the packet and uses the VPN suboption information from the second relay, along
   with the option 82 information from the first relay agent, to assign IP
   addresses and other configuration parameters and forwards the packet back to
   the second relay agent.

8. When the second relay agent
   receives the reply message from the server, it restores the encapsulated option
   82 and prior giaddr from the first relay agent. The reply message is then sent
   to the prior giaddr.

9. The option 82 is stripped
   off of the packet by the first relay agent before forwarding to the client.

Figure 4. DHCP Relay Agent Information Option Encapsulation Support
Processing

Specifying the Packet
Forwarding Address

Device> enable

Device# configure terminal

Device(config)# interface GigabitEthernet0/0/0

Device(config-if)# ip helper-address 172.16.1.2

Configuring Relay Agent Information Option Support

Perform this task to enable support for the DHCP relay agent information option.

Note

If an ip dhcp relay information command is configured in global configuration mode but not configured in interface configuration mode, the global configuration is applied to all interfaces. If an ip dhcp relay information command is configured in both global configuration mode and interface configuration mode, the interface configuration command takes precedence over the global configuration command. However, the global configuration is applied to interfaces without the interface configuration. If an ip dhcp relay information command is not configured in global configuration mode but is configured in interface configuration mode, only the interface with the configuration option applied is affected. All other interfaces are not impacted by the configuration. See the «Configuring Relay Agent Information Option Support per Interface» section for more information on per-interface support for the relay agent information option. >

SUMMARY STEPS

1.   


enable



2.   


configure


terminal



3.   


ip
dhcp
relay
information
option



4.   


ip
dhcp
relay
information
check



5.   


ip
dhcp
relay
information
policy
{drop
|
keep
|
replace}



6.   


ip
dhcp
relay
information
trust-all



7.   


end



8.   


show
ip
dhcp
relay
information
trusted-sources

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	ip dhcp relay information option Example: Router(config)# ip dhcp relay information option	Enables the system to insert the DHCP relay agent information option (option-82 field) in forwarded BOOTREQUEST messages to a DHCP server. This function is disabled by default.
Step 4	ip dhcp relay information check Example: Router(config)# ip dhcp relay information check	(Optional) Configures DHCP to check that the relay agent information option in forwarded BOOTREPLY messages is valid. By default, DHCP checks that the option-82 field in DHCP reply packets it receives from the DHCP server is valid. If an invalid message is received, the relay agent drops it. If a valid message is received, the relay agent removes the option-82 field and forwards the packet. Use the ip dhcp relay information check command to reenable this functionality if it has been disabled.
Step 5	ip dhcp relay information policy {drop | keep | replace} Example: Router(config)# ip dhcp relay information policy replace	(Optional) Configures the reforwarding policy for a DHCP relay agent (what a relay agent should do if a message already contains relay information). See the «Relay Agent Information Reforwarding Policy» section for more information.
Step 6	ip dhcp relay information trust-all Example: Router(config)# ip dhcp relay information trust-all	(Optional) Configures all interfaces on a router as trusted sources of the DHCP relay information option. By default, if the gateway address is set to all zeros in the DHCP packet and the relay agent information option is already present in the packet, the DHCP relay agent will discard the packet. Use the ip dhcp relay information trust-allcommand to override this behavior and accept the packets. This command is useful if there is a switch in between the client and the relay agent that may insert option 82. Use this command to ensure that these packets do not get dropped. You can configure an individual interface as a trusted source of the DHCP relay information option by using the ip dhcp relay information trusted interface configuration mode command.
Step 7	end Example: Router(config)# end	Returns to privileged EXEC mode.
Step 8	show ip dhcp relay information trusted-sources Example: Router# show ip dhcp relay information trusted-sources	(Optional) Displays all interfaces configured to be a trusted source for the DHCP relay information option.

Configuring Relay Agent Information Option Support per Interface

Perform this task to enable support for the DHCP relay agent information option (option 82) on a per interface basis.

The interface configuration allows the subscribers with different DHCP option 82 requirements on different interfaces to be reached from one Cisco router.

Before You Begin

Read the “Restrictions” and «Relay Agent Information Reforwarding Policy» sections to understand how DHCP processes the relay agent information option for global configurations.

Note

If an ip dhcp relay information command is configured in global configuration mode but not configured in interface configuration mode, the global configuration is applied to all interfaces. If an ip dhcp relay information command is configured in both global configuration mode and interface configuration mode, the interface configuration command takes precedence over the global configuration command. However, the global configuration is applied to interfaces without the interface configuration. If an ip dhcp relay information command is not configured in global configuration mode but is configured in interface configuration mode, only the interface with the configuration option applied is affected. All other interfaces are not impacted by the configuration. >

SUMMARY STEPS

1.   


enable



2.   


configure


terminal



3.   


interface


type
number



4.   


ip
dhcp
relay
information
option-insert
[none]


5.   


ip
dhcp
relay
information
check-reply
[none]


6.   


ip
dhcp
relay
information
policy-action
{drop|
keep|
replace}



7.   


exit



8.   
Repeat Steps 3 through 7 to configure relay agent information settings on different interfaces.

DETAILED STEPS

	Command or Action	Purpose
Step 1	enable Example: Router> enable	Enables privileged EXEC mode. Enter your password if prompted.
Step 2	configure terminal Example: Router# configure terminal	Enters global configuration mode.
Step 3	interface type number Example: Router(config)# interface GigabitEthernet0/0/0	Configures an interface and enters interface configuration mode.
Step 4	ip dhcp relay information option-insert [none] Example: Router(config-if)# ip dhcp relay information option-insert	Enables the system to insert the DHCP relay agent information option (option-82 field) in forwarded BOOTREQUEST messages to a DHCP server. This function is disabled by default. However, if support for the relay agent information option is configured in global configuration mode, but not in interface configuration mode, the interface inherits the global configuration. The ip dhcp relay information option-insert none interface configuration command is saved in the running configuration. This command takes precedence over any global relay agent information configuration.
Step 5	ip dhcp relay information check-reply [none] Example: Router(config-if)# ip dhcp relay information check-reply	Configures a DHCP server to validate the relay information option in forwarded BOOTREPLY messages. By default, DHCP checks that the option-82 field in DHCP reply packets it receives from the DHCP server is valid. If an invalid message is received, the relay agent drops it. If a valid message is received, the relay agent removes the option-82 field and forwards the packet. Use the ip dhcp relay information check-reply command to reenable this functionality if it has been disabled. The ip dhcp relay information check-reply none interface configuration command option is saved in the running configuration. This command takes precedence over any global relay agent information configuration.
Step 6	ip dhcp relay information policy-action {drop| keep| replace} Example: Router(config-if)# ip dhcp relay information policy-action replace	Configures the information reforwarding policy for a DHCP relay agent (what a relay agent should do if a message already contains relay information).
Step 7	exit Example: Router(config-if)# exit	Exits interface configuration mode.
Step 8	Repeat Steps 3 through 7 to configure relay agent information settings on different interfaces.	(Optional)

Configuring the Subscriber
Identifier Suboption of the Relay Agent Information Option

Device> enable

Device# configure terminal

Device(config)# ip dhcp relay information option

Device(config)# interface atm4/0/0

Device(config-if)# ip dhcp relay information option subscriber-id newsubscriber123

Configuring DHCP Relay
Agent Support for MPLS VPNs

Device> enable

Device# configure terminal

Device(config)# ip dhcp relay information option vpn

Device(config)# interface GigabitEthernet0/0/0

Device(config-if)# ip helper-address vrf blue 172.27.180.232

Setting the Gateway Address
of the DHCP Broadcast to a Secondary Address Using Smart Relay Agent
Forwarding

Device> enable

Device# configure terminal

Device(config)# ip dhcp smart-relay

Device(config)# exit

Configuring Relay Agent Information Option Encapsulation Support

Router> enable

Router# configure terminal

Router(config)# ip dhcp relay information option

Router(config)# ip dhcp relay information option vpn

Router(config)# ip dhcp relay information policy encapsulate

Router(config)# interface FastEthernet0/0

Router(config-if)# ip dhcp relay information policy-action encapsulate

Troubleshooting the DHCP
Relay Agent

Device> enable

Device# show ip route dhcp

Device# show ip route dhcp 172.16.1.3

Device# show ip route vrf red dhcp 

Device# clear ip route dhcp

Example Configuring the DHCP Relay Agent and Relay Agent Information Option Support

!reenables the DHCP server
service dhcp
ip dhcp relay information option
!
interface GigabitEthernet 0/0/0
 ip address 192.168.100.1 255.255.255.0
 ip helper-address 10.55.11.3

Example Configuring the DHCP Relay Agent and Relay Agent Information Option Support per Interface

ip dhcp relay information trust-all
interface Loopback0
 ip address 10.16.0.1 255.255.255.0
!
interface ATM 3/0/0
 no ip address
!
interface ATM 3/0/0
 ip helper-address 10.16.1.2
 ip unnumbered loopback0
 ip dhcp relay information option-insert
!
interface Loopback1
 ip address 10.18.0.1 255.255.255.0
!
interface GigabitEthernet0/0/0
 no ip address
!
interface GigabitEthernet 0/0/1
 encap dot1q 123
 ip unnumbered loopback1
 ip helper-address 10.18.1.2
 ip dhcp relay information policy-action keep

Example Configuring the Subscriber Identifier Suboption

ip dhcp relay information option
!
interface Loopback0 
 ip address 10.1.1.129 255.255.255.192 
!
interface ATM 4/0/0 
 no ip address 
!
interface ATM 4/0/1 point-to-point
 ip helper-address 10.16.1.2
 ip unnumbered Loopback0
 ip dhcp relay information option subscriber-id newperson123
 atm route-bridged ip
 pvc 88/800
 encapsulation aal5snap

Example Configuring DHCP Relay Agent Support for MPLS VPNs

ip dhcp relay information option vpn
!
interface GigabitEthernet 0/0/0
 ip helper-address vrf red 10.44.23.7
!

Example Configuring DHCP Smart Relay Agent Forwarding

ip dhcp smart-relay
!
interface GigabitEthernet0/0/0
 ip address 192.168.100.1 255.255.255.0
 ip address 172.16.31.254 255.255.255.0
 ip helper-address 10.55.11.3
!

client
—A host trying to configure its interface (obtain an IP address)
using DHCP or BOOTP protocols.

DHCP
—Dynamic Host Configuration Protocol.

giaddr
—Gateway IP address. The giaddr field of the DHCP message
provides the DHCP server with information about the IP address subnet on which
the client is to reside. It also provides the DHCP server with an IP address
where the response messages are to be sent.

MPLS
—Multiprotocol Label Switching. Emerging industry standard upon
which tag switching is based.

relay
agent
—A device that forwards DHCP and BOOTP messages between a server
and a client on different subnets.

server
—DHCP or BOOTP server.

VPN
—Virtual Private Network. Enables IP traffic to use tunneling to
travel securely over a public TCP/IP network.

VRF
—VPN routing and forwarding instance. A VRF consists of an IP
routing table, a derived forwarding table, a set of interfaces that use the
forwarding table, and a set of rules and routing protocols that determine what
goes into the forwarding table. In general, a VRF includes the routing
information that defines a customer VPN site that is attached to a PE device.
Each VPN instantiated on the PE device has its own VRF.