Configuring The Dhcp Relay Agent Security Features; Rustications And Guidelines; Enabling The Dhcp Relay Agent To Record Relay Entries; Enabling Periodic Refresh Of Dynamic Relay Entries - H3C SR8800-F Configuration Manual

Step
10. (Optional.) Enable the
switchback to the master
DHCP server and set the
delay time.
Configuring the DHCP relay agent security
features

Rustications and guidelines

If you execute both the dhcp flood-protection enable and dhcp server check mac-address
commands on an interface, the dhcp server check mac-address command takes priority.

Enabling the DHCP relay agent to record relay entries

Perform this task to enable the DHCP relay agent to automatically record clients' IP-to-MAC bindings
(relay entries) after they obtain IP addresses through DHCP.
Some security features use the relay entries to check incoming packets and block packets that do
not match any entry. In this way, illegal hosts are not able to access external networks through the
relay agent. Examples of the security features are ARP address check, authorized ARP, and IP
source guard.
The DHCP relay agent does not record IP-to-MAC bindings for DHCP clients running on
synchronous/asynchronous serial interfaces.
To enable the DHCP relay agent to record relay entries:
Step
1. Enter system view.
2. Enable the relay agent to
record relay entries.

Enabling periodic refresh of dynamic relay entries

A DHCP client unicasts a DHCP-RELEASE message to the DHCP server to release its IP address.
The DHCP relay agent conveys the message to the DHCP server and does not remove the
IP-to-MAC entry of the client.
With this feature, the DHCP relay agent uses the following information to periodically send a
DHCP-REQUEST message to the DHCP server:
•
The IP address of a relay entry.
•
The MAC address of the DHCP relay interface.
The relay agent maintains the relay entries depending on what it receives from the DHCP server:
•
If the server returns a DHCP-ACK message or does not return any message within an interval,
the DHCP relay agent removes the relay entry. In addition, upon receiving the DHCP-ACK
message, the relay agent sends a DHCP-RELEASE message to release the IP address.
•
If the server returns a DHCP-NAK message, the relay agent keeps the relay entry.
To enable periodic refresh of dynamic relay entries:
Command
master-server switch-delay
delay-time
Command
system-view
dhcp relay client-information record
138
Remarks
By default, the DHCP relay agent
does not switch back to the master
DHCP server.
Remarks
N/A
By default, the relay agent
does not record relay entries.