Configuring The Dhcp Relay Agent Security Functions - 3Com 4500G Family Configuration Manual

To do...
Correlate the DHCP server
group with the current interface
You can specify up to twenty DHCP server groups on the relay agent and eight DHCP server
addresses for each DHCP server group.
The IP addresses of DHCP servers and those of relay agent's interfaces cannot be on the same
subnet. Otherwise, the client cannot obtain an IP address.
A DHCP server group can correlate with one or multiple DHCP relay agent interfaces, while a relay
agent interface can only correlate with one DHCP server group. Using the dhcp relay
server-select command repeatedly overwrites the previous configuration. However, if the
specified DHCP server group does not exist, the interface still uses the previous correlation.
The group-id argument in the dhcp relay server-select command was specified by the dhcp
relay server-group command.

Configuring the DHCP Relay Agent Security Functions

Creating static bindings and enable IP address check
For avoidance of invalid IP address configuration, you can configure the DHCP relay agent to check
whether a requesting client's IP and MAC addresses match a binding (dynamic or static) on the DHCP
relay agent.
With this feature enabled, the DHCP relay agent can dynamically record clients' IP-to-MAC bindings
after clients get IP addresses. It also supports static bindings, that is, you can manually configure
IP-to-MAC bindings on the DHCP relay agent, so that users can access external networks using fixed
IP addresses.
Upon receiving an ARP packet, the DHCP relay agent matches the sender's IP and MAC addresses in
the packet against the bindings (both dynamic and static). If no match is found, the DHCP relay agent
does not learn the ARP entry, and thus the sending host cannot access external networks via the DHCP
relay agent.
Follow these steps to create a static binding and enable IP address check:
To do...
Enter system view
Create a static binding
Enter interface view
Enable invalid IP
address check
Use the command...
dhcp relay server-select
group-id
Use the command...
system-view
dhcp relay security static ip-address
mac-address [ interface interface-type
interface-number ]
interface interface-type
interface-number
dhcp relay address-check { disable |
enable }
2-5
Remarks
Required
By default, no interface is
correlated with any DHCP
server group.
Remarks
—
Optional
No static binding is created
by default.
—
Required
Disabled by default.