Droms R. The DHCP handbook
Подождите немного. Документ загружается.
The Dynamic Address Pool
If you are confident that no servers with permanently assigned IP addresses will be
added to the network, you can allocate all the remaining 252 IP addresses to the
DHCP server in a dynamic pool. However, it can be helpful to save some addresses
for new servers that might be added later. For example, you can reserve addresses
10.0.0.1 through 10.0.0.9 for servers and give the remaining addresses to the DHCP
server to allocate to DHCP clients. To provide addresses to the DHCP server for
assignment, you use the
range statement, as shown in Example 15.3.
Example 15.3
range 10.0.0.10 10.0.0.254;
Now that the DHCP server has some IP addresses to allocate, it can respond when a
client requests an address. When a DHCP client broadcasts a
DHCPDISCOVER message
on the network in this example, the DHCP server chooses an address from the range
shown in Example 15.3. It’s not really possible to guess which address the server will
allocate because it depends on the server implementation.
Client Configuration Information
At this point, the DHCP server in our example has only enough information to
assign the client an IP address. As mentioned in Chapter 1, “An Introduction to
DHCP,” and Chapter 9, “DHCP Options,” this is not enough information to enable
the client to do anything useful. At a minimum, the client must know the IP address
of a router that can serve as its default route and the IP address of at least one name
server. This is shown in Example 15.4.
Example 15.4
option domain-name-servers ns.fugue.com;
option routers gw.nyc.fugue.com;
NOTE
In Example 15.4, the values of the domain name servers and routers options are declared
by using the domain names that correspond to those servers (for example, ns. fugue.com).
The DHCP server translates these domain names into IP addresses and sends the IP addresses
to the DHCP client. Because the network administrator used domain names, there is no need
to edit the configuration file when the IP addresses assigned to the routers and servers
change.
The only drawback to this is that it takes time to look up a domain name. If a client sends
a request and the DHCP server finds that it has to look up one or more names to satisfy
that request, it has to send its own request to the DNS server for each name, wait for the
responses, and then send its reply to the client.
CHAPTER 15 Configuring a DHCP Server256
019 3273 CH15 10/3/02 4:59 PM Page 256
To take advantage of this feature, it is a good idea to have a DNS server running either on the
same machine as your DHCP server or locally on the same network segment that is either a
primary or secondary server for all domain names mentioned in the DHCP server configura-
tion file. DNS and DHCP tend to go together, so this is a very common configuration anyway.
Some clients also require the broadcast address option, although many compute it
themselves from the IP address and subnet mask. Example 15.5 shows how to send
this option explicitly.
Example 15.5
option broadcast-address 10.0.0.255;
If the DHCP network administrator does not specify the subnet-mask option, the
DHCP server uses the subnet mask value from the subnet declaration. To simplify
maintenance, you should not write an explicit
subnet-mask option declaration.
Example 15.6 shows an example of a
subnet-mask option declaration.
Example 15.6
option subnet-mask 255.255.255.0;
A Complete Subnet Configuration
In the previous DHCP examples in this chapter we have described the minimal set of
options that most DHCP clients need to use a simple network, such as the one at Ted
Lemon’s home. In practice, you must usually specify more options. Chapter 9 gives a
complete list of DHCP options.
Example 15.7 shows the complete DHCP server configuration file, with the option
declarations shown in the previous examples.
Example 15.7
Authoritative;
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.10 10.0.0.254;
option domain-name-servers ns.fugue.com;
option routers gw.nyc.fugue.com;
option broadcast-address 10.0.0.255;
}
Configuring a DHCP Server to Be Authoritative 257
019 3273 CH15 10/3/02 4:59 PM Page 257
Supporting Multiple Network Segments
Many sites require DHCP service on more than one subnet. For example, at the DEC
Palo Alto campus, five separate business units were located in four buildings, and
each business unit had between one and four network segments of its own.
When servicing more than one network segment, the network administrator must
do the following:
•Write a subnet declaration for each network segment
• Define a range of addresses that the DHCP server can allocate on each subnet
•Write option declarations for global options and also for options that vary on
different subnets
•Make sure DHCP packets from all network segments can get to the DHCP
server
Each additional subnet declaration is written as described in the section
“Configuring an Individual Subnet,” earlier in this chapter.
There are two ways to configure the DHCP server and the network routers so that
the DHCP server receives DHCP broadcasts from each of the network segments that
it supports:
• Connect the DHCP server directly to each network segment.
• Relay messages to the DHCP server from network segments to which it is not
directly connected, using a relay agent.
Multiple Network Interfaces
One way to support more than one network segment from a single DHCP server is to
connect the DHCP server directly to every network segment you want to support. To
make this work, the server must be installed in a location where all network
segments are available, and a network interface must be installed in the server
computer for each network segment. Figure 15.1 shows an example of such a config-
uration.
CHAPTER 15 Configuring a DHCP Server258
019 3273 CH15 10/3/02 4:59 PM Page 258
FIGURE 15.1 Connecting the DHCP server directly to all network segments.
Using DHCP Relay Agents
Rather than directly connect the DHCP server to every network segment it serves,
most network administrators configure a DHCP relay agent on each network
segment. Relay agents are configured with a list of one or more DHCP servers. When
a relay agent receives a message from a DHCP client on a particular network
segment, it records the IP address of the interface on which it received the request in
the
giaddr field of the message, and then it forwards the message to the DHCP
server.
The server uses the
giaddr field to determine what network segment the client is
attached to. When it has a reply for the client, it sends the reply back to the relay
agent, using the IP address the relay agent stored in the
giaddr field. The DHCP
relay agent then sends the message back to the DHCP client. Chapter 7 describes this
process in greater detail.
Relay Agent Types
There are two common kinds of DHCP relay agents: those that run in IP routers and
those that run on general-purpose computers. Relay agents are not routers; they are
network server programs that relay packets from clients to servers and from servers
to clients.
One possible configuration is to have a server machine on every network segment
on which DHCP services will be provided and to have one of the services on that
computer be a relay agent that relays DHCP requests back to a central DHCP server.
This configuration is illustrated in Figure 15.2. The drawback to this setup is that a
server is needed on every network segment.
Supporting Multiple Network Segments 259
Network
Segment
A
Network
Segment
C
Network
Segment
B
Network
Segment
D
DHCP Server
Machine
019 3273 CH15 10/3/02 4:59 PM Page 259
FIGURE 15.2 Using general-purpose computers as relay agents.
If you use dedicated routers to route on the network, and if the router software
includes a DHCP relay agent, it is very convenient to use the embedded relay agent.
A router must be connected to every network segment anyway, so in this case you do
not incur an additional equipment overhead for providing DHCP service. Figure 15.3
shows an example of this sort of configuration.
If a general-purpose computer does the routing, you can likewise run a DHCP relay
agent program on each router. It is becoming popular at some cost-sensitive sites to
set up inexpensive Linux or NetBSD-based computers that start from a floppy disk or
a very small hard drive to act as dedicated routers. Starting up a DHCP relay agent
on such a machine takes little additional effort and serves the same purpose as a
built-in DHCP relay agent on a dedicated router. Figure 15.4 shows such a
configuration.
CHAPTER 15 Configuring a DHCP Server260
Network
Segment
A
Network
Segment
C
Network
Segment
B
Network
Segment
D
DHCP
Server
DHCP Relay
Server
DHCP Relay
Server
DHCP Relay
Server
Router
019 3273 CH15 10/3/02 4:59 PM Page 260
FIGURE 15.3 Using a dedicated router with its own DHCP relay agent.
Supporting Multiple Network Segments 261
Network
Segment
A
Network
Segment
B
Network
Segment
C
Network
Segment
D
DHCP Server
Machine
Router with
Relay Agent
Network
Segment
A
Network
Segment
B
Network
Segment
D
Network
Segment
C
DHCP Server
Machine
Linux or
NetBSD
Router
with
Relay Agent
FIGURE 15.4 Using an inexpensive PC running Linux or NetBSD for routing and DHCP
relay.
The ISC DHCP Relay Agent
The ISC DHCP relay agent is a widely available relay agent that works on general-
purpose computers. This program typically runs automatically at system startup. The
IP addresses or domain names of the DHCP server or DHCP servers to which the
relay agent should forward DHCP messages are specified on the command line as
shown in Example 15.8.
019 3273 CH15 10/3/02 4:59 PM Page 261
Example 15.8
dhcrelay dhcp.rc.isc.org
The Cisco DHCP Relay Agent
Most dedicated routers contain built-in DHCP relay agents, and each router must be
configured differently. It is difficult to document every possible embedded router; for
this book, Cisco routers are used as examples.
Cisco routers running Cisco IOS versions 10.0 and higher support DHCP relaying as
part of a general mechanism for forwarding UDP broadcasts. Every interface on a
Cisco router is declared by using an
interface declaration. After the interface decla-
ration for the interface connected to each network segment for which the network
administrator wants to provide DHCP relaying, one or more
IP helper-address
statements must be written—one for each DHCP server to which DHCP packets will
be relayed.
The Cisco
IP helper-address statement enables relaying of a number of UDP-based
protocols by default. These include the Time Server (port 37), TACACS (port 49),
DNS (port 53), DHCP/BOOTP (port 67 and 68), TFTP (port 69), NetBIOS Name
Service (port 137), and NetBIOS Datagram Service (Port 138) protocols. It is a good
idea to disable relaying of these protocols unless you want them relayed. The Cisco
IP forward-protocol statement controls the relaying of UDP broadcast packets.
Example 15.9 shows how relaying is enabled on two interfaces to a single DHCP
server at IP address 10.20.11.7 and how all UDP ports except for the DHCP ports are
disabled.
Example 15.9
no ip forward-protocol udp 37
no ip forward-protocol udp 49
no ip forward-protocol udp 53
no ip forward-protocol udp 69
no ip forward-protocol udp 137
no ip forward-protocol udp 138
ip forward-protocol udp 67
ip forward-protocol udp 68
interface ethernet 0
ip address 10.20.11.1 255.255.255.0
interface ethernet 1
ip address 10.20.12.1 255.255.255.0
ip helper-address 10.20.11.7
interface ethernet 2
ip address 10.20.13.1 255.255.255.0
ip helper-address 10.20.11.7
CHAPTER 15 Configuring a DHCP Server262
019 3273 CH15 10/3/02 4:59 PM Page 262
In Example 15.9, three Ethernet interfaces are defined. The first is connected to
subnet 10.20.11/24, which is the subnet that the DHCP server is also connected to.
No
IP helper-address statement exists for this interface because the DHCP server
does not need relaying for its own subnet. The other two interfaces are connected
to subnets 10.20.12/24 and 10.20.13/24, and both of these interface definitions
include
IP helper-address statements that point to the DHCP server. The IP
forward-protocol statements are outside the interface definitions because they
apply globally.
Other Embedded Relay Agents
Most dedicated routers include DHCP relay agents. The documentation that comes
with a router should state what is needed to configure the router. If the documenta-
tion is not sufficient, you can try to contact the router vendor for help. If the vendor
can’t help you, you can also contact the support group for the DHCP server. In all
likelihood, someone else who is using that server is also using the same router and
knows how to make it work. It is beyond the scope of this book to provide a
complete list of such support groups; information on obtaining support can be
found in the documentation accompanying most routers and DHCP servers.
A DHCP CONFIGURATION FOR THE ISC OFFICE
The ISC office is a modest affair—a small building with perhaps 20 offices, a machine room,
and a testing lab hosted by Vixie Enterprises. It has two network segments: the office network
and the lab network. The DHCP server runs on a server on the office network, and a small,
dedicated router with a built-in relay agent relays DHCP traffic from the lab network.
The isc.org domain is actually used only for external servers; all the internal machines are
in the rc.vix.com domain for the Redwood City, California, offices of Vixie Enterprises.
Figure 15.5 is a diagram of the network.
Supporting Multiple Network Segments 263
Office
Network
204.152.187/24
Lab
Network
204.152.186/24
DHCP Server
Dedicated Router
with DHCP Relay
FIGURE 15.5 The ISC office network.
019 3273 CH15 10/3/02 4:59 PM Page 263
The ISC office has a pair of DNS servers: one running on bb.rc.vix.com and one running on
ib.rc.vix.com. These servers provide name service for the entire office—every DHCP client
uses them, regardless of the network segment to which it is connected. The domain name for
the entire office is rc.vix.com. Network Time Protocol (NTP) is also used quite heavily. The
ISC’s standard NTP server is clock.isc.org.
Because these options are the same, regardless of the network segment to which a DHCP
client is connected, they can be defined globally for all network segments. The global options
are specified at the beginning of the file, before any subnet declarations, as shown in
Example 15.10.
Example 15.10
option domain-name-servers bb.rc.vix.com, ib.rc.vix.com;
option domain-name “rc.vix.com”;
option ntp-servers clock.isc.org;
The office network has a network number of 204.152.187.0 and a subnet mask of
255.255.255.0. The Cisco router, which routes to both the lab network and the Internet, is
connected at IP address 204.152.187.254. Example 15.11 shows the subnet declaration for
the office network.
Example 15.11
subnet 204.152.187.0 netmask 255.255.255.0 {
range 204.152.187.200 204.152.187.239;
option routers 204.152.187.254;
option broadcast-address 204.152.187.255;
}
You might notice that for a subnet with 254 possible IP addresses, only 40 addresses are avail-
able to the DHCP server for dynamic allocation. This configuration has been specified because
there are many computers with fixed addresses on this network, and only a few computers—
mostly notebooks and desktop computers—are configured with DHCP.
The lab network has a network number of 204.152.186.0 and a subnet mask of
255.255.255.0. It is routed through the same Cisco router as the office network. The Cisco
router’s IP address on the lab network is 204.152.186.254. Example 15.12 shows the subnet
declaration, which looks very much like the one for the office network.
Example 15.12
subnet 204.152.186.0 netmask 255.255.255.0 {
range 204.152.186.20 204.152.186.30;
option routers 204.152.186.254;
option broadcast-address 204.152.186.255;
}
CHAPTER 15 Configuring a DHCP Server264
019 3273 CH15 10/3/02 4:59 PM Page 264
The difference in the address ranges of the lab and office networks reflects the fact that the
lab network contains many computers with fixed IP addresses running a variety of different
operating systems. Unfortunately, none of them provide a DHCP client, and all of them must
have permanently assigned IP addresses. It is quite rare for somebody to plug a DHCP-aware
computer into the network, but a few addresses are made available just in case.
A Cisco router connects the two networks. The router is configured as a relay agent by using
the Cisco-specific IP helper-address and IP forward-protocol statements. Example 15.13
shows the relevant sections of the Cisco configuration file.
Example 15.13
no ip forward-protocol udp 37
no ip forward-protocol udp 49
no ip forward-protocol udp 53
no ip forward-protocol udp 69
no ip forward-protocol udp 137
no ip forward-protocol udp 138
ip forward-protocol udp 67
ip forward-protocol udp 68
interface ethernet 0
ip address 204.152.187.0 255.255.255.0
interface ethernet 1
ip address 204.152.186.0 255.255.255.0
ip helper-address 204.152.187.11
Example 15.14 shows the complete DHCP configuration file for the ISC Redwood City office.
Example 15.14
option domain-name-servers bb.rc.vix.com, ib.rc.vix.com;
option domain-name “rc.vix.com”;
option ntp-servers clock.isc.org;
subnet 204.152.187.0 netmask 255.255.255.0 {
range 204.152.187.200 204.152.187.239;
option routers 204.152.187.254;
option broadcast-address 204.152.187.255;
}
subnet 204.152.186.0 netmask 255.255.255.0 {
range 204.152.186.20 204.152.186.30;
option routers 204.152.186.254;
option broadcast-address 204.152.186.255;
}
Supporting Multiple Network Segments 265
019 3273 CH15 10/3/02 4:59 PM Page 265