KB.15.15

Figure 49 Example configured to allow only the primary relay agent to contribute an Option 82

field

The above combination allows for detection and dropping of client requests with spurious Option

82 fields. If none are found, the drop policy on the first relay agent adds an Option 82 field, which

is then kept unchanged over the next two relay agent hops ("B" and "C".) The server can then

enforce an IP addressing policy based on the Option 82 field generated by the edge relay agent

("A".) In this example, the DHCP policy boundary is at relay agent 1.

Figure 50 Example configured to allow multiple relay agents to contribute an Option 82 field

This is an enhancement of the previous example. In this case, each hop for an accepted client

request adds a new Option 82 field to the request. A DHCP server capable of using multiple Option

82 fields can be configured to use this approach to keep a more detailed control over leased IP

addresses. In this example, the primary DHCP policy boundary is at relay agent "A," but more

global policy boundaries can exist at relay agents "B" and "C."

Figure 51 Example allowing only an upstream relay agent to contribute an Option 82 field

Like the first example, above, this configuration drops client requests with spurious Option 82 fields

from clients on the edge relay agent. However, in this case, only the Option 82 field from the last

relay agent is retained for use by the DHCP server. In this case the DHCP policy boundary is at

relay agent "C." In the previous two examples the boundary was with relay "A."

Validation of server response packets

A valid Option 82 server response to a client request packet includes a copy of the Option 82

fields the server received with the request. With validation disabled, most variations of Option 82

information are allowed, and the corresponding server response packets are forwarded.

Server response validation is an option you can specify when configuring Option 82 DHCP for

append, replace, or drop operation. See “Forwarding policies” (page 241). Enabling validation

on the routing switch can enhance protection against DHCP server responses that are either from

untrusted sources or are carrying invalid Option 82 information.

With validation enabled, the relay agent applies stricter rules to variations in the Option 82 fields

of incoming server responses to determine whether to forward the response to a downstream device

or to drop the response due to invalid (or missing) Option 82 information. Table 29 (page 244),

below, describes relay agent management of DHCP server responses with optional validation

enabled and disabled

DHCP Option 82 243