R3166-R3206-HP High-End Firewalls Network Management Configuration Guide-6PW101

147
NOTE:
• The dhcp relay address-check enable command can be executed only on Layer 3 Ethernet interfaces
(including sub-interfaces).
• Before enabling address check on an interface, you must enable the DHCP service, and enable the
DHCP relay agent on the interface; otherwise, the address check configuration is ineffective.
• The dhcp relay address-check enable command only checks IP addresses but not interfaces.
• When using the dhcp relay security static command to bind an interface to a static binding entry, make
sure that the interface is configured as a DHCP relay agent; otherwise, address entry conflicts may
occur.
Configuring periodic refresh of dynamic client entries
A DHCP client unicasts a DHCP-RELEASE message to the DHCP server to release its IP address. The
DHCP relay agent simply conveys the message to the DHCP server and does not remove the IP-to-MAC
entry of the client.
With this feature, the DHCP relay agent uses the IP address of a client and the MAC address of the DHCP
relay interface to periodically send a DHCP-REQUEST message to the DHCP server.
• If the server returns a DHCP-ACK message or does not return any message within a specified
interval, the DHCP relay agent ages out the entry.
• If the server returns a DHCP-NAK message, the relay agent keeps the entry.
Follow these steps to configure periodic refresh of dynamic client entries:
To do… Use the command…
Remarks
Enter system view system-view —
Enable periodic refresh of dynamic
client entries
dhcp relay security refresh enable
Optional
Enabled by default.
Configure the refresh interval
dhcp relay security tracker
{ interval | auto }
Optional
auto by default. (auto interval is
calculated by the relay agent
according to the number of client
entries.)
Enabling unauthorized DHCP server detection
Unauthorized DHCP servers may assign wrong IP addresses to DHCP clients.
With unauthorized DHCP servers detection enabled, the DHCP relay agent checks whether a request
contains Option 54 (Server Identifier Option). If yes, the DHCP relay agent records the IP address in the
option, which is the IP address of the DHCP server that assigned an IP address to the DHCP client, and
records the receiving interface. The administrator can use this information to check for unauthorized
DHCP servers.
Follow these steps to enable unauthorized DHCP server detection:
To do… Use the command…
Remarks
Enter system view system-view —
Enable unauthorized DHCP server
detection
dhcp relay server-detect
Required
Disabled by default.