Alcatel 9000 Guía de usuario descargar pdf (Pagina 356)

100

101

Configuring DHCP Security Features Configuring DHCP Relay

page 18-20 OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006

Configuring Rate Limiting

To set up DHCP rate limiting from the client, configure a QoS policy rule similar to the one shown in the

following example:

-> policy condition client-dhcp destination udp port 67

-> policy action client-limit maximum bandwidth <

rate>

-> policy rule client-limit action client-limit condition client-dhcp

Where <rate> is (packets per second * average packet size) or a specific overall data rate to use for limit-

ing the number of DHCP packets.

In the above rule example, however, DHCP requests are limited on all ports. To narrow the scope of the

rate limiting, add a source port condition to the rule. For example, the following condition specifies 3/2 as

a source port:

-> policy condition client-dhcp source port 3/2

In addition, you can also use the UserPorts port group to apply the rule to all ports that are members of this

group or configure a customized port group. For example:

-> policy condition client-dhcp source port group UserPorts

-> policy port group dhcp-client-ports 3/1-12 3/14

-> policy condition client-dhcp source port group dhcp-client-ports

Note that when QoS policy rules are configured, they do not apply to the switch until the qos apply

command is performed. See Chapter 26, “Configuring QoS,” in the OmniSwitch 6800/6850/9000 Network

Configuration Guide for more information.

Configuring the DHCP Snooping Binding Table

The DHCP Snooping binding table is automatically enabled when DHCP Snooping is enabled at either the

switch or VLAN level. This table is used by DHCP Snooping to filter DHCP traffic that is received on

untrusted ports.

Entries are made in this table when the relay agent receives a DHCPACK packet from a trusted DHCP

server. The agent extracts the client information, populates the binding table with the information and then

forwards the DHCPACK packet to the port where the client request originated.

To enable or disable the DHCP Snooping binding table, use the ip helper dhcp-snooping binding

command. For example:

-> ip helper dhcp-snooping binding enable

-> ip helper dhcp-snooping binding disable

Note that enabling the binding table functionality is not allowed if Option-82 data insertion is not enabled

at either the switch or VLAN level.

In addition, it is also possible to configure static binding table entries. This type of entry is created using

available ip helper dhcp-snooping binding command parameters to define the static entry. For example,

the following command creates a static DHCP client entry:

-> ip helper dhcp-snooping binding 00:2a:95:51:6c:10 port 1/15 address

17.15.3.10 lease-time 3 vlan 200

To remove a static binding table entry, use the no form of the ip helper dhcp-snooping binding

command. For example:

1 2 ... 351 352 353 354 355 356 357 358 359 360 361 ... 701 702

Comentarios a estos manuales

Sin comentarios

Alcatel 9000 Guía de usuario Pagina 356

Comentarios a estos manuales

Relacionado con productos y manuales para Software Alcatel 9000