Try   HackMD
DHCP Addressing

DHCPv4

Config

Exclude IPv4 Addresses

Router(config)# ip dhcp excluded-address <low-address> [<high-address>]

Define a DHCPv4 Pool Name

Router(config)# ip dhcp pool <pool-name>
Router(dhcp-config)#

Configure the DHCPv4 Pool

R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 192.168.11.5
R1(dhcp-config)# domain-name example.com
R1(dhcp-config)# end
R1# 
R1# show running-config | section dhcp
! Displays the DHCPv4 commands configured on the router.
R1# 
R1# show ip dhcp binding
! Displays a list of all IPv4 address to MAC address bindings provided by the DHCPv4 service.
R1# 
R1# show ip dhcp server statistics
! Displays count information regarding the number of DHCPv4 messages that have been sent and received.
R1#

Example

R1(config)# ip dhcp excluded-address 192.168.10.1 192.168.10.9
R1(config)# ip dhcp excluded-address 192.168.10.254
R1(config)# ip dhcp pool LAN-POOL-1
R1(dhcp-config)# network 192.168.10.0 255.255.255.0
R1(dhcp-config)# default-router 192.168.10.1
R1(dhcp-config)# dns-server 192.168.11.5
R1(dhcp-config)# domain-name example.com
R1(dhcp-config)# end
R1# 
R1# show running-config | section dhcp
! ip dhcp excluded-address 192.168.10.1 192.168.10.9
! ip dhcp excluded-address 192.168.10.254
! ip dhcp pool LAN-POOL-1
!  network 192.168.10.0 255.255.255.0
!  default-router 192.168.10.1
!  dns-server 192.168.11.5
!  domain-name example.com
R1# 
R1# show ip dhcp binding
! Bindings from all pools not associated with VRF:
! IP address      Client-ID/              Lease expiration        ! Type       State      Interface
!                 Hardware address/
!                 User name
! 192.168.10.10   0100.5056.b3ed.d8       Sep 15 2019 8:42 AM    ! Automatic  Active     GigabitEthernet0/0/0
R1# 
R1# show ip dhcp server statistics
! Memory usage         19465
! Address pools        1
! Database agents      0
! Automatic bindings   2
! Manual bindings      0
! Expired bindings     0
!  ...output truncated...
! Message              Received
! BOOTREQUEST          0
! DHCPDISCOVER         4
! DHCPREQUEST          2
! DHCPDECLINE          0
! DHCPRELEASE          0
! DHCPINFORM           0

DHCPv4 Relay

Configure a Router to relay DHCPv4 broadcasts to an external DHCPv4 server

R1(config)# interface g0/0/0
R1(config-if)# ip helper-address 192.168.11.6
R1(config-if)# end
R1#

By default, the ip helper-address command forwards the following eight UDP services

  • Port 37: Time
  • Port 49: TACACS
  • Port 53: DNS
  • Port 67: DHCP/BOOTP server
  • Port 68: DHCP/BOOTP client
  • Port 69: TFTP
  • Port 137: NetBIOS name service
  • Port 138: NetBIOS datagram service

DHCPv4 Client

Configure a Cisco IOS router as a DHCPv4 client - [connect the Ethernet interface to a cable or DSL modem]

R1(config)# interface G0/0/1
R1(config-if)# ip address dhcp
R1(config-if)# no shutdown
! Sep 12 10:01:25.773: %DHCP-6-ADDRESS_ASSIGN: Interface GigabitEthernet0/0/1 assigned DHCP address 209.165.201.12, mask 255.255.255.224, hostname R1
R1(config-if)# end
R1# 
R1# show ip interface g0/0/1
! GigabitEthernet0/0/1 is up, line protocol is up
!   Internet address is 209.165.201.12/27
!   Broadcast address is 255.255.255.255
!   Address determined by DHCP

DHCPv6 Configuration

DHCPv6 Router Advertisement

Stateless Address Auto-configuration (SLAAC) Advertisement

To enable the sending of RA messages, a router must join the IPv6 all-routers group using the ipv6 unicast-routing global config command, as show in the output.

R1(config)# ipv6 unicast-routing
R1(config)# exit
R1#

Stateless DHCPv6 Advertisement

Stateless DHCPv6 is enabled on a router interface using the ipv6 nd other-config-flag interface configuration command. This sets the O flag to 1.

Use the command no ipv6 nd other-config-flag to reset the interface to the default SLAAC only option (i.e. set the O flag to 0).

R1(config-if)# ipv6 nd other-config-flag
R1(config-if)# end
R1#
R1# show ipv6 interface g0/0/1 | begin ND
!  ND DAD is enabled, number of DAD attempts: 1
!  ND reachable time is 30000 milliseconds (using 30000)
!  ND advertised reachable time is 0 (unspecified)
!  ND advertised retransmit interval is 0 (unspecified)
!  ND router advertisements are sent every 200 seconds
!  ND router advertisements live for 1800 seconds
!  ND advertised default router preference is Medium
!  Hosts use stateless autoconfig for addresses.
!  Hosts use DHCP to obtain other configuration.
R1#

Stateful DHCPv6 Advertisement

Stateful DHCPv6 is enabled on a router interface using the ipv6 nd managed-config-flag interface configuration command. This sets the M flag to 1. The ipv6 nd prefix default no-autoconfig interface command disables SLAAC by setting the A flag to 0.

R1(config)# int g0/0/1
R1(config-if)# ipv6 nd managed-config-flag
R1(config-if)# ipv6 nd prefix default no-autoconfig
R1(config-if)# end
R1#
R1# show ipv6 interface g0/0/1 | begin ND
!  ND DAD is enabled, number of DAD attempts: 1
!  ND reachable time is 30000 milliseconds (using 30000)
!  ND advertised reachable time is 0 (unspecified)
!  ND advertised retransmit interval is 0 (unspecified)
!  ND router advertisements are sent every 200 seconds
!  ND router advertisements live for 1800 seconds
!  ND advertised default router preference is Medium
!  Hosts use DHCP to obtain routable addresses.
R1#

DHCPv6 Router Roles

Stateless DHCPv6 Configuration (Router-As-Server)

The stateless DHCPv6 server option requires that the router advertise the IPv6 network addressing information in RA messages. However, the client must contact a DHCPv6 server for more information.

  1. Enable IPv6 routing.
    2. R1(config)# ipv6 unicast-routing
R1(config)#
  2. Define a DHCPv6 pool name.
    3. R1(config)# ipv6 dhcp pool IPV6-STATELESS
R1(config-dhcpv6)#

    Pool names do not have to be uppercase. However, using an uppercase name makes it easier to see in a configuration.

  3. Configure the DHCPv6 pool.
    4. R1(config-dhcpv6)# dns-server 2001:db8:acad:1::254
R1(config-dhcpv6)# domain-name example.com
R1(config-dhcpv6)# exit
R1(config)#
  4. Bind the DHCPv6 pool to an interface.

    5. The DHCPv6 pool has to be bound to the interface using the ipv6 dhcp server POOL-NAME interface config command as shown in the output.

    R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# description Link to LAN
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# ipv6 nd other-config-flag
R1(config-if)# ipv6 dhcp server IPV6-STATELESS
R1(config-if)# no shut
R1(config-if)# end
R1#

    The O flag must be manually changed from 0 to 1 using the interface command ipv6 nd other-config-flag. The A flag is 1 by default, telling clients to use SLAAC to create their own GUA.

Stateless DHCPv6 Configuration (Router-As-Client)

A router can also be a DHCPv6 client and get an IPv6 configuration from a DHCPv6 server, such as a router functioning as a DHCPv6 server.

  1. Enable IPv6 routing.
    2. R1(config)# ipv6 unicast-routing
R1(config)#
  2. Configure client router to create an LLA.
    3. R3(config)# interface g0/0/1
R3(config-if)# ipv6 enable
R3(config-if)#
  3. Configure client router to use SLAAC.
    4. R3(config-if)# ipv6 address autoconfig
R3(config-if)# end
R3#
  4. Verify client router is assigned a GUA.
    5. R3# show ipv6 interface brief
! GigabitEthernet0/0/0   [up/up]
!     unassigned
! GigabitEthernet0/0/1   [up/up]
!     FE80::2FC:BAFF:FE94:29B1
!     2001:DB8:ACAD:1:2FC:BAFF:FE94:29B1
! Serial0/1/0            [up/up]
!     unassigned
! Serial0/1/1            [up/up]
!     unassigned
R3#

    It may take the interface a few seconds to complete the process.

  5. Verify client router received other DHCPv6 information.
    6. R3# show ipv6 dhcp interface g0/0/1
! GigabitEthernet0/0/1 is in client mode
!   Prefix State is IDLE (0)
!   Information refresh timer expires in 23:56:06
!   Address State is IDLE
!   List of known servers:
!     Reachable via address: FE80::1
!     DUID: 000300017079B3923640
!     Preference: 0
!     Configuration parameters:
!       DNS server: 2001:DB8:ACAD:1::254
!       Domain name: example.com
!       Information refresh time: 0
!   Prefix Rapid-Commit: disabled
!   Address Rapid-Commit: disabled
R3#

Stateful DHCPv6 Configuration (Router-As-Server)

The stateful DHCP server option requires that the IPv6 enabled router tells the host to contact a DHCPv6 server to obtain all necessary IPv6 network addressing information.

  1. Enable IPv6 routing and configure the DHCPv6 pool.
    2. R1(config)# ipv6 unicast-routing
R1(config)# ipv6 dhcp pool IPV6-STATEFUL
R1(config-dhcpv6)# address prefix 2001:db8:acad:1::/64
R1(config-dhcpv6)# dns-server 2001:4860:4860::8888
R1(config-dhcpv6)# domain-name example.com
R1(config-dhcpv6)# exit
R1(config)#
  2. Bind the DHCPv6 pool to an interface.
    • The M flag must be manually changed from 0 to 1 using the interface command ipv6 nd managed-config-flag.
    • The A flag is manually changed from 1 to 0 using the interface command ipv6 nd prefix default no-autoconfig. Setting the A flag to 0 tells the client not to use SLAAC to create a GUA.
    • The ipv6 dhcp server command binds the DHCPv6 pool to the interface.
    R1(config)# interface GigabitEthernet0/0/1
R1(config-if)# description Link to LAN
R1(config-if)# ipv6 address fe80::1 link-local
R1(config-if)# ipv6 address 2001:db8:acad:1::1/64
R1(config-if)# ipv6 nd managed-config-flag
R1(config-if)# ipv6 nd prefix default no-autoconfig
R1(config-if)# ipv6 dhcp server IPV6-STATEFUL
R1(config-if)# no shut
R1(config-if)# end
R1#

    You can use the no ipv6 nd managed-config-flag command to set the M flag back to its default of 0.

    Similarly, no ipv6 nd prefix default no-autoconfig command sets the A flag back to its default of 1.

Stateful DHCPv6 Configuration (Router-As-Client)

The client router needs to have ipv6 unicast-routing enabled and an IPv6 link-local address to send and receive IPv6 messages.

R3(config)# ipv6 unicast-routing
R3(config)# interface g0/0/1
R3(config-if)# ipv6 enable
R3(config-if)# ipv6 address dhcp
R3(config-if)# end
R3# 
R3# show ipv6 interface brief
! GigabitEthernet0/0/0   [up/up]
!     unassigned
! GigabitEthernet0/0/1   [up/up]
!     FE80::2FC:BAFF:FE94:29B1
!     2001:DB8:ACAD:1:B4CB:25FA:3C9:747C
! Serial0/1/0            [up/up]
!     unassigned
! Serial0/1/1            [up/up]
!     unassigned
R3#

DHCPv6 Relay Agent Configuration

If the DHCPv6 server is located on a different network than the client, then the IPv6 router can be configured as a DHCPv6 relay agent. The configuration of a DHCPv6 relay agent is similar to the configuration of an IPv4 router as a DHCPv4 relay.

R1(config)# interface gigabitethernet 0/0/1
R1(config-if)# ipv6 dhcp relay destination 2001:db8:acad:1::2 G0/0/0
R1(config-if)# exit
R1(config)#

This command is configured on the interface facing the DHCPv6 clients and specifies the DHCPv6 server address and egress interface to reach the server, as shown above. The egress interface is only required when the next-hop address is an LLA.

DHCPv6 Relay Agent Verification Commands

The DHCPv6 relay agent can be verified using the show ipv6 dhcp interface command. This will verify that the appropriate interface is in relay mode.

R1# show ipv6 dhcp interface
! GigabitEthernet0/0/1 is in relay mode
!   Relay destinations:
!     2001:DB8:ACAD:1::2
!     2001:DB8:ACAD:1::2 via GigabitEthernet0/0/0
R1#

On the DHCPv6 server, use the show ipv6 dhcp binding command to verify if any hosts have been assigned an IPv6 configuration.

R3# show ipv6 dhcp binding
! Client: FE80::5C43:EE7C:2959:DA68
!   DUID: 0001000124F5CEA2005056B3636D
!   Username : unassigned
!   VRF : default
!   IA NA: IA ID 0x03000C29, T1 43200, T2 69120
!     Address: 2001:DB8:ACAD:2:9C3C:64DE:AADA:7857
!             preferred lifetime 86400, valid lifetime 172800
!             expires at Sep 29 2019 08:26 PM (172710 seconds)
R3#

DHCPv6 Server Verification Commands

The show ipv6 dhcp pool command verifies the name of the DHCPv6 pool and its parameters. The command also identifies the number of active clients.

R1# show ipv6 dhcp pool
! DHCPv6 pool: IPV6-STATEFUL
!   Address allocation prefix: 2001:DB8:ACAD:1::/64 valid 172800 ! preferred 86400 (2 in use,  0 conflicts)
!   DNS server: 2001:4860:4860::8888
!   Domain name: example.com
!   Active clients: 2
R1#

The show ipv6 dhcp binding command displays the IPv6 link-local address of the client and the global unicast address assigned by the server.

This information is maintained by a stateful DHCPv6 server. A stateless DHCPv6 server would not maintain this information.

R1# show ipv6 dhcp binding
! Client: FE80::192F:6FBC:9DB:B749
!   DUID: 0001000125148183005056B327D6
!   Username : unassigned
!   VRF : default
!   IA NA: IA ID 0x03000C29, T1 43200, T2 69120
!     Address: 2001:DB8:ACAD:1:A43C:FD28:9D79:9E42
!             preferred lifetime 86400, valid lifetime 172800
!             expires at Sep 27 2019 09:10 AM (171192 seconds)
R1#
Last changed by 
 
Faelin Landy
0
535

Read more

Ruby on Rails Tutorial, pt. 1 – Ruby

Overview of the &quot;Ruby&quot; part of Ruby on Rails

Jan 25, 2024
ASA Firewall Configuration

ASA Firewall Configuration [toc] --- Getting Started ASA CLI Overview The ASA command line interface has a similar look and feel to the Cisco router IOS. However, the ASA CLI also has different commands. This table contrasts common IOS router and ASA commands.

Nov 21, 2021
Network Security Configuration

Network Security Configuration [toc] --- {%hackmd r8ZvM3noSwKf-NviH6Qb3Q %} Dynamic Routing Protocol Security Routing systems can be attacked by disrupting peer network routers, or by falsifying or spoofing the information carried within the routing protocols. Spoofing routing information may generally be used to cause systems to misinform each other, cause a DoS attack, or cause traffic to follow a path it would not normally follow.

Nov 21, 2021
VPN Configuration

VPN Configuration [toc] --- Overview To secure network traffic between sites and users, organizations use virtual private networks (VPNs) to create end-to-end private network connections. VPNs are private in that traffic over a VPN is encrypted to keep the data confidential while it is transported across a public network. :::info The first types of VPNs were strictly IP tunnels that did not include authentication or encryption of the data. For example, Generic Routing Encapsulation (GRE), which does not include encryption services, is used to encapsulate IPv4 and IPv6 traffic inside an IP tunnel to create a virtual point-to-point link.

Nov 18, 2021
Read more from Faelin Landy
Published on HackMD