{"id":510,"date":"2020-04-06T20:49:37","date_gmt":"2020-04-06T18:49:37","guid":{"rendered":"http:\/\/tech.sosthe.sk\/?page_id=510"},"modified":"2020-04-06T20:49:37","modified_gmt":"2020-04-06T18:49:37","slug":"13-dhcp-sluzby-na-switchi","status":"publish","type":"page","link":"http:\/\/tech.sosthe.sk\/index.php\/ccna\/cisco-ios\/13-dhcp-sluzby-na-switchi\/","title":{"rendered":"13. DHCP slu\u017eby na switchi"},"content":{"rendered":"

Konfigur\u00e1cia DHCP Serveru<\/span><\/h3>\n

DHCP server, teda dynamick\u00e9 pride\u013eovanie adries, je slu\u017eba, ktor\u00e1 je s\u00fa\u010das\u0165ou v\u00e4\u010d\u0161iny dne\u0161n\u00fdch Catalyst switchov (alebo lep\u0161ie povedan\u00e9 dne\u0161n\u00fdch verzi\u00ed IOSu) a tie\u017e routerov.\u00a0V defaultn\u00fdm nastaven\u00ed je t\u00e1to slu\u017eba zapnut\u00e1, ale nem\u00e1 nastaven\u00e9 \u017eiadne parametre, tak\u017ee adresy nepride\u013euje.<\/span><\/p>\n

SWITCH (config) # service dhcp <\/strong>             \/\/ zapne DHCP server (defaultne je zapnut\u00fd)<\/span><\/pre>\n
Konfigur\u00e1cia adresn\u00e9ho poolu<\/span><\/h4>\n
Aby sa mohli pride\u013eova\u0165 adresy, tak mus\u00edme vytvori\u0165\u00a0<\/span>DHCP Pool<\/span><\/em><\/strong>\u00a0a nastavi\u0165 mu po\u017eadovan\u00e9 parametre.\u00a0T\u00fdchto poolov m\u00f4\u017eeme vytvori\u0165 nieko\u013eko, be\u017ene pre ka\u017ed\u00fa VLAN, v ktorej chceme pride\u013eova\u0165 adresy.<\/span><\/p>\n
SWITCH (config) # ip dhcp pool NET1 <\/strong>        \/\/ vytvor\u00ed pool s menom NET1<\/span><\/pre>\n
Vytvoren\u00edm pomenovan\u00e9ho Pool sa dostaneme do\u00a0<\/span>DHCP konfigura\u010dn\u00e9ho m\u00f3du<\/span><\/em><\/strong>\u00a0a nastavujeme jeho parametre.<\/span><\/p>\n
SWITCH (dhcp-config) # network 192.168.190.0 255.255.255.0 <\/strong>   \/\/ nastav\u00ed adresn\u00e9 rozsah, m\u00f4\u017eeme zada\u0165 nielen pomocou masky, ale aj pomocou CIDR (tak\u017ee napr\u00edklad \/ 24) \r\nSWITCH (dhcp-config) # default-router 192.168.190.1 <\/strong>          \/ \/ adresa br\u00e1ny \r\nSWITCH (dhcp-config) # domain-name mydomain.tld                <\/strong>\/\/ nastavenie DNS n\u00e1zvu dom\u00e9ny na mydomain.tld \r\nSWITCH (dhcp-config) # dns-server 192.168.190.9 192.168.190.8 <\/strong>\/\/ adresy DNS serverov (m\u00f4\u017eeme zada\u0165 1 a\u017e 8 adries) \r\nSWITCH (dhcp-config) # netbios-name-server 192.168.190.9 <\/strong>     \/\/ adresy WINS serverov (op\u00e4\u0165 ich m\u00f4\u017eeme zada\u0165 a\u017e 8) \r\nSWITCH (dhcp-config) # netbios-node-type h-node<\/strong>              \/\/ typ pre NetBios, pre MS klientov mus\u00edme zada\u0165 Hybridn\u00fd \r\nSWITCH (dhcp-config) # lease 30 <\/strong>                              \/\/ pren\u00e1jom adresy na 30 dn\u00ed, ak chceme zada\u0165 men\u0161ie \u010das, tak je form\u00e1t de\u0148 hodina min\u00fata (teda potrebn\u00e9 0 0 10 = 10 min\u00fat ) \r\nSWITCH (dhcp-config) # option 150 ip 192.168.190.20     <\/strong>       \/\/ m\u00f4\u017eeme definova\u0165 take \u013eubovo\u013en\u00fa zo \u0161peci\u00e1lnych vlastnost\u00ed, ktor\u00e9 m\u00f4\u017ee pride\u013eova\u0165 DHCP server klientovi, tu pr\u00edklad adresy TFTP servera pre Cisco IP telef\u00f3niu<\/span><\/pre>\n
Vyl\u00fa\u010denie adries<\/span><\/h4>\n
V\u00e4\u010d\u0161inou nechceme pride\u013eova\u0165 adresy z cel\u00e9ho rozsahu subnetu, preto m\u00f4\u017eeme nastavi\u0165 vyl\u00fa\u010den\u00e9 (nep\u0159id\u011blovan\u00e9) adresy.<\/span><\/p>\n
SWITCH (config) # ip dhcp excluded-address 192.168.190.0 192.168.190.10 <\/strong>\/\/ vyl\u00fa\u010di adresy 0 a\u017e 10 z pride\u013eovania<\/span><\/pre>\n
Rezerv\u00e1cia adresy<\/span><\/h4>\n
\u010eal\u0161ie be\u017enou vlastnos\u0165ou DHCP servera je mo\u017en\u00e9 rezervova\u0165 nejak\u00fa adresu pre ur\u010dit\u00fd po\u010d\u00edta\u010d pod\u013ea jeho MAC adresy, ten ke\u010f si potom po\u017eiada o IP adresu, dostane v\u017edy t\u00fato rezervovan\u00fa.\u00a0Na Cisco sa mus\u00ed pre ka\u017ed\u00fa rezerv\u00e1ciu vytvori\u0165 vlastn\u00e9 Pool.<\/span><\/p>\n
SWITCH (config) # ip dhcp pool client1 <\/strong>                         \/\/ vytvor\u00ed pool s menom client1 \r\nSWITCH (dhcp-config) # client-name wbouskap <\/strong>                   \/\/ nepovinn\u00e9 meno klienta bez dom\u00e9ny \r\nSWITCH (dhcp-config) # hos\u0165 192.168.190.9 255.255.255.0 <\/strong>       \/\/ adresa pre klienta spolu so subnetem (maska alebo CIDR) \r\nSWITCH (dhcp-config) # hardware-address 0012.1759.b073 ieee802 <\/strong>\/\/ MAC adresa a typ protocol, sl\u00fa\u017ei pre BOOTP \u017eiadosti \r\n \/\/ alebo klientsky identifik\u00e1tor pre Microsoft klientov (DHCP) \r\nSWITCH ( dhcp-config) # client-identifier 0100.1217.59b0.73 <\/strong>    \/\/ MAC adresa pred ktorou je typ m\u00e9dia, 01 je pre Ethernet a bodka sa pos\u00fava<\/span><\/pre>\n
Pozn .:<\/span><\/em><\/strong>\u00a0Preto\u017ee sa inform\u00e1cie ded\u00ed, tak nemus\u00edme pri rezerv\u00e1cii zad\u00e1va\u0165 v\u0161etky parametre, ale automaticky sa dopln\u00ed t\u00fdch z patri\u010dn\u00e9ho poolu.<\/span><\/p>\n
Ako sa prira\u010fuje Pool k VLAN<\/span><\/h3>\n
Niekto by sa mohol zam\u00fd\u0161\u013ea\u0165 nad t\u00fdm, ke\u010f m\u00e1m nieko\u013eko\u00a0<\/span>DHCP poolov<\/span><\/em><\/strong>\u00a0, tak pod\u013ea \u010doho sa prira\u010fuj\u00fa adresy r\u00f4znym \u017eiadostiam.\u00a0Pou\u017e\u00edva sa jednoduch\u00e1 a be\u017en\u00e1 met\u00f3da (podobne ako napr\u00edklad u MS DHCP servera).<\/span><\/p>\n
Server sa pozrie na\u00a0<\/span>adresu interfacu<\/span><\/em><\/strong>\u00a0, z ktor\u00e9ho pri\u0161la \u017eiados\u0165 a pod\u013ea nej doh\u013ead\u00e1 zodpovedaj\u00face\u00a0<\/span>Pool<\/span><\/em><\/strong>\u00a0, z neho potom pridel\u00ed adresu.\u00a0Ak by tak\u00fdto neexistoval, tak je \u017eiados\u0165 ignorovan\u00e1.\u00a0Z toho vypl\u00fdva d\u00f4le\u017eit\u00e1 vlastnos\u0165.\u00a0Ka\u017ed\u00e1\u00a0<\/span>VLAN<\/span><\/strong>\u00a0, v ktorej chceme pride\u013eova\u0165 adresy, mus\u00ed ma\u0165 nastaven\u00fa svoju\u00a0<\/span>IP adresu<\/span><\/strong>\u00a0(na switchi, kde be\u017e\u00ed DHCP slu\u017eba).<\/span><\/p>\n
Inform\u00e1cie z DHCP servera<\/span><\/h3>\n
Ke\u010f sa pridel\u00ed IP adresa nejak\u00e9mu po\u010d\u00edta\u010du, tak sa o tom vytvor\u00ed z\u00e1znam, ktor\u00fd sa ozna\u010duje ako DHCP Binding a obsahuje IP adresu a MAC adresu (a \u010fal\u0161ie parametre).<\/span><\/p>\n
SWITCH # show ip dhcp Bindings <\/strong>         \/\/ zoznam pridelen\u00fdch adries \r\nSWITCH # clear ip dhcp Bindings <\/strong>         \/\/ vyma\u017ee zoznam \r\nSWITCH # show ip dhcp conflicts <\/strong>        \/\/ zoznam konfliktov \r\nSWITCH # clear ip dhcp conflicts <\/strong>       \/\/ vyma\u017ee zoznam konfliktov \r\nSWITCH # show ip dhcp pool <\/strong>             \/\/ inform\u00e1cie o poole \r\nSWITCH # show ip dhcp server statistics <\/strong> \/\/ \u0161tatistiky servera<\/span><\/pre>\n
V pr\u00edpade probl\u00e9mov m\u00f4\u017eeme ladi\u0165 komunik\u00e1ciu zapnut\u00edm Debugging.<\/span><\/p>\n
SWITCH # debug ip dhcp server packets<\/strong> \r\nSWITCH # debug ip dhcp server events<\/strong><\/span><\/pre>\n
Postupnos\u0165 zasielan\u00fdch paketov je:<\/span><\/p>\n
    \n
  • klient\u00a0<\/span>DHCPDISCOVER<\/span><\/strong><\/li>\n
  • server\u00a0<\/span>DHCPOFFER<\/span><\/strong><\/li>\n
  • klient\u00a0<\/span>DHCPREQUEST<\/span><\/strong><\/li>\n
  • server\u00a0<\/span>DHCPACK<\/span><\/strong><\/li>\n<\/ul>\n
    Adresa switche z DHCP<\/span><\/h3>\n
    Tro\u0161ku bokom, ale patriaci k DHCP, je aj mo\u017enos\u0165, aby si switch po\u017eiadal o adresu z DHCP servera.\u00a0V praxi by som v\u0161ak odpor\u00fa\u010dal nastavova\u0165 adresu napevno.<\/span><\/p>\n
    SWITCH (config-if) # ip address dhcp <\/strong>    \/\/ interface dostane adresu z DHCP<\/span><\/pre>\n
    DHCP Relay Agent<\/span><\/h3>\n
    \u017diados\u0165<\/span><\/em><\/strong>\u00a0o adresu z DHCP prebieha pomocou<\/span>\u00a0Broadcast<\/span><\/em><\/strong>\u00a0, to znamen\u00e1, \u017ee DHCP server mus\u00ed by\u0165 na<\/span>\u00a0rovnakom subnetu<\/span><\/em><\/strong>\u00a0ako klient.\u00a0\u010co je v praxi \u010dasto nepohodln\u00e9 (napr\u00edklad chceme ma\u0165 iba jeden centr\u00e1lny DHCP server).\u00a0Preto je mo\u017en\u00e9 vyu\u017ei\u0165<\/span>\u00a0DHCP Relay Agenta<\/span><\/strong>\u00a0, ktor\u00fd be\u017e\u00ed typicky na routeru (\u010do je v lok\u00e1lnej sieti v\u00e4\u010d\u0161inou switch).\u00a0Ten prijme<\/span>\u00a0DHCP po\u017eiadavku<\/span><\/em><\/strong>\u00a0a u\u017e ako unicast ho po\u0161le ur\u010den\u00e9mu<\/span>\u00a0DHCP servera<\/span><\/em><\/strong>\u00a0.\u00a0A opa\u010dne spracuje odpove\u010f.<\/span><\/p>\n
    Pozn .:<\/span><\/em><\/strong>\u00a0Aby fungoval DHCP Relay Agent, tak samozrejme mus\u00ed be\u017ea\u0165 DHCP server, ten je defaultne zapnut\u00fd.<\/span><\/p>\n
    Tak\u017ee\u00a0<\/span>Relay Agent<\/span><\/em><\/strong>\u00a0n\u00e1m be\u017e\u00ed, ale aby za\u010dal skuto\u010dne fungova\u0165, tak mu mus\u00edme nastavi\u0165 adresu DHCP servera, ktor\u00e9mu m\u00e1 preposiela\u0165 po\u017eiadavky.\u00a0Tejto adrese sa na Cisco hovor\u00ed\u00a0<\/span>helper address<\/span><\/em><\/strong>\u00a0.\u00a0A preto\u017ee m\u00f4\u017eeme ma\u0165 nieko\u013eko DHCP serverov alebo pre niektor\u00e9 subnetmi prev\u00e1dzkova\u0165 server na switchi, tak t\u00fato adresu nenastavuje glob\u00e1lne, ale pre interface, \u010do je naj\u010dastej\u0161ie\u00a0<\/span>VLAN<\/span><\/strong>\u00a0.\u00a0D\u00f4le\u017eit\u00fdm po\u017eiadavkou je, aby tento\u00a0<\/span>interface<\/span><\/em><\/strong>\u00a0(VLAN) mal nastaven\u00fa\u00a0<\/span>IP adresu<\/span><\/em><\/strong>\u00a0.<\/span><\/p>\n
    SWITCH (config-if) # ip helper-address 192.168.10.10 <\/strong>\/\/ adresa servera, ktor\u00e9mu sa bud\u00fa preposiela\u0165 DHCP ot\u00e1zky alebo sie\u0165ov\u00e1 adresa<\/span><\/pre>\n
    Helper address<\/span><\/strong><\/em>\u00a0sl\u00fa\u017ei k preposielanie<\/span>\u00a0UDP Broadcast<\/span><\/strong><\/em>\u00a0, ktor\u00e9 s\u00fa prijat\u00e9 na interfacu.\u00a0M\u00f4\u017ee fungova\u0165 pre \u013eubovo\u013en\u00fd UDP port, defaultne pre<\/span>\u00a0BOOTP<\/span><\/strong>\u00a0(obsahuje DHCP 67, 68),<\/span>\u00a0DNS<\/span><\/strong>\u00a0(53),<\/span>\u00a0time service<\/span><\/strong>\u00a0(37),<\/span>\u00a0TFTP<\/span><\/strong>\u00a0(69),<\/span>\u00a0TACAS<\/span><\/strong>\u00a0(49),<\/span>\u00a0NetBIOS<\/span><\/strong>\u00a0(137, 138),<\/span>\u00a0IEN-116 name<\/span><\/strong>\u00a0(42).<\/span><\/p>\n
    DHCP Snooping<\/span><\/h3>\n
    DHCP Snooping<\/span><\/em><\/strong>\u00a0je s\u00fa\u010das\u0165ou nov\u0161\u00edch verzi\u00ed IOSu.\u00a0Ide o bezpe\u010dnostn\u00fa funkciu, ktor\u00e1 filtruje ned\u00f4veryhodn\u00e9 DHCP spr\u00e1vy.<\/span><\/p>\n
    My\u0161lienka je tak\u00e1, \u017ee po zapnut\u00ed s\u00fa v\u0161etky porty bran\u00e9 ako\u00a0<\/span>ned\u00f4veryhodn\u00e9<\/span><\/em><\/strong>\u00a0(untrusted) a my nastavujeme niektor\u00e9 ako\u00a0<\/span>d\u00f4veryhodn\u00e9<\/span><\/em><\/strong>\u00a0(trusted).\u00a0Ako d\u00f4veryhodn\u00fd mus\u00edme nastavi\u0165 port kam je pripojen\u00fd\u00a0<\/span>DHCP server<\/span><\/em><\/strong>\u00a0a potom porty, ktor\u00fdmi s\u00fa prepojen\u00e9\u00a0<\/span>switche<\/span><\/em><\/strong>\u00a0(Trunk).\u00a0Ak pr\u00edde napr\u00edklad pridelenie adresy (alebo ak\u00fdko\u013evek paket z DHCP servera) z ned\u00f4veryhodn\u00e9ho portu, tak je paket zahoden\u00fd.<\/span><\/p>\n
    Z\u00e1rove\u0148 sa m\u00f4\u017ee vytv\u00e1ra\u0165\u00a0<\/span>DHCP Snooping Binding Database<\/span><\/em><\/strong>\u00a0, ktor\u00e1 obsahuje inform\u00e1cie o v\u0161etk\u00fdch pridelen\u00fdch IP adres\u00e1ch spolu s MAC, VLAN, \u010dasom pren\u00e1jmu a inform\u00e1ciami o interfacu.\u00a0Ke\u010f potom pr\u00edde komunik\u00e1cie na ned\u00f4veryhodn\u00e9 interfacu, tak sa kontroluje oproti tejto datab\u00e1ze a v pr\u00edpade nes\u00fahlasu sa zahadzuje.<\/span><\/p>\n
    Najprv je potrebn\u00e9 zapn\u00fa\u0165 funkciu DHCP Snooping na switchi<\/span><\/p>\n
    SWITCH (config) # ip dhcp snooping<\/strong><\/span><\/pre>\n
    Potom \u0161pecifikujeme, na ktor\u00fdch VLAN\u00e1ch bude funkcia zapnut\u00e1<\/span><\/p>\n
    SWITCH (config) # ip dhcp snooping vlan 1 - 999 <\/strong>  \/\/ m\u00f4\u017eeme definova\u0165 jednu VLAN, zoznam oddelen\u00fd \u010diarkou alebo rozsah<\/span><\/pre>\n
    \u010ealej (sk\u00f4r asi sk\u00f4r, ne\u017e funkciu zapneme) potom mus\u00edme ur\u010di\u0165 d\u00f4veryhodn\u00e9 porty, to vykon\u00e1me priamo na danom porte.<\/span><\/p>\n
    SWITCH (config-if) # ip dhcp snooping trust<\/strong><\/span><\/pre>\n
    Ak by sme chceli vyu\u017ei\u0165\u00a0<\/span>DHCP Snooping Binding Database<\/span><\/em><\/strong>\u00a0, tak mus\u00edme t\u00fato funkciu zapn\u00fa\u0165 a ur\u010di\u0165, kde sa bude uklada\u0165.<\/span><\/p>\n
    SWITCH (config) # ip dhcp snooping database flash: \/dhcpbind.txt <\/strong> \/\/ ur\u010denie miesta ukladania DB, tu do s\u00faboru vo flash pam\u00e4ti, \u010falej m\u00f4\u017ee by\u0165 FTP, TFTP, web, RCP<\/span><\/pre>\n
    Aby sme n\u00e1sledne blokovali na portoch nepovolen\u00e9 IP (a pr\u00edpadne i MAC) adresy, tak vyu\u017eijeme funkciu\u00a0<\/span>IP Source Guard<\/span><\/em><\/strong>\u00a0, ktor\u00fd sa konfiguruje na switchovan\u00e9 port.<\/span><\/p>\n
    SWITCH (config-if) # ip verify source <\/strong>                \/\/ filtruje zdrojovej IP adresy \r\nSWITCH (config-if) # ip verify source port-security <\/strong>  \/\/ filtruje zdrojovej IP a MAC adresy<\/span><\/pre>\n
    Pozn .:<\/span><\/em><\/strong>\u00a0Pre konfigur\u00e1ciu DHCP snooping je e\u0161te cel\u00fd rad \u010fal\u0161\u00edch pr\u00edkazov.<\/span><\/p>\n
    zobrazenie inform\u00e1ci\u00ed<\/span><\/p>\n
    SWITCH # show ip dhcp snooping<\/strong> \r\nSWITCH # show ip verify source<\/strong><\/span><\/pre>\n","protected":false},"excerpt":{"rendered":"
    Konfigur\u00e1cia DHCP Serveru DHCP server, teda dynamick\u00e9 pride\u013eovanie adries, je slu\u017eba, ktor\u00e1 je s\u00fa\u010das\u0165ou v\u00e4\u010d\u0161iny dne\u0161n\u00fdch Catalyst switchov (alebo lep\u0161ie povedan\u00e9 dne\u0161n\u00fdch verzi\u00ed IOSu) a…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":431,"menu_order":2,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/pages\/510"}],"collection":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/comments?post=510"}],"version-history":[{"count":1,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/pages\/510\/revisions"}],"predecessor-version":[{"id":511,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/pages\/510\/revisions\/511"}],"up":[{"embeddable":true,"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/pages\/431"}],"wp:attachment":[{"href":"http:\/\/tech.sosthe.sk\/index.php\/wp-json\/wp\/v2\/media?parent=510"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}