Pruebas de DHCP relay
con varias subredes en la misma VLAN
Fecha: 2 de marzo del 2020
Escenario
Este laboratorio se realiza a partir de un problema con DHCP en una red que tiene
dos segmentos de red en la misma VLAN (esto es por una migración aún sin finalizar)
y que plantea el cómo se obtienen rangos de DHCP diferentes estando en un mismo
segmento de broadcast. El relay DHCP se asocia a una interface y puntualmente a
la IP “real” de la interface, las direcciones IP secundarias no aplican como relay DHCP
y por lo tanto no es posible discriminar entre un pool y otro.
1.- Prueba inicial:
C:\>ipconfig /renew
Configuración IP de Windows
Adaptador de Ethernet Conexión de área local:
Sufijo DNS específico para la conexión. . :
Dirección IPv4. . . . . . . . . . . . . . .
. . . . . . . . : 192.168.64.100
Máscara de subred . . . . . . . . . . . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada . . . . . : 192.168.64.1
C:\>
2.- Verificación:
DHCP-Server#sh ip dhcp bind
Bindings from all pools not associated with
VRF:
IP address Client-ID/ Lease expiration Type
Hardware
address/
User name
192.168.64.100 0100.1b38.7ef1.71 Mar 02 2002 01:11 AM Automatic
DHCP-Server#
3.- Liberamos la dirección y renovamos:
Con esto nos aseguramos de realizar si o si un discover DHCP mediante un broadcast.
C:\>ipconfig
/release
Configuración IP de Windows
Error al liberar la interfaz Conexión de área local : Todavía no se ha asociado
una dirección con el extremo de red.
C:\>ipconfig
/renew
Configuración IP de Windows
Adaptador de Ethernet Conexión de área local:
Sufijo DNS específico para la conexión. . :
Dirección IPv4. . . . . . . . . . . . . . . . . . . . . . . : 192.168.64.100 (nos da una dirección 64.x)
Máscara de subred . . . . . . . . . . . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada . . . . . : 192.168.64.1
C:\>
4.- Creamos una reserva de DHCP para esa MAC:
DHCP-Server(config)#ip dhcp pool 0100.1b38.7ef1.71
DHCP-Server(dhcp-config)#hardware-address
0100.1b38.7ef1.71
DHCP-Server(dhcp-config)#host
192.168.65.100
DHCP-Server(dhcp-config)#default-router
192.168.65.1
DHCP-Server(dhcp-config)#end
DHCP-Server#
5.- Verificamos:
DHCP-Server#sh ip dhcp bind
Bindings from all pools not associated with
VRF:
IP address Client-ID/ Lease expiration Type
Hardware address/
User name
192.168.64.100 0100.1b38.7ef1.71 Mar 02 2002 01:19 AM Automatic
192.168.65.100 0100.1b38.7ef1.71 Infinite Manual
DHCP-Server#
6.- Activamos el debug para analizar el
comportamiento del relay:
DHCP-Server#debug ip dhcp server packet
6.1.- Se libera nuevamente con /release:
DHCP-Server#
*Mar 2 01:24:14.535: DHCPD: DHCPRELEASE message
received from client 0100.1b38.7ef1.71 (192.168.64.100).
*Mar 2 01:24:14.535: DHCPD: returned 192.168.64.100 to address pool
RED_64.
DHCP-Server#
6.2.- Solicitamos IP para monitorear con Debug:
*Mar 2 01:24:20.891: DHCPD: DHCPDISCOVER
received from client 0100.1b38.7ef1.71 through relay 192.168.64.1.
*Mar 2 01:24:22.895: DHCPD: assigned IP
address 192.168.64.100 to client 0100.1b38.7ef1.71.
*Mar 2 01:24:22.895: DHCPD: Sending
DHCPOFFER to client 0100.1b38.7ef1.71 (192.168.64.100).
*Mar 2 01:24:22.895: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.64.1.
*Mar 2 01:24:22.899: DHCPD: DHCPREQUEST
received from client 0100.1b38.7ef1.71.
*Mar 2 01:24:22.899: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.64.100).
*Mar 2 01:24:22.899: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.64.1.
*Mar 2 01:24:26.219: DHCPD: DHCPINFORM
received from client 0100.1b38.7ef1.71 (192.168.64.100).
*Mar 2 01:24:26.219: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.64.100).
*Mar 2 01:24:26.219: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.64.1.
DHCP-Server#
7.- Modificamos la IP principal de la interface como contraprueba:
Cisco1841#conf
t
Enter configuration commands, one per
line. End with CNTL/Z.
Cisco1841(config)#interface FastEthernet0/0
Cisco1841(config-if)#no ip address 192.168.65.1 255.255.255.0
secondary
Cisco1841(config-if)#ip address 192.168.65.1 255.255.255.0 (reemplaza la IP principal)
Cisco1841(config-if)#end
Cisco1841#
7.1.- Liberamos la dirección y renovamos:
*Mar 2 02:20:21.787: DHCPD: DHCPRELEASE message received from
client 0100.1b38.7ef1.71 (192.168.64.100).
*Mar 2 02:20:21.791: DHCPD: returned
192.168.64.100 to address pool RED_64.
*Mar 2 02:20:27.299: DHCPD: DHCPDISCOVER received from client
0100.1b38.7ef1.71 through relay 192.168.65.1.
*Mar 2 02:20:27.299: DHCPD: Sending
DHCPOFFER to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 02:20:27.299: DHCPD: unicasting BOOTREPLY
for client 001b.387e.f171 to relay 192.168.65.1.
*Mar 2 02:20:27.303: DHCPD: DHCPREQUEST
received from client 0100.1b38.7ef1.71.
*Mar 2 02:20:27.303: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 02:20:27.303: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.65.1.
*Mar 2 02:20:30.799: DHCPD: DHCPINFORM
received from client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 02:20:30.799: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 02:20:30.799: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.65.1.
DHCP-Server#
7.2.- Verificación:
C:\>ipconfig
Configuración IP de Windows
Adaptador de Ethernet Conexión de área local:
Sufijo DNS específico para la conexión. . :
Dirección IPv4. . . . . . . . . . . . . . .
. . . . . . . . : 192.168.65.100
Máscara de subred . . . . . . . . . . . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada . . . . . : 192.168.65.1
C:\>
8.- Volvemos a la configuración inicial:
Cisco1841(config-if)#ip address 192.168.64.1 255.255.255.0
Cisco1841(config-if)#ip address 192.168.65.1 255.255.255.0 secondary
Cisco1841(config-if)#
8.1.- Hacemos un /renew con la IP del pool
65:
Esto genera un unicast de extremo a extremo, por lo tanto no utiliza relay.
DHCP-Server#
*Mar 2 02:27:12.279: DHCPD: DHCPREQUEST
received from client 0100.1b38.7ef1.71.
*Mar 2 02:27:12.279: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 02:27:12.279: DHCPD: unicasting
BOOTREPLY to client 001b.387e.f171 (192.168.65.100).
DHCP-Server#
9.- Implementamos smart relay:
Cisco1841(config)#ip dhcp smart-relay
Cisco1841(config)#
9.1.- Eliminamos el pool de la red 64:
DHCP-Server#conf t
Enter configuration commands, one per
line. End with CNTL/Z.
DHCP-Server(config)#no ip dhcp pool RED_64
DHCP-Server(config)#end
DHCP-Server#
*Mar 2 03:14:19.655: DHCPD: deleting
address pool RED_64.
*Mar 2 03:14:19.655: DHCPD: deleting option
3, instance 0
*Mar 2 03:14:19.655: DHCPD: Remove subnet
[192.168.64.1,192.168.64.254] from pool RED_64
DHCP-Server#
9.2.-
Hacemos un /release /renew:
DHCP-Server#
*Mar 2 03:15:44.999: DHCPD: DHCPRELEASE
message received from client 0100.1b38.7ef1.71 (192.168.65.100).
DHCP-Server#
9.3.- Verificamos en el server:
DHCP-Server#
*Mar 2 03:19:48.395: DHCPD: DHCPDISCOVER
received from client 0100.1b38.7ef1.71 through relay 192.168.64.1.
*Mar 2 03:19:48.395: DHCPD: there is no
address pool for 192.168.64.1.
*Mar 2 03:19:52.207: DHCPD: DHCPDISCOVER
received from client 0100.1b38.7ef1.71 through relay 192.168.64.1.
*Mar 2 03:19:52.207: DHCPD: there is no
address pool for 192.168.64.1.
*Mar 2 03:19:59.087: DHCPD: DHCPDISCOVER
received from client 0100.1b38.7ef1.71 through relay 192.168.64.1.
*Mar 2 03:19:59.087: DHCPD: there is no
address pool for 192.168.64.1.
*Mar 2 03:20:16.479: DHCPD: DHCPDISCOVER
received from client 0100.1b38.7ef1.71 through relay 192.168.65.1.
*Mar 2 03:20:16.479: DHCPD: Sending
DHCPOFFER to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 03:20:16.479: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.65.1.
*Mar 2 03:20:16.487: DHCPD: DHCPREQUEST
received from client 0100.1b38.7ef1.71.
*Mar 2 03:20:16.487: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 03:20:16.487: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.65.1.
*Mar 2 03:20:19.891: DHCPD: DHCPINFORM
received from client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 03:20:19.891: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 03:20:19.891: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.65.1.
*Mar 2 03:21:06.547: DHCPD: checking for
expired leases.
*Mar 2 03:21:35.011: DHCPD: DHCPINFORM
received from client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 03:21:35.011: DHCPD: Sending DHCPACK
to client 0100.1b38.7ef1.71 (192.168.65.100).
*Mar 2 03:21:35.015: DHCPD: unicasting
BOOTREPLY for client 001b.387e.f171 to relay 192.168.65.1.
*Mar 2 03:23:06.547: DHCPD: checking for
expired leases.
*Mar 2 03:25:06.547: DHCPD: checking for
expired leases.
DHCP-Server#
9.4.- Verificamos en el relay:
Cisco1841#debug
ip dhcp server packet
Cisco1841#
*Mar 2 15:05:38.419: DHCPD: relay binding
created for client 0100.1b38.7ef1.71.
*Mar 2 15:05:38.419: DHCPD: setting giaddr to 192.168.64.1.
*Mar 2 15:05:38.419: DHCPD: BOOTREQUEST
from 0100.1b38.7ef1.71 forwarded to 192.168.1.2.
*Mar 2 15:05:41.147: DHCPD: setting giaddr to 192.168.64.1.
*Mar 2 15:05:41.147: DHCPD: BOOTREQUEST
from 0100.1b38.7ef1.71 forwarded to 192.168.1.2.
*Mar 2 15:05:49.555: DHCPD: setting giaddr to 192.168.64.1.
*Mar 2 15:05:49.555: DHCPD: BOOTREQUEST
from 0100.1b38.7ef1.71 forwarded to 192.168.1.2.
*Mar 2 15:06:04.083: DHCPD: excessive
retransmissions from client 0100.1b38.7ef1.71.
*Mar 2 15:06:04.083: DHCPD: switching to
relay address 192.168.65.1.
*Mar 2 15:06:04.083: DHCPD: setting giaddr to
192.168.65.1.
*Mar 2 15:06:04.083: DHCPD: BOOTREQUEST
from 0100.1b38.7ef1.71 forwarded to 192.168.1.2.
*Mar 2 15:06:04.087: DHCPD: forwarding
BOOTREPLY to client 001b.387e.f171.
*Mar 2 15:06:04.087: DHCPD: broadcasting
BOOTREPLY to client 001b.387e.f171.
*Mar 2 15:06:04.087: DHCPD: Finding a relay
for client 0100.1b38.7ef1.71 on interface FastEthernet0/0.
*Mar 2 15:06:04.087: DHCPD: setting giaddr to 192.168.65.1.
*Mar 2 15:06:04.087: DHCPD: BOOTREQUEST
from 0100.1b38.7ef1.71 forwarded to 192.168.1.2.
*Mar 2 15:06:04.091: DHCPD: forwarding BOOTREPLY
to client 001b.387e.f171.
*Mar 2 15:06:04.091: DHCPD: broadcasting
BOOTREPLY to client 001b.387e.f171.
*Mar 2 15:06:04.091: DHCPD: removed relay
binding for 001b.387e.f171
*Mar 2 15:06:07.239: DHCPD: Finding a relay
for client 0100.1b38.7ef1.71 on interface FastEthernet0/0.
*Mar 2 15:06:07.239: DHCPD: setting giaddr to 192.168.65.1.
*Mar 2 15:06:07.239: DHCPD: BOOTREQUEST
from 0100.1b38.7ef1.71 forwarded to 192.168.1.2.
*Mar 2 15:06:07.243: DHCPD: forwarding
BOOTREPLY to client 001b.387e.f171.
*Mar 2 15:06:07.243: DHCPD: broadcasting
BOOTREPLY to client 001b.387e.f171.
Cisco1841#
9.5.- Verificamos en el cliente:
C:\>ipconfig
Configuración IP de Windows
Adaptador de Ethernet Conexión de área local:
Sufijo DNS específico para la conexión. . :
Dirección IPv4. . . . . . . .
. . . . . . . . . . . . . . . : 192.168.65.100
Máscara de subred . . . . . . . . . . . . . . . . . . : 255.255.255.0
Puerta de enlace predeterminada . . . . . : 192.168.65.1
C:\>
Podemos ver que la comunicación entre el DHCP relay y la PC siempre es a través de
la dirección de broadcast. Cada sistema operativo tiene su implementación particular.
Puede apreciarse que dentro del mismo segmento de capa 2, los mesajes los envía el
router con la dirección 192.168.64.1 y flags del relay 192.168.65.1 (el mismo equipo).
10.-
Función del commando smart-relay:
You only need to configure helper addresses on
the interface where the UDP broadcasts that you want to forward
to the DHCP server are being received, and you
only need the ip dhcp
smart-relay command configured if you have
secondary addresses on that interface and you
want the router to step through each IP network when forwarding
DHCP requests. Without the smart relay agent
configured, all requests are forwarded using the primary IP address
on the interface.
If the ip dhcp smart-relay command is configured, the relay agent
counts the number of times the client retries
sending a request to the DHCP server when
there is no DHCPOFFER message from the DHCP server. After three
retries, the relay agent sets the gateway
address to the secondary address. If the DHCP server still does not
respond after three more retries, then the
next secondary address is used as the gateway address.
This functionality is useful when the DHCP
server cannot be configured to use secondary pools.
Fuente:
https://www.cisco.com/en/US/docs/ios/12_4t/ip_addr/configuration/guide/htdhcpre.html#wp1089419
11.-
Corolario:
- Si es necesario tener varios rangos IP, se recomienda separar los segmentos de capa 3 asociados a diferentes
segmentos de capa 2 (VLANs) y utilizar diferentes gateways/relays.
- Se puede realizar una oferta de DHCP a un segundo segmento IP dentro de un mismo dominio de broadcast,
siempre y cuando el segmento principal no esté habilitado.
- La IP primaria de la interface es la que ejecuta el relay DHCP, la IP secundaria actúa solamente de gateway de
la red/subred, y sólo el Smart-relay la utiliza si no hay ofertas (OFFER) utilizando la IP primaria como relay.
- Esto podría funcionar también si en lugar de dos redes /24 tendríamos una única /23, un único gateway y dos
pools con reservas de direcciones, pero no es el caso del presente estudio.
(2020) Helping
to lonely packets
Rosario, Argentina