Ujeedada maqaalkani waa in la fududeeyo qaabaynta adeega DHCP ee VXLAN BGP EVPN iyo dharka DFA iyadoo la isticmaalayo Microsoft Windows Server 2016/2019.
Dukumentiga rasmiga ah, adeegga DHCP ee ku salaysan Microsoft Windows Server 2012 ee dharka ayaa loo qaabeeyey sidii SuperScope oo ka kooban barkad Loopback ah (muhiimadda barkadani waa ka saarida dhammaan ciwaannada IP-ga barkada barkada (laga saaray ciwaanka IP = barkad)) iyo barkado loogu talagalay soo saarista ciwaannada IP ee shabakadaha dhabta ah (halkan waa iftiiminta - siyaasada ayaa la habeeyay - kaas oo DHCP Relay Circuit ID lagu sifeeyay iyo aqoonsiga wareega gudbinta DHCP wuxuu ka kooban yahay VNI ee shabakada, ie. barkad kale Gudbinta DHCP Aqoonsiga wareeggu wax yar ayuu ka duwanaan doonaa).
To configure DHCP on Windows server.
1. Create a super scope. Within the super scope, create scope B, S1, S2, S3, β¦, Sn for the subnet B and the subnets for each segment.
2. In scope B, specify the 'Exclusion Range' to be the entire address range (so that the offered address range must not be from this scope).
3. For every segment scope Si, specify a policy that matches on Agent Circuit ID with value of '0108000600XXXXXX', where '0108000600' is a fixed value for all segments, the 6 numbers "XXXXXX" is the segment ID value in hexadecimal. Also ensure to check the Append wildcard(*) check box.
4. Set the policy address range to the entire range of the scope.Maqaalkani waxa uu ka kooban yahay jawaabaha su'aalaha soo socda:
Tusmo
-
- ( & )
-
-
Horudhac
Qaybtani waxay si kooban u taxay dhammaan xogta bilawga ah: Tilmaamaha habaynta qalabka shabakada, RFC-yada loo isticmaalo baakadaha DHCP ee warshadaha eVPN, kobcinta goobaha server-ka DHCP ee Microsoft Windows Server 2012 ee dukumentiga Cisco ayaa la bixiyaa si loo tixraaco. Iyo sidoo kale macluumaad kooban oo ku saabsan Superscope-ka iyo Siyaasada ee adeega DHCP ee Microsoft Windows Servers.
Sida loo habeeyo Gudbinta DHCP ee VXLAN BGP EVPN, dharka DFA
Ku habeynta Gudbinta DHCP ee dharka VXLAN BGP EVPN maaha mawduuca ugu muhiimsan ee maqaalkan, maadaama ay aad u fudud tahay. Waxaan bixiyaa xiriirinta dukumeentiyada iyo kharribayaasha goobaha qalabka shabakada.
Tusaalaha dejinta DHCP Relay ee Nexus 9000V v9.2(3)
service dhcp
ip dhcp relay
ip dhcp relay information option
ip dhcp relay information option vpn
interface loopback10
vrf member VRF1
ip address 10.120.0.1/32 tag 1234567
interface Vlan12
no shutdown
vrf member VRF1
no ip redirects
ip address 10.120.251.1/24 tag 1234567
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.0.0.5
ip dhcp relay source-interface loopback10
RFC-yada lagu fuliyo hawlgalka adeegga Gudbinta DHCP ee VXLAN BGP EVPN
RFC#6607: Xulasho-hoosaadka 151(0x97) - Xulashada Subnetka Virtual
β’ Sub-option 151(0x97) - Virtual Subnet Selection (Defined in RFC#6607)
Used to convey VRF related information to the DHCP server in an MPLS-VPN and VXLAN EVPN multi-tenant environment."Magaca" VRF ee uu macmiilku ku jiro waa la kala qaadaa.
RFC # 5107:-hoosaadka 11(0xb) - Ka-hortagga aqoonsiga server-ka
β’ Sub-option 11(0xb) - Server ID Override (Defined in RFC#5107.)
The server identifier (server ID) override sub-option allows the DHCP relay agent to specify a new value for the server ID option, which is inserted by the DHCP server in the reply packet. This sub-option allows the DHCP relay agent to act as the actual DHCP server such that the renew requests will come to the relay agent rather than the DHCP server directly. The server ID override sub-option contains the incoming interface IP address, which is the IP address on the relay agent that is accessible from the client. Using this information, the DHCP client sends all renew and release request packets to the relay agent. The relay agent adds all of the appropriate sub-options and then forwards the renew and release request packets to the original DHCP server. For this function, Ciscoβs proprietary implementation is sub-option 152(0x98). You can use the ip dhcp relay sub-option type cisco command to manage the function.Xulashada waxaa loo isticmaalaa in lagu hubiyo in macmiilku u soo diro codsi lagu cusboonaysiinayo heshiiska kirada ciwaanka IP-ga ee doorashadan lagu isticmaalo. (Cisco VXLAN BGP, EVPN waa albaabka laga galo macmiilka ee Anycast.)
RFC # 3527: Xulashada-hoosaadka 5 (0x5) - Xulashada isku xirka
Sub-option 5(0x5) - Link Selection (Defined in RFC#3527.)
The link selection sub-option provides a mechanism to separate the subnet/link on which the DHCP client resides from the gateway address (giaddr), which can be used to communicate with the relay agent by the DHCP server. The relay agent will set the sub-option to the correct subscriber subnet and the DHCP server will use that value to assign an IP address rather than the giaddr value. The relay agent will set the giaddr to its own IP address so that DHCP messages are able to be forwarded over the network. For this function, Ciscoβs proprietary implementation is sub-option 150(0x96). You can use the ip dhcp relay sub-option type ciscocommand to manage the function.Ciwaanka shabakada uu macmiilku uga baahan yahay ciwaanka IP-ga
Horumarka dukumeenti Cisco ee ku saabsan habaynta DHCP ee Microsoft Windows Server 2012
Waxaan ku daray qaybtan sababtoo ah waxaa jira isbeddel wanaagsan oo dhinaca iibiyaha ah:
Dukumeentigu wuxuu muujinayaa kaliya sida loo habeeyo Gudbinta DHCP ee qalabka shabakada.
Maqaal kale ayaa loo isticmaalay in lagu habeeyo DHCP Windows Server 2012:
Maqaalkani waxa uu tilmaamayaa in shabakad kasta/VNI ay u baahan tahay xidhmo SuperScope u gaar ah iyo ciwaanka Loopback u gaar ah:
If multiple DHCP Scopes are required for multiple subnets, you need to create one LoopbackX per subnet/vlan on all LEAFS and create a superscope with a loopbackX range scope and actual client IP subnet scope per vlan.
Ku darista Windows 2012 Dejinta serverka dukumeentiyada dejinta qalabka shabakada Dhammaan barkadaha ciwaanka ee la isticmaalo, hal SuperScope xarun xogeed ayaa looga baahan yahay SuperScope-kan ayaa ah xadka xarunta xogta:
Create Superscope for all scopes you want to use for Option 82-based policies.
Note
The Superscope should combine all scopes and act as the administrative boundary.
Wax walba si kooban ayaa loo sharaxay:
Let us assume the switch is using the address from subnet B (it can be the backbone subnet, management subnet, or any customer designated subnet for this purpose) to communicate with the Windows DHCP server. In DFA we have subnets S1, S2, S3, β¦, Sn for segment s1, s2, s3, β¦, sn.
To configure DHCP on Windows server.
1. Create a super scope. Within the super scope, create scope B, S1, S2, S3, β¦, Sn for the subnet B and the subnets for each segment.
2. In scope B, specify the 'Exclusion Range' to be the entire address range (so that the offered address range must not be from this scope).
3. For every segment scope Si, specify a policy that matches on Agent Circuit ID with value of '0108000600XXXXXX', where '0108000600' is a fixed value for all segments, the 6 numbers "XXXXXX" is the segment ID value in hexadecimal. Also ensure to check the Append wildcard(*) check box.
4. Set the policy address range to the entire range of the scope.
DHCP gudaha Microsoft Windows Server (Superscope & Policy)
Superscope is an administrative feature of a DHCP server that can be used to group multiple scopes as a single administrative entity. Superscope allows a DHCP server to provide leases from more than one scope to clients on a single physical network. Scopes added to a superscope are called member scopes.
Waa maxay SuperScope - waa hawlqabad kuu oggolaanaysa inaad ku darto dhowr barkadood oo cinwaannada IP ah hal unug maamul. Si aad ugu xayeysiiso isticmaalayaasha isla shabakad muuqaal ah (ku jira isla VLAN) cinwaannada IP ee barkadaha badan. Haddii codsigu ku yimid goob ciwaanno ah oo qayb ka ah SuperScope, markaas macmiilka waxa la siin karaa ciwaan ka socda Baaxadda kale ee ku jirta SuperScope-kan.
The DHCP Server role in Windows Server 2012 introduces a new feature that allows you to create IPv4 policies that specify custom IP address and option assignments for DHCP clients based on a set of conditions.
The policy based assignment (PBA) feature allows you to group DHCP clients by specific attributes based on fields contained in the DHCP client request packet. PBA enables targeted administration and greater control of the configuration parameters delivered to network devices with DHCP.
Xeerarka - waxay kuu oggolaanayaan inaad ku meelayso isticmaaleyaasha cinwaannada IP-yada iyadoo ku xiran nooca isticmaale ama cabbirka. Injineerada Cisco waxay isticmaalaan siyaasadaha Windows Server 2012 si ay u shaandheeyaan VNI ( Aqoonsiga Shabakadda Virtual ).
Qaybta ugu muhiimsan
Qaybtan waxay ka kooban tahay natiijada cilmi-baarista, sababta loo taageeri waayay, sida ay u shaqeyso (macquul), maxaa cusub iyo sida tan cusubi ay noo caawin doonto.
Waa maxay sababta Microsoft Windows Server 2000/2003/2008 aan loo taageerin?
Microsoft Windows Server 2008 iyo noocyadii hore ma baaraan doorashada 82 oo xirmada soo celinta waxaa la diraa iyada oo aan la dooran 82.
- Codsiga macmiilka waxa loo diraa Broadcast (DHCP Discover).
- Qalabku (Nexus) wuxuu u soo diraa xidhmada serverka DHCP (DHCP Discover + Option 82).
- Adeegga DHCP waxa uu helayaa xidhmada, farsameeyaa, soo celiyaa, laakiin la'aanteed 82. (DHCP Offer β without option 82)
- Qalabku (Nexus) wuxuu ka helayaa baakidh server-ka DHCP. (Dhibaatooyinka DHCP) Laakin uma soo dirto xirmadan isticmaalaha ugu dambeeya.
Xogta Sniffer - ee ku jirta Windows Server 2008 iyo macmiilka DHCPWindows Server 2008 waxa uu codsi ka helaa qalabka shabakada (Doorashada 82 ayaa ku jirta liiska)
Windows Server 2008 waxay jawaabta u dirtaa qalabka shabakada (Doorashada 82 kuma jirto liiska ikhtiyaarka xirmada)
Codsiga macmiilka - DHCP Discover waa joogaa, Bixinta DHCPna waa maqan tahay
Tirakoobka qalabka shabakada:
NEXUS-9000V-SW-1# show ip dhcp relay statistics
----------------------------------------------------------------------
Message Type Rx Tx Drops
----------------------------------------------------------------------
Discover 8 8 0
Offer 8 8 0
Request(*) 0 0 0
Ack 0 0 0
Release(*) 0 0 0
Decline 0 0 0
Inform(*) 0 0 0
Nack 0 0 0
----------------------------------------------------------------------
Total 16 16 0
----------------------------------------------------------------------
DHCP L3 FWD:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
Non DHCP:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
DROP:
DHCP Relay not enabled : 0
Invalid DHCP message type : 0
Interface error : 0
Tx failure towards server : 0
Tx failure towards client : 0
Unknown output interface : 0
Unknown vrf or interface for server : 0
Max hops exceeded : 0
Option 82 validation failed : 0
Packet Malformed : 0
Relay Trusted port not configured : 0
DHCP Request dropped on MCT : 0
* - These counters will show correct value when switch
receives DHCP request packet with destination ip as broadcast
address. If request is unicast it will be HW switched
NEXUS-9000V-SW-1#
Waa maxay sababta qaabayntu aad ugu adag tahay Microsoft Windows Server 2012?
Microsoft Windows Server 2012 weli ma taageero RFC#3527 (Doorashada 82-hoosaadka 5(0x5) - Xulashada Link)
Laakiin ku shaqaynta Siyaasadda mar hore ayaa la hirgeliyay.
Sida ay u shaqeyneyso:
- Microsoft Windows Server 2012 waxa ay leedahay barkad weyn (SuperScope) kaas oo leh cinwaano Loopback ah iyo barkadaha shabakadaha dhabta ah.
- Xulashada barkada soo saarista ciwaanka IP-ga waxay ku dhacdaa SuperScope, maadaama jawaabtu ka timid DHCP Relay oo ciwaanka Loopback ku jiro SuperScope.
- Isticmaalka Siyaasadda, codsigu wuxuu ka dooranayaa Superscope-kaas xubinta ah oo VNI ay ku jirto Xulashada 82 Soo-jeedinta 1 Aqoonsiga Wareegga Wakiilka. ("0108000600"+ 24-bits VNI + 24-bits kuwaas oo qiyamkooda aan la garaneyn aniga, laakiin sniffer wuxuu muujinayaa qiyamka 0 ee goobtan.)
Sidee habaynta loogu fududeeyay Microsoft Windows Server 2016/2019?
Microsoft Windows Server 2016 waxa ay fulisaa shaqada RFC#3527 Taasi waa, Windows Server 2016 waxay aqoonsan kartaa shabakadda saxda ah ee Xulashada 82-hoosaadka 5 (0x5) - Xulashada sifo
Saddex su'aalood ayaa isla markiiba soo baxay:
- Ma samayn karnaa la'aanteed Superscope?
- Ma samayn karnaa siyaasad la'aan oo ma u beddeli karnaa VNI foomka hexadecimal?
- Ma samayn karnaa la'aanteed Baaxadda Dib-u-celinta DHCP ciwaannada Isha?
Q. Ma samayn karnaa la'aanteed Superscope?
A. Haa, baaxadda waxaa isla markiiba laga abuuri karaa aagga cinwaannada IPv4.
Q. Ma samayn karnaa siyaasad la'aan oo ma u beddeli karnaa VNI foomka hexadecimal?
A. Haa, xulashada shabakadu waxay ku salaysan tahay Xulashada 82 Suboption 0x5,
Q. Ma samayn karnaa la'aanteed Baaxadda Dib-u-celinta DHCP ciwaannada Isha?
A. Maya ma awoodno. Sababtoo ah Microsoft Windows Server 2016/2019 ayaa ka ilaalinaya codsiyada DHCP ee xaasidnimada leh. Taasi waa, dhammaan codsiyada cinwaannada aan ku jirin barkadda server-ka DHCP waxaa loo tixgeliyaa xaasidnimo.
Note
All relay agent IP addresses (GIADDR) must be part of an active DHCP scope IP address range. Any GIADDR outside of the DHCP scope IP address ranges is considered a rogue relay and Windows DHCP Server will not acknowledge DHCP client requests from those relay agents.
A special scope can be created to "authorize" relay agents. Create a scope with the GIADDR (or multiple if the GIADDR's are sequential IP addresses), exclude the GIADDR address(es) from distribution, and then activate the scope. This will authorize the relay agents while preventing the GIADDR addresses from being assigned.Kuwaas. Si loo habeeyo barkadda DHCP ee warshadda VXLAN BGP EVPN ee Microsoft Windows Server 2016/2019, waxaad u baahan tahay oo kaliya:
- U samee barkad loogu talagalay ciwaannada Source Relay.
- U samee barkad shabakadaha macmiilka
Waxa aan loo baahnayn (laakiin waa la habayn karaa oo wuu shaqayn doonaa mana faragelin doono shaqada):
- Siyaasad abuur
- Samee SuperScope
Tusaale:Tusaalaha dejinta server-ka DHCP (waxaa jira 2 macmiil oo DHCP ah - macaamiishu waxay ku xidhan yihiin dharka VXLAN)
Tusaalaha dejinta barkada isticmaalaha:
Tusaale ahaan dejinta barkada isticmaalaha (siyaasadaha ayaa la doortay - si loo caddeeyo in siyaasadaha aan loo isticmaalin hawlgalka saxda ah ee barkadda):
Tusaalaha u habaynta barkada ciwaanada DHCP ee Isha (inta badan ee ciwaanada soo saarista waxay si buuxda ugu dhigmaan ka saarida barkada ciwaanka):
Dejinta adeegga DHCP ee Microsoft Windows Server 2019
U habeynta barkad ciwaannada Loopback ( isha) ee DHCP Relay.
Waxaan ka abuurnaa barkad cusub (Scope) booska IPV4.
saaxir abuurka barkadaha. " Xiga >"
Habee magaca barkadda iyo sharraxaadda barkadda.
U deji tirada ciwaanka IP-ga ee Loopback iyo maaskaro barkada.
Ku darida waxyaabaha ka reeban. Kalasaarku waa inuu si sax ah u dhigmaa tirada barkadda.
Waqtiga kirada " Xiga >"
Weydiinta: Miyaad hadda dejinaysaa ikhtiyaarrada DHCP (DNS, WINS, Gateway, Domain) mise mar dambe ayaad samayn doontaa. Way dhakhso badan tahay in maya laga jawaabo, ka dibna gacanta ku dhaqaaji barkadda. Ama u gudub dhamaadka adiga oo aan buuxin wax macluumaad ah oo dhaqaaji barkada dhamaadka saaxirka.
Waxaan xaqiijineynaa in xulashooyinka aan la habeynin oo barkadda aan la kicin. "Dhamays"
Waxaan ku hawlgelinaa barkadda gacanta. - Dooro Baaxadda iyo menu-ka macnaha guud - dooro "Dhaqdhaqaaq".
Waxaan u abuurnaa barkad isticmaalayaasha/serverrada.
Aan abuurno barkad cusub.
saaxir abuurka barkadaha. " Xiga >"
Habee magaca barkadda iyo sharraxaadda barkadda.
U deji tirada ciwaanka IP-ga ee Loopback iyo maaskaro barkada.
Ku darida waxyaabaha ka reeban. (Ma jirto wax ka reeban oo loo baahan yahay si caadi ah) " Xiga >"
Waqtiga kirada " Xiga >"
Weydiinta: Miyaad hadda dejinaysaa ikhtiyaarrada DHCP (DNS, WINS, Gateway, Domain) mise mar dambe ayaad samayn doontaa. Aynu hadda dhigno.
Habee ciwaanka albaabka caadiga ah.
Waxaan dejineynaa domain-ka iyo cinwaanada server-ka DNS.
Habaynta ciwaanada IP-ga ee adeegayaasha WINS
Dhaqdhaqaaqa baaxadda
Barkadda waa la habeeyey. "Dhamays"
gunaanad
Isticmaalka Windows Server 2016/2019 waxay yaraynaysaa kakanaanta dejinta server-ka DHCP ee dharka VXLAN (ama dhar kasta oo kale). (Ma aha lagama maarmaan in lagu wareejiyo xiriiriyeyaasha gaarka ah ee ku takhasusay IT: Shabakadda/Aqoonsiga Wareegga Wakiilka si loo diiwaan geliyo filtarrada.)
Qaabaynta Windows Server 2012 ma ku shaqayn doontaa adeegayaasha cusub ee 2016/2019 - haa way shaqayn doontaa.
Dukumeentigani wuxuu ka kooban yahay tixraacyo 2 nooc: 7.X iyo 9.3. Tani waxay sabab u tahay xaqiiqda ah in nooca 7.0 (3) I7 (7) uu yahay siidaynta Cisco soo jeedinta, iyo nooca 9.3 waa kan ugu hal-abuurka badan (xitaa taageeraya Multicast via VXLAN Multisite).
Liiska ilaha
Source: www.habr.com