Injongo yeli nqaku kukwenza lula uqwalaselo lwenkonzo yeDHCP yeVXLAN BGP EVPN kunye nelaphu leDFA usebenzisa iMicrosoft Windows Server 2016/2019.
Kumaxwebhu asemthethweni, inkonzo ye-DHCP esekelwe kwi-Microsoft Windows Server 2012 yelaphu iqwalaselwe njengeSuperScope equlethe i-Loopback pool (into ebalaseleyo kweli chibi kukungabandakanyi zonke iidilesi ze-IP zedama ukusuka echibini (ngaphandle kwedilesi ye-IP = pool)) kunye namachibi okukhutshwa kweedilesi ze-IP kuthungelwano lokwenene (nantsi eyona nto iphambili - umgaqo-nkqubo uqwalaselwe - apho i-DHCP Relay Circuit ID iyahluzwa kwaye le ID yeSekethe yokudlulisa i-DHCP iqulethe i-VNI yothungelwano, o.t. enye ichibi le-DHCP Relay Isazisi seSekethe siya kwahluka kancinci).
To configure DHCP on Windows server.
1. Create a super scope. Within the super scope, create scope B, S1, S2, S3, …, Sn for the subnet B and the subnets for each segment.
2. In scope B, specify the 'Exclusion Range' to be the entire address range (so that the offered address range must not be from this scope).
3. For every segment scope Si, specify a policy that matches on Agent Circuit ID with value of '0108000600XXXXXX', where '0108000600' is a fixed value for all segments, the 6 numbers "XXXXXX" is the segment ID value in hexadecimal. Also ensure to check the Append wildcard(*) check box.
4. Set the policy address range to the entire range of the scope.Eli nqaku lineempendulo zale mibuzo ilandelayo:
Iziqulatho
-
- ( & )
-
-
Intshayelelo
Le nxalenye idwelisa ngokufutshane yonke idatha yokuqala: Imiyalelo yokuqwalasela izixhobo zenethiwekhi, ii-RFC ezisetyenziswe kwiipakethi ze-DHCP kwiifektri ze-eVPN, ukuguquka kwezicwangciso zeseva ye-DHCP kwi-Microsoft Windows Server 2012 kumaxwebhu e-Cisco anikezelwe kwireferensi. Kunye nolwazi olufutshane malunga neSuperscope kunye nePolisi kwinkonzo yeDHCP kwiiSeva zikaMicrosoft Windows.
Indlela yokuqwalasela i-DHCP Relay kwi-VXLAN BGP EVPN, ilaphu le-DFA
Ukuqwalasela i-DHCP Relay kwilaphu le-VXLAN BGP EVPN ayisosihloko esiphambili seli nqaku, njengoko ilula kakhulu. Ndibonelela ngamakhonkco kumaxwebhu kunye nomphangi kwiisetingi kwizixhobo zenethiwekhi.
Umzekelo wokuseta i-DHCP Relay kwi-Nexus 9000V v9.2(3)
service dhcp
ip dhcp relay
ip dhcp relay information option
ip dhcp relay information option vpn
interface loopback10
vrf member VRF1
ip address 10.120.0.1/32 tag 1234567
interface Vlan12
no shutdown
vrf member VRF1
no ip redirects
ip address 10.120.251.1/24 tag 1234567
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.0.0.5
ip dhcp relay source-interface loopback10
Ii-RFC eziphunyezwe ekusebenzeni kwenkonzo ye-DHCP Relay kwi-VXLAN BGP EVPN amalaphu
RFC#6607: Sub-option 151(0x97) - Virtual Subnet Ukukhetha
• Sub-option 151(0x97) - Virtual Subnet Selection (Defined in RFC#6607)
Used to convey VRF related information to the DHCP server in an MPLS-VPN and VXLAN EVPN multi-tenant environment."Igama" leVRF apho umxhasi ahlala khona uthunyelwa.
RFC#5107: I-Sub-option 11(0xb) - UBhaliso lwe-ID yomncedisi
• Sub-option 11(0xb) - Server ID Override (Defined in RFC#5107.)
The server identifier (server ID) override sub-option allows the DHCP relay agent to specify a new value for the server ID option, which is inserted by the DHCP server in the reply packet. This sub-option allows the DHCP relay agent to act as the actual DHCP server such that the renew requests will come to the relay agent rather than the DHCP server directly. The server ID override sub-option contains the incoming interface IP address, which is the IP address on the relay agent that is accessible from the client. Using this information, the DHCP client sends all renew and release request packets to the relay agent. The relay agent adds all of the appropriate sub-options and then forwards the renew and release request packets to the original DHCP server. For this function, Cisco’s proprietary implementation is sub-option 152(0x98). You can use the ip dhcp relay sub-option type cisco command to manage the function.Inketho isetyenziselwa ukuqinisekisa ukuba umxhasi uthumela isicelo sokuvuselela idilesi yokuqeshisa kwidilesi ye-IP esetyenziswe kolu khetho. (Kwi-Cisco VXLAN BGP, i-EVPN lisango lomthengi elingagqibekanga idilesi ye-Anycast.)
RFC # 3527: I-Sub-option 5 (0x5) - Ukukhetha ikhonkco
Sub-option 5(0x5) - Link Selection (Defined in RFC#3527.)
The link selection sub-option provides a mechanism to separate the subnet/link on which the DHCP client resides from the gateway address (giaddr), which can be used to communicate with the relay agent by the DHCP server. The relay agent will set the sub-option to the correct subscriber subnet and the DHCP server will use that value to assign an IP address rather than the giaddr value. The relay agent will set the giaddr to its own IP address so that DHCP messages are able to be forwarded over the network. For this function, Cisco’s proprietary implementation is sub-option 150(0x96). You can use the ip dhcp relay sub-option type ciscocommand to manage the function.Idilesi yenethiwekhi apho umxhasi adinga idilesi ye-IP.
Ukuvela kwamaxwebhu eCisco malunga nokuqwalasela i-DHCP kwi-Microsoft Windows Server 2012
Ndifake eli candelo kuba kukho indlela elungileyo kwicala lomthengisi:
Amaxwebhu abonisa kuphela indlela yokuqwalasela i-DHCP Relay kwisixhobo sothungelwano.
Elinye inqaku lisetyenziselwe ukuqwalasela iDHCP kwiWindows Server 2012:
Eli nqaku libonisa ukuba inethiwekhi/VNI nganye ifuna eyakhe inqwaba yeSuperScope kunye neseti yayo yeedilesi zeLoopback:
If multiple DHCP Scopes are required for multiple subnets, you need to create one LoopbackX per subnet/vlan on all LEAFS and create a superscope with a loopbackX range scope and actual client IP subnet scope per vlan.
Yongeziwe Windows 2012 Useto lweseva kumaxwebhu okuseta izixhobo zenethiwekhi. Kuwo onke amachibi eedilesi asetyenzisiweyo, iSuperScope enye kwiziko ledatha iyafuneka kwaye le SuperScope ngumda weziko ledatha:
Create Superscope for all scopes you want to use for Option 82-based policies.
Note
The Superscope should combine all scopes and act as the administrative boundary.
Yonke into ichazwe ngokucacileyo:
Let us assume the switch is using the address from subnet B (it can be the backbone subnet, management subnet, or any customer designated subnet for this purpose) to communicate with the Windows DHCP server. In DFA we have subnets S1, S2, S3, …, Sn for segment s1, s2, s3, …, sn.
To configure DHCP on Windows server.
1. Create a super scope. Within the super scope, create scope B, S1, S2, S3, …, Sn for the subnet B and the subnets for each segment.
2. In scope B, specify the 'Exclusion Range' to be the entire address range (so that the offered address range must not be from this scope).
3. For every segment scope Si, specify a policy that matches on Agent Circuit ID with value of '0108000600XXXXXX', where '0108000600' is a fixed value for all segments, the 6 numbers "XXXXXX" is the segment ID value in hexadecimal. Also ensure to check the Append wildcard(*) check box.
4. Set the policy address range to the entire range of the scope.
I-DHCP kwi-Microsoft Windows Server (i-Superscope & nomgaqo-nkqubo)
Superscope is an administrative feature of a DHCP server that can be used to group multiple scopes as a single administrative entity. Superscope allows a DHCP server to provide leases from more than one scope to clients on a single physical network. Scopes added to a superscope are called member scopes.
Yintoni iSuperScope - lumsebenzi okuvumela ukuba udibanise iidikethi ezininzi zeedilesi ze-IP kwiyunithi enye yolawulo. Ukubhengeza kubasebenzisi kuthungelwano lwenyama efanayo (kwiVLAN efanayo) iidilesi ze-IP ezivela kumachibi amaninzi. Ukuba isicelo sifike kuluhlu lweedilesi njengenxalenye yeSuperScope, ngoko umxhasi unokunikwa idilesi esuka komnye uMda oqukwe kule SuperScope.
The DHCP Server role in Windows Server 2012 introduces a new feature that allows you to create IPv4 policies that specify custom IP address and option assignments for DHCP clients based on a set of conditions.
The policy based assignment (PBA) feature allows you to group DHCP clients by specific attributes based on fields contained in the DHCP client request packet. PBA enables targeted administration and greater control of the configuration parameters delivered to network devices with DHCP.
Imigaqo-nkqubo - ikuvumela ukuba unikeze iidilesi ze-IP kubasebenzisi ngokuxhomekeke kuhlobo lomsebenzisi okanye ipharamitha. Iinjineli zeCisco zisebenzisa imigaqo-nkqubo kwi-Windows Server 2012 ukuhluza nge-VNI (Isichongi seNethiwekhi ebonakalayo).
Inxalenye ephambili
Eli candelo liqulethe iziphumo zophando, kutheni lingaxhaswanga, lisebenza njani (ingqiqo), yintoni entsha kunye nendlela entsha eya kusinceda ngayo.
Kutheni iMicrosoft Windows Server 2000/2003/2008 ingaxhaswanga?
I-Microsoft Windows Server 2008 kunye neenguqulelo zangaphambili aziqhubeki kukhetho 82 kwaye ipakethi yokubuya ithunyelwa ngaphandle kwenketho 82.
- Isicelo somthengi sithunyelwa kuSasazo (DHCP Discover).
- Isixhobo (i-Nexus) ithumela ipakethe kwiseva ye-DHCP (DHCP Discover + Option 82).
- Iseva ye-DHCP ifumana ipakethi, iyenze, iyithumele kwakhona, kodwa ngaphandle kwenketho 82. (I-DHCP Unikezelo - ngaphandle kwenketho 82)
- Isixhobo (i-Nexus) ifumana ipakethi kwi-DHCP iseva. (Unikezelo lweDHCP) Kodwa ayithumeli le pakethi kumsebenzisi wokugqibela.
Idatha ye-Sniffer - kwi-Windows Server 2008 kunye nakwi-DHCP clientIWindows Server 2008 ifumana isicelo kwisixhobo sothungelwano. (Ukhetho 82 lukhona kuluhlu)
I-Windows Server 2008 ithumela impendulo kwisixhobo sothungelwano. (Ukhetho 82 aludweliswanga njengokhetho kwiphakheji)
Isicelo esivela kumxhasi-i-DHCP Discover ikhona kwaye i-DHCP Offer ayikho
Amanani kwizixhobo zenethiwekhi:
NEXUS-9000V-SW-1# show ip dhcp relay statistics
----------------------------------------------------------------------
Message Type Rx Tx Drops
----------------------------------------------------------------------
Discover 8 8 0
Offer 8 8 0
Request(*) 0 0 0
Ack 0 0 0
Release(*) 0 0 0
Decline 0 0 0
Inform(*) 0 0 0
Nack 0 0 0
----------------------------------------------------------------------
Total 16 16 0
----------------------------------------------------------------------
DHCP L3 FWD:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
Non DHCP:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
DROP:
DHCP Relay not enabled : 0
Invalid DHCP message type : 0
Interface error : 0
Tx failure towards server : 0
Tx failure towards client : 0
Unknown output interface : 0
Unknown vrf or interface for server : 0
Max hops exceeded : 0
Option 82 validation failed : 0
Packet Malformed : 0
Relay Trusted port not configured : 0
DHCP Request dropped on MCT : 0
* - These counters will show correct value when switch
receives DHCP request packet with destination ip as broadcast
address. If request is unicast it will be HW switched
NEXUS-9000V-SW-1#
Kutheni ulungelelwaniso lunzima kangaka kwiMicrosoft Windows Server 2012?
I-Microsoft Windows Server 2012 ayikayixhasi i-RFC#3527 (Ukhetho lwama-82 oluKhethelweyo 5(0x5)-Ukhetho lwekhonkco)
Kodwa ukusebenza koMgaqo-nkqubo sele kuphunyeziwe.
Ingaba isebenza kanjani:
- I-Microsoft Windows Server 2012 ine-pool enkulu (SuperScope) eneedilesi zeLoopback kunye namachibi othungelwano lokwenene.
- Ukukhethwa kwequla lokukhupha idilesi ye-IP iwela kwi-SuperScope, ekubeni impendulo yavela kwi-DHCP Relay kunye nedilesi yoMthombo weLoopback ibandakanywe kwi-SuperScope.
- Ukusebenzisa uMgaqo-nkqubo, isicelo sikhetha kwi-Superscope ukuba ilungu lomda we-VNI equlethwe kwi-ID yeSekethe ye-Agent 82. ("1"+ 0108000600 bits VNI + 24 bits amaxabiso angaziwa kum, kodwa i-sniffer ibonisa amaxabiso ka-24 kulo mmandla.)
Kwenziwa lula njani ukuseta kwiMicrosoft Windows Server 2016/2019?
I-Microsoft Windows Server 2016 isebenzisa i-RFC#3527 ukusebenza. Oko kukuthi, iWindows Server 2016 inokubona inethiwekhi echanekileyo ukusuka kuKhetho lwe-82 Sub-option 5(0x5) - Uphawu loKhetho lwekhonkco
Imibuzo emithathu ivela ngokukhawuleza:
- Ngaba sinokwenza ngaphandle kweSuperscope?
- Ngaba sinokwenza ngaphandle kwePolisi kwaye siguqule i-VNI kwifomu ye-hexadecimal?
- Ngaba sinokwenza ngaphandle koMda we-Loopback DHCP iidilesi zoMthombo?
Q. Ngaba sinokwenza ngaphandle kweSuperscope?
A. Ewe, umda unokudalwa kwangoko kwindawo yeedilesi ze-IPv4.
Q. Ngaba sinokwenza ngaphandle kwePolisi kwaye siguqule i-VNI kwifomu ye-hexadecimal?
A. Ewe, ukhetho lwenethiwekhi lusekwe kuKhetho lwe-82 Suboption 0x5,
Q. Ngaba sinokwenza ngaphandle koMda we-Loopback DHCP iidilesi zoMthombo?
A. Hayi asikwazi. Ngenxa yokuba iMicrosoft Windows Server 2016/2019 inokhuseleko kwizicelo ezinobungozi zeDHCP. Okokuthi, zonke izicelo ezivela kwiidilesi ezingekho kwi-pool pool ye-DHCP zibhekwa njengenkohlakalo.
Note
All relay agent IP addresses (GIADDR) must be part of an active DHCP scope IP address range. Any GIADDR outside of the DHCP scope IP address ranges is considered a rogue relay and Windows DHCP Server will not acknowledge DHCP client requests from those relay agents.
A special scope can be created to "authorize" relay agents. Create a scope with the GIADDR (or multiple if the GIADDR's are sequential IP addresses), exclude the GIADDR address(es) from distribution, and then activate the scope. This will authorize the relay agents while preventing the GIADDR addresses from being assigned.Ezo. Ukumisela iphuli ye-DHCP yomzi-mveliso we-VXLAN BGP EVPN kwi-Microsoft Windows Server 2016/2019, udinga kuphela:
- Yenza ichibi leedilesi zoMthombo weRelay.
- Yenza ichibi lothungelwano lwabathengi
Yintoni engafunekiyo (kodwa inokuqwalaselwa kwaye iya kusebenza kwaye ayiyi kuphazamisa umsebenzi):
- Yenza uMgaqo-nkqubo
- Yenza iSuperScope
Umzekelo:Umzekelo wokuseta iseva ye-DHCP (kukho abaxumi be-2 bokwenyani beDHCP - abathengi badityaniswe nelaphu leVXLAN)
Umzekelo wokuseta iqula labasebenzisi:
Umzekelo wokumisela iqula labasebenzisi (imigaqo-nkqubo ikhethiwe - ukubonisa ukuba imigaqo-nkqubo ayizange isetyenziswe ekusebenzeni okuchanekileyo kwequla):
Umzekelo wokumisela iqula leedilesi zoMthombo we-DHCP Relay (uluhlu lweedilesi zokukhutshwa luhambelana ngokupheleleyo nokukhutshelwa ngaphandle kwindawo yeedilesi):
Ukumisela inkonzo ye-DHCP kwi-Microsoft Windows Server 2019
Ukuqwalasela i-pool yeedilesi zeLoopback (umthombo) we-DHCP Relay.
Senza ichibi elitsha (uMda) kwindawo ye-IPv4.
Iwizadi yokudala iphuli. "Okulandelayo >"
Qwalasela igama lechibi kunye nenkcazo yedama.
Cwangcisa uluhlu lweedilesi ze-IP zeLoopback kunye nemaski echibini.
Ukongeza ngaphandle. Uluhlu lokukhubayo kufuneka lungqinelane ncam noluhlu lwequla.
Ixesha lokurenta. "Okulandelayo >"
Umbuzo: Ngaba uya kuqwalasela iinketho zeDHCP ngoku (DNS, WINS, Gateway, Domain) okanye uya kuyenza kamva. Kuya kukhawuleza ukuphendula hayi, kwaye emva koko uvule ichibi ngesandla. Okanye uye ekupheleni ngaphandle kokugcwalisa naluphi na ulwazi kwaye uvule ichibi ekupheleni kwewizard.
Siqinisekisa ukuba ukhetho alucwangciswanga kwaye i-pool ayisebenzi. "Gqiba"
Sivula idama ngesandla. — Khetha uMda kwaye kwimenyu yemeko — khetha “Vula”.
Senza i-pool kubasebenzisi / abancedisi.
Senza ichibi elitsha.
Iwizadi yokudala iphuli. "Okulandelayo >"
Qwalasela igama lechibi kunye nenkcazo yedama.
Cwangcisa uluhlu lweedilesi ze-IP zeLoopback kunye nemaski echibini.
Ukongeza ngaphandle. (Akukho ngaphandle kufunwa ngokungagqibekanga) "Okulandelayo >"
Ixesha lokurenta. "Okulandelayo >"
Umbuzo: Ngaba uya kuqwalasela iinketho zeDHCP ngoku (DNS, WINS, Gateway, Domain) okanye uya kuyenza kamva. Masiyimise ngoku.
Qwalasela idilesi yesango emiselweyo.
Siqwalasela i-domain kunye needilesi zeseva ye-DNS.
Ukuqwalasela iidilesi ze-IP zeeseva ze-WINS.
Ukusebenza koMda.
Iqula liqwalaselwe. "Gqiba"
isiphelo
Ukusebenzisa i-Windows Server 2016/2019 kunciphisa ubunzima bokuseka iseva ye-DHCP yelaphu le-VXLAN (okanye nayiphi na enye into). (Akuyomfuneko ukudlulisa amakhonkco akhethekileyo kwiingcali ze-IT: I-ID yeSekethe yeNethiwekhi/ye-Agent ukubhalisa izihluzi.)
Ngaba uqwalaselo lweWindows Server 2012 lusebenza kwiiseva ezintsha zika-2016/2019 - ewe luya kusebenza.
Olu xwebhu luqulethe iimbekiselo kwiinguqulelo ezi-2: 7.X kunye ne-9.3. Oku kubangelwa kukuba i-7.0 (3) I7 (7) i-Cisco Suggested release, kunye nenguqulo ye-9.3 yeyona nto intsha (ixhasa i-Multicast nge-VXLAN Multisite).
Uluhlu lwemithombo
umthombo: www.habr.com