Injongo yalesi sihloko ukwenza lula ukucushwa kwesevisi ye-DHCP ye-VXLAN BGP EVPN nendwangu ye-DFA kusetshenziswa i-Microsoft Windows Server 2016/2019.
Embhalweni osemthethweni, isevisi ye-DHCP esekelwe ku-Microsoft Windows Server 2012 yendwangu ihlelwa njengeSuperScope equkethe i-Loopback pool (okugqamile kwaleli chibi ukukhishwa kwawo wonke amakheli e-IP echibini (okungafakiwe ikheli le-IP = pool)) kanye namachibi okukhipha amakheli e-IP amanethiwekhi wangempela (nakhu okugqamile - inqubomgomo imisiwe - lapho i-DHCP Relay Circuit ID ihlungwa khona futhi le ID yesifunda edluliselwe ye-DHCP iqukethe i-VNI yenethiwekhi, i.e. kwenye indawo yokubhukuda le-DHCP Relay I-ID yesifunda izohluka kancane).
To configure DHCP on Windows server.
1. Create a super scope. Within the super scope, create scope B, S1, S2, S3, …, Sn for the subnet B and the subnets for each segment.
2. In scope B, specify the 'Exclusion Range' to be the entire address range (so that the offered address range must not be from this scope).
3. For every segment scope Si, specify a policy that matches on Agent Circuit ID with value of '0108000600XXXXXX', where '0108000600' is a fixed value for all segments, the 6 numbers "XXXXXX" is the segment ID value in hexadecimal. Also ensure to check the Append wildcard(*) check box.
4. Set the policy address range to the entire range of the scope.Lesi sihloko siqukethe izimpendulo zemibuzo elandelayo:
Okuqukethwe
-
- ( & )
-
-
Isingeniso
Le ngxenye ibhala kafushane yonke idatha yokuqala: Imiyalo yokumisa okokusebenza kwenethiwekhi, ama-RFC asetshenziswa kumaphakethe e-DHCP ezimbonini ze-eVPN, ukuvela kwezilungiselelo zeseva ye-DHCP ku-Microsoft Windows Server 2012 kumibhalo ye-Cisco kunikezwa ukuze kusetshenziswe ireferensi. Kanye nolwazi olufushane mayelana ne-Superscope kanye Nenqubomgomo kusevisi ye-DHCP kumaseva e-Microsoft Windows.
Uyimisa kanjani i-DHCP Relay ku-VXLAN BGP EVPN, indwangu ye-DFA
Ukulungisa i-DHCP Relay kundwangu ye-VXLAN BGP EVPN akusona isihloko esiyinhloko salesi sihloko, njengoba kulula kakhulu. Ngihlinzeka ngezixhumanisi eziya kumadokhumenti kanye nesiphangi kuzilungiselelo kumpahla yenethiwekhi.
Isibonelo sokusetha i-DHCP Relay ku-Nexus 9000V v9.2(3)
service dhcp
ip dhcp relay
ip dhcp relay information option
ip dhcp relay information option vpn
interface loopback10
vrf member VRF1
ip address 10.120.0.1/32 tag 1234567
interface Vlan12
no shutdown
vrf member VRF1
no ip redirects
ip address 10.120.251.1/24 tag 1234567
no ipv6 redirects
fabric forwarding mode anycast-gateway
ip dhcp relay address 10.0.0.5
ip dhcp relay source-interface loopback10
Ama-RFC asetshenziswa ekusebenzeni kwesevisi ye-DHCP Relay ezindwangu ze-VXLAN BGP EVPN
I-RFC#6607: Inketho engaphansi 151(0x97) - Ukukhetha kwe-Subnet ebonakalayo
• Sub-option 151(0x97) - Virtual Subnet Selection (Defined in RFC#6607)
Used to convey VRF related information to the DHCP server in an MPLS-VPN and VXLAN EVPN multi-tenant environment."Igama" le-VRF lapho iklayenti litholakala khona lithunyelwa.
I-RFC#5107: Inketho engaphansi 11(0xb) - Ukukhishwa Kwe-ID Yeseva
• Sub-option 11(0xb) - Server ID Override (Defined in RFC#5107.)
The server identifier (server ID) override sub-option allows the DHCP relay agent to specify a new value for the server ID option, which is inserted by the DHCP server in the reply packet. This sub-option allows the DHCP relay agent to act as the actual DHCP server such that the renew requests will come to the relay agent rather than the DHCP server directly. The server ID override sub-option contains the incoming interface IP address, which is the IP address on the relay agent that is accessible from the client. Using this information, the DHCP client sends all renew and release request packets to the relay agent. The relay agent adds all of the appropriate sub-options and then forwards the renew and release request packets to the original DHCP server. For this function, Cisco’s proprietary implementation is sub-option 152(0x98). You can use the ip dhcp relay sub-option type cisco command to manage the function.Inketho isetshenziselwa ukuqinisekisa ukuthi iklayenti lithumela isicelo sokuvuselela ikheli lokuqashisa ekhelini le-IP elisetshenziswe kule nketho. (Ku-Cisco VXLAN BGP, i-EVPN iyisango elizenzakalelayo leklayenti le-Anycast address.)
I-RFC#3527: Inketho engaphansi 5(0x5) - Ukukhetha Isixhumanisi
Sub-option 5(0x5) - Link Selection (Defined in RFC#3527.)
The link selection sub-option provides a mechanism to separate the subnet/link on which the DHCP client resides from the gateway address (giaddr), which can be used to communicate with the relay agent by the DHCP server. The relay agent will set the sub-option to the correct subscriber subnet and the DHCP server will use that value to assign an IP address rather than the giaddr value. The relay agent will set the giaddr to its own IP address so that DHCP messages are able to be forwarded over the network. For this function, Cisco’s proprietary implementation is sub-option 150(0x96). You can use the ip dhcp relay sub-option type ciscocommand to manage the function.Ikheli lenethiwekhi lapho iklayenti lidinga khona ikheli le-IP.
Ukuvela kwemibhalo ye-Cisco mayelana nokumisa i-DHCP ku-Microsoft Windows Server 2012
Ngifake lesi sigaba ngoba kukhona ukuthambekela okuhle ngasohlangothini lomthengisi:
Amadokhumenti abonisa kuphela indlela yokumisa i-DHCP Relay kumpahla yenethiwekhi.
Enye i-athikili isetshenziswe ukulungisa i-DHCP ku-Windows Server 2012:
Lesi sihloko sibonisa ukuthi inethiwekhi/VNI ngayinye idinga inqwaba yayo ye-SuperScope kanye nesethi yayo yamakheli e-Loopback:
If multiple DHCP Scopes are required for multiple subnets, you need to create one LoopbackX per subnet/vlan on all LEAFS and create a superscope with a loopbackX range scope and actual client IP subnet scope per vlan.
Kwengezwe Izilungiselelo zeseva ye-Windows 2012 emibhalweni yokusetha okokusebenza kwenethiwekhi. Kuwo wonke amachibi amakheli asetshenzisiwe, i-SuperScope eyodwa isikhungo sedatha ngasinye siyadingeka futhi le SuperScope iwumngcele wesikhungo sedatha:
Create Superscope for all scopes you want to use for Option 82-based policies.
Note
The Superscope should combine all scopes and act as the administrative boundary.
Konke kuchazwe ngokufushane kakhulu:
Let us assume the switch is using the address from subnet B (it can be the backbone subnet, management subnet, or any customer designated subnet for this purpose) to communicate with the Windows DHCP server. In DFA we have subnets S1, S2, S3, …, Sn for segment s1, s2, s3, …, sn.
To configure DHCP on Windows server.
1. Create a super scope. Within the super scope, create scope B, S1, S2, S3, …, Sn for the subnet B and the subnets for each segment.
2. In scope B, specify the 'Exclusion Range' to be the entire address range (so that the offered address range must not be from this scope).
3. For every segment scope Si, specify a policy that matches on Agent Circuit ID with value of '0108000600XXXXXX', where '0108000600' is a fixed value for all segments, the 6 numbers "XXXXXX" is the segment ID value in hexadecimal. Also ensure to check the Append wildcard(*) check box.
4. Set the policy address range to the entire range of the scope.
I-DHCP ku-Microsoft Windows Server (i-Superscope nenqubomgomo)
Superscope is an administrative feature of a DHCP server that can be used to group multiple scopes as a single administrative entity. Superscope allows a DHCP server to provide leases from more than one scope to clients on a single physical network. Scopes added to a superscope are called member scopes.
Yini i-SuperScope - kuwumsebenzi okuvumela ukuthi uhlanganise amachibi amaningana amakheli e-IP ube yiyunithi eyodwa yokuphatha. Ukuze ukhangise kubasebenzisi kunethiwekhi efanayo (kwi-VLAN efanayo) amakheli e-IP avela kumachibi amaningana. Uma isicelo sifike kuqoqo lamakheli njengengxenye ye-SuperScope, iklayenti linganikezwa ikheli elisuka kwenye Ububanzi obufakwe kule SuperScope.
The DHCP Server role in Windows Server 2012 introduces a new feature that allows you to create IPv4 policies that specify custom IP address and option assignments for DHCP clients based on a set of conditions.
The policy based assignment (PBA) feature allows you to group DHCP clients by specific attributes based on fields contained in the DHCP client request packet. PBA enables targeted administration and greater control of the configuration parameters delivered to network devices with DHCP.
Izinqubomgomo - zikuvumela ukuthi unikeze amakheli e-IP kubasebenzisi kuye ngohlobo lomsebenzisi noma ipharamitha. Onjiniyela beCisco basebenzisa izinqubomgomo ku-Windows Server 2012 ukuze bahlunge nge-VNI (I-Virtual Network Identifier).
Umzimba oyinhloko
Lesi sigaba siqukethe imiphumela yocwaningo, kungani lungasekelwa, lusebenza kanjani (logic), yini entsha nokuthi lokhu okusha kuzosisiza kanjani.
Kungani iMicrosoft Windows Server 2000/2003/2008 ingasekelwe?
I-Microsoft Windows Server 2008 kanye nezinguqulo zangaphambili aziyicubunguli inketho 82 futhi iphakethe lokubuyisela lithunyelwa ngaphandle kwenketho 82.
- Isicelo esivela kuklayenti sithunyelwa kokuthi Ukusakaza (i-DHCP Discover).
- Isisetshenziswa (i-Nexus) sithumela iphakethe kuseva ye-DHCP (DHCP Discover + Option 82).
- Iseva ye-DHCP ithola iphakethe, ilicubungule, ilibuyisele emuva, kodwa ngaphandle kwenketho 82. (Umnikelo we-DHCP – ngaphandle kwenketho 82)
- Okokusebenza (i-Nexus) kuthola iphakethe kusuka kuseva ye-DHCP. (Umnikelo we-DHCP) Kodwa ayithumeli leli phakethe kumsebenzisi wokugcina.
Idatha ye-Sniffer - ku-Windows Server 2008 kanye nakuklayenti le-DHCPIWindows Server 2008 ithola isicelo esivela kumishini yenethiwekhi. (Inketho 82 ikhona ohlwini)
IWindows Server 2008 ithumela impendulo kumishini yenethiwekhi. (Inketho 82 ayifakiwe ohlwini lwenketho ephaketheni)
Isicelo esivela kuklayenti - I-DHCP Discover ikhona futhi Umnikelo we-DHCP awukho
Izibalo zezinto zenethiwekhi:
NEXUS-9000V-SW-1# show ip dhcp relay statistics
----------------------------------------------------------------------
Message Type Rx Tx Drops
----------------------------------------------------------------------
Discover 8 8 0
Offer 8 8 0
Request(*) 0 0 0
Ack 0 0 0
Release(*) 0 0 0
Decline 0 0 0
Inform(*) 0 0 0
Nack 0 0 0
----------------------------------------------------------------------
Total 16 16 0
----------------------------------------------------------------------
DHCP L3 FWD:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
Non DHCP:
Total Packets Received : 0
Total Packets Forwarded : 0
Total Packets Dropped : 0
DROP:
DHCP Relay not enabled : 0
Invalid DHCP message type : 0
Interface error : 0
Tx failure towards server : 0
Tx failure towards client : 0
Unknown output interface : 0
Unknown vrf or interface for server : 0
Max hops exceeded : 0
Option 82 validation failed : 0
Packet Malformed : 0
Relay Trusted port not configured : 0
DHCP Request dropped on MCT : 0
* - These counters will show correct value when switch
receives DHCP request packet with destination ip as broadcast
address. If request is unicast it will be HW switched
NEXUS-9000V-SW-1#
Kungani ukumisa kunzima kangaka ku-Microsoft Windows Server 2012?
I-Microsoft Windows Server 2012 ayikasekeli i-RFC#3527 (Inketho 82 Inketho 5(0x5) - Ukukhetha Isixhumanisi)
Kodwa ukusebenza Kwenqubomgomo sekuvele kwenziwa.
Isebenza kanjani:
- I-Microsoft Windows Server 2012 ine-super pool (SuperScope) enamakheli e-Loopback namachibi amanethiwekhi wangempela.
- Ukukhethwa kwechibi lokukhipha ikheli lasesizindeni se-inthanethi kuwela ku-SuperScope, njengoba impendulo ivele ku-DHCP Relay nekheli lomthombo we-Loopback elifakwe ku-SuperScope.
- Ngokusebenzisa Inqubomgomo, isicelo sikhetha ku-Superscope leyo scope yelungu i-VNI yayo equkethwe ku-ID Yesekethe Yomenzeli Yenketho 82. (“1”+ amabhithi angu-0108000600 e-VNI + amabhithi angu-24 amanani awo angaziwa kimi, kodwa isiduphunga sibonisa amanani angu-24 kulo mkhakha.)
Ukusetha kwenziwa kanjani lula ku-Microsoft Windows Server 2016/2019?
I-Microsoft Windows Server 2016 isebenzisa i-RFC#3527 ukusebenza. Okusho ukuthi, iWindows Server 2016 ingabona inethiwekhi elungile ku-Option 82 Sub-option 5(0x5) - Isibaluli Sokukhetha Isixhumanisi.
Imibuzo emithathu ephakama ngokushesha:
- Singakwazi ukwenza ngaphandle kwe-Superscope?
- Singakwazi yini ukwenza ngaphandle Kwenqubomgomo futhi siguqule i-VNI ibe ifomu le-hexadecimal?
- Singakwazi ukwenza ngaphandle kwe-Scope for Loopback DHCP Source amakheli?
Q. Singakwazi ukwenza ngaphandle kwe-Superscope?
A. Yebo, ububanzi bungenziwa ngokushesha endaweni yamakheli e-IPv4.
Q. Singakwazi yini ukwenza ngaphandle Kwenqubomgomo futhi siguqule i-VNI ibe ifomu le-hexadecimal?
A. Yebo, ukukhethwa kwenethiwekhi kusekelwe ku-Option 82 Suboption 0x5,
Q. Singakwazi ukwenza ngaphandle kwe-Scope for Loopback DHCP Source amakheli?
A. Cha ngeke sikwazi. Ngoba i-Microsoft Windows Server 2016/2019 inokuvikelwa ezicelweni ezinonya ze-DHCP. Okusho ukuthi, zonke izicelo ezivela emakhelini angekho kuseva ye-DHCP zibhekwa njengezinonya.
Note
All relay agent IP addresses (GIADDR) must be part of an active DHCP scope IP address range. Any GIADDR outside of the DHCP scope IP address ranges is considered a rogue relay and Windows DHCP Server will not acknowledge DHCP client requests from those relay agents.
A special scope can be created to "authorize" relay agents. Create a scope with the GIADDR (or multiple if the GIADDR's are sequential IP addresses), exclude the GIADDR address(es) from distribution, and then activate the scope. This will authorize the relay agents while preventing the GIADDR addresses from being assigned.Labo. Ukuze ulungiselele ichibi le-DHCP lemboni ye-VXLAN BGP EVPN ku-Microsoft Windows Server 2016/2019, udinga kuphela:
- Dala iphuli yamakheli e-Source Relay.
- Dala iphuli yamanethiwekhi amaklayenti
Okungadingeki (kodwa kungalungiswa futhi kuzosebenza futhi ngeke kuphazamise umsebenzi):
- Dala Inqubomgomo
- Dala i-SuperScope
Isibonelo:Isibonelo sokusetha iseva ye-DHCP (kunamakhasimende angu-2 wangempela e-DHCP - amaklayenti axhunywe kwindwangu ye-VXLAN)
Isibonelo sokusetha iphuli yabasebenzisi:
Isibonelo sokusetha iphuli yabasebenzisi (izinqubomgomo zikhethiwe - ukufakazela ukuthi izinqubomgomo azizange zisetshenziselwe ukusebenza kahle kwephuli):
Isibonelo sokumisa iphuli yomthombo wamakheli e-DHCP Relay (ububanzi bamakheli bokukhishwa buhambisana ngokugcwele nokukhishwa endaweni yamakheli):
Ukusetha isevisi ye-DHCP ku-Microsoft Windows Server 2019
Ilungiselela ichibi lamakheli e-Loopback (umthombo) we-DHCP Relay.
Sakha ichibi elisha (Scope) esikhaleni se-IPv4.
Isilekeleli sokudala iphuli. "Okulandelayo >"
Lungiselela igama lechibi kanye nencazelo yechibi.
Setha ububanzi bamakheli e-IP we-Loopback kanye nemaski ye-pool.
Yengeza okuhlukile. Ububanzi bokukhishwa kufanele bufane ncamashi nobubanzi bechibi.
Isikhathi sokuqasha. "Okulandelayo >"
Umbuzo: Ingabe uzozilungiselela izinketho ze-DHCP manje (DNS, WINS, Gateway, Domain) noma uzokwenza kamuva. Kungaba ngokushesha ukuphendula ukuthi cha, bese uvula ichibi ngokwenza. Noma uye ekupheleni ngaphandle kokugcwalisa noma yiluphi ulwazi futhi wenze i-pool isebenze ekugcineni kwewizadi.
Siyaqinisekisa ukuthi izinketho azilungisiwe futhi ichibi alicushiwe. "Qeda"
Senza i-pool isebenze mathupha. — Khetha Ububanzi futhi kumenyu yokuqukethwe — khetha “Vumela”.
Sakha ichibi labasebenzisi/amaseva.
Sakha ichibi elisha.
Isilekeleli sokudala iphuli. "Okulandelayo >"
Lungiselela igama lechibi kanye nencazelo yechibi.
Setha ububanzi bamakheli e-IP we-Loopback kanye nemaski ye-pool.
Yengeza okuhlukile. (Akukho okuhlukile okudingeka ngokuzenzakalela) "Okulandelayo >"
Isikhathi sokuqasha. "Okulandelayo >"
Umbuzo: Ingabe uzozilungiselela izinketho ze-DHCP manje (DNS, WINS, Gateway, Domain) noma uzokwenza kamuva. Asiyimise manje.
Lungiselela ikheli lesango elizenzakalelayo.
Silungisa isizinda kanye namakheli eseva ye-DNS.
Ilungiselela amakheli e-IP wamaseva e-WINS.
Ukwenziwa kusebenze kobubanzi.
I-pool imisiwe. "Qeda"
isiphetho
Ukusebenzisa i-Windows Server 2016/2019 kunciphisa inkimbinkimbi yokumisa iseva ye-DHCP yendwangu ye-VXLAN (noma iyiphi enye indwangu). (Akudingekile ukudlulisa izixhumanisi ezikhethekile kochwepheshe be-IT: I-ID Yesifunda Yenethiwekhi/Yomenzeli ukuze ubhalise izihlungi.)
Ingabe ukucushwa kweWindows Server 2012 kuzosebenza kumaseva amasha ka-2016/2019 - yebo kuzosebenza.
Lo mbhalo uqukethe izinkomba ezinguqulweni ezi-2: 7.X kanye no-9.3. Lokhu kungenxa yokuthi inguqulo 7.0(3)I7(7) iwukukhululwa Okuphakanyisiwe kwe-Cisco, futhi inguqulo engu-9.3 iyona emisha kakhulu (ngisho nokusekela i-Multicast nge-VXLAN Multisite).
Uhlu lwemithombo
Source: www.habr.com