Assigning Static IP address via Cisco IOS DHCP

For some cases that you want to assign a static IP address via a Cisco IOS DHCP server, to make sure for that particular MAC address will always get the same IP address, here is the example on how to get it done:


ip dhcp pool PandaPhone
   host 192.168.20.10 255.255.255.0
   client-identifier 01ee.ffaa.bbcc.dd
   default-router 192.168.20.254
   option 150 ip 192.168.20.200


Assuming the MAC address of the phone is EEFF.AABB.CCDD

Configuring IPv6 address on Linux

My environment: RH FC8 x86_64

To enable IPv6 globally, modify the file

# vi /etc/sysconfig/network

And append the following:

NETWORKING_IPV6=yes

Then change the NIC config file

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

And append the following IPv6 parameters:

IPV6INIT=yes
IPV6ADDR=<IPv6-IP-Address>
IPV6_DEFAULTGW=<IPv6-IP-Gateway-Address>

If you want to acquire the IPv6 address via DHCPv6 server, first make sure you have the DHCPv6 client installed:

# rpm –q dhcpv6-client

then modifiy the NIC config file and append the following parameters:

# vi /etc/sysconfig/network-scripts/ifcfg-eth0

IPV6INIT=yes
DHCPV6C=yes

Edit the main DHCPv6 client config file

# cp /usr/share/doc/dhcpv6-client-*/dhcp6c.conf /etc/
# vi /etc/dhcp6c.conf

interface eth0 {
    send rapid-commit;
    request domain-name-servers;
};

Restart the network service

# /etc/init.d/network restart

Then check your eth0 configuration to make sure you get the ipv6 address:

# ifconfig eth0

Protecting from Rogue DHCP server attacks – DHCP Snooping

My environment: Cisco Catalyst 3560E
IOS: c3560e-universal-mz.122-35.SE5.bin

One of the common DHCP server attack is rogue dhcp server attack, the potential problem is the attacker will become the hosts’ default gateway or DNS server.  DHCP snooping can prevent it from happening by untrusting the switchport that are not connecting to the DHCP server.

! Global Command

! which vlan you would like to snoop
ip dhcp snooping vlan 168,201

! this is important otherwise this feature is not enabled
ip dhcp snooping

! Switchport configuration for DHCP server
int gi0/4
ip dhcp snooping trust 

! User-facing switchport configuration, default untrust
int gi0/5
no ip dhcp snooping trust 

To showing the DHCP snooping binding:

pandaeatsbamboo-sw01#sh ip dhcp snooping binding
MacAddress          IpAddress        Lease(sec)  Type           VLAN  Interface
------------------  ---------------  ----------  -------------  ----  --------------------
00:16:C8:FF:C4:6D   192.168.10.102   80179       dhcp-snooping   201   GigabitEthernet0/6
00:17:E0:1C:AB:1A   192.168.10.104   79680       dhcp-snooping   201   GigabitEthernet0/8
Total number of bindings: 2

DHCP Snooping table can be written to flash or external storage.  Very importantly if you want to get the DHCP snooping database agent working, you MUST synchronize your switch with NTP, you can verify it with the command “sh ntp status”, make sure the clock is synchronized.

ip dhcp snooping database tftp://192.168.10.2/snoop.db

 

Then you can show ip dhcp snooping database to verify:

pandaeatsbamboo-sw01#sh ip dhcp snooping database
Agent URL : tftp://192.168.10.2/snoop.db
Write delay Timer : 15 seconds
Abort Timer : 300 seconds

Agent Running : No
Delay Timer Expiry : Not Running
Abort Timer Expiry : Not Running

Last Succeded Time : 10:29:01 HKT Fri Jun 5 2009
Last Failed Time : 18:35:29 HKT Wed Jun 3 2009
Last Failed Reason : Unable to access URL.

Total Attempts       :     1206   Startup Failures :        0
Successful Transfers :     1205   Failed Transfers :        1
Successful Reads     :        2   Failed Reads     :        0
Successful Writes    :     1203   Failed Writes    :        1
Media Failures       :        0

"Unknown DHCP problem.. No allocation possible"

Configuring DHCP client on a Cisco IOS router interface is pretty straight forward:

interface fastethernet1/0

ip address dhcp

But when your DHCP server is assigning addresses with option 150 for IP phones, you will not be able to get your address from the DHCP server for your interface and you will see the error message in debug dhcp:

"Unknown DHCP problem.. No allocation possible"

What you'll need to do is to ask your router interface (the DHCP client) to stop requesting option 150, and there is a per-interface command allows you to do that:

interface fastethernet1/0

ip address dhcp

no ip dhcp client request tftp-server-address

You should be able to get your address by then!

DHCP Server on Linux

My environment: RH FC8, x86_64

Before get started, make sure you have the dhcp package installed:

dhcp-3.0.6-12.fc8

The main configuration file is in /etc/dhcpd.conf, here is mine:

ddns-update-style interim;
ignore client-updates;

subnet 192.168.2.0 netmask 255.255.255.0 {

option routers 192.168.2.254;
option subnet-mask 255.255.255.0;

option domain-name "pandaeatsbamboo.com";
option domain-name-servers 192.168.2.60;

next-server 192.168.2.50; #My CUCM address

range dynamic-bootp 192.168.2.101 192.168.2.200; #The dhcp pool range
default-lease-time 21600;
max-lease-time 43200;

host test-server {
hardware ethernet 12:34:56:78:AB:CD;
fixed-address 12.34.56.78; # Fixed allocation based on MAC address
}


}

Restart your DHCP daemon:
/etc/init.d/dhcpd restart

Check the leases by viewing the lease file at /var/lib/dhcpd/dhcpd.leases, here is the sample file:

lease 192.168.2.197 {
starts 2 2008/03/11 08:00:21;
ends 2 2008/03/11 14:00:21;
tstp 2 2008/03/11 14:00:21;
binding state free;
hardware ethernet 00:19:d2:d0:10:01;
uid "\001\000\031\322\320\020\001";
}
lease 192.168.2.196 {
starts 2 2008/03/11 12:34:28;
ends 2 2008/03/11 18:34:28;
binding state active;
next binding state free;
hardware ethernet 00:02:78:90:e6:c5;
uid "\001\000\002x\220\346\305";
}

Cisco IOS DHCP Server

Don't wanna get another box just for DHCP? Using your routers or switches as DHCP server might be a choice for you. :)

! Your exclude range
ip dhcp excluded-address 10.3.1.1 10.3.1.20

! Define your pool
ip dhcp pool MyPool
network 10.3.1.0 255.255.255.0
default-router 10.3.1.1
option 150 ip 10.3.1.1
dns-server 10.1.1.20

A trick if you want to restart the DHCP server:
no service dhcp
service dhcp