配置自适应安全设备(ASA) DHCP中继
简介
本文档介绍借助数据包捕获和调试在Cisco ASA上进行的DHCP中继，并提供配置示例。
先决条件
动态主机配置协议(DHCP)中继代理允许安全设备将DHCP请求从客户端转发到连接到其他接口的路由器或其他DHCP服务器。
以下限制仅适用于使用DHCP中继代理：
- 如果启用了 DHCP 服务器功能，则不能同时启用中继代理。
- 您必须直接连接到安全设备，并且不能通过其他中继代理或路由器发送请求。
- 对于多情景模式，不能在多个情景使用的接口上启用DHCP中继或配置DHCP中继服务器。
在透明防火墙模式下，DHCP 中继服务不可用。透明防火墙模式中的安全设备只允许地址解析协议(ARP)流量通过。所有其他流量都要求使用访问控制列表 (ACL)。要允许DHCP请求和应答在透明模式下通过安全设备，必须配置两个ACL：
- 一个 ACL 允许从内部接口向外部发送 DHCP 请求.
- 一个 ACL 允许接收来自反方向的服务器的答复.
要求
Cisco建议您具备ASA CLI和Cisco IOS® CLI的基础知识。
使用的组件
本文档中的信息基于以下软件和硬件版本：
- ASA 5500-x系列安全设备版本9.x或更高版本
- Cisco 1800 系列路由器
本文档中的信息都是基于特定实验室环境中的设备编写的。本文档中使用的所有设备最初均采用原始（默认）配置。如果您的网络处于活动状态，请确保您了解所有命令的潜在影响。
背景信息
DHCP协议为主机提供自动配置参数，例如带子网掩码的IP地址、默认网关、DNS服务器地址和Windows Internet名称服务(WINS)地址。最初，DHCP 客户端没有其中的任何配置参数。为了获得此信息，他们发送广播请求以获取此信息。当 DHCP 服务器看到此请求后，DHCP 服务器将提供必要信息。由于这些广播请求的特性，DHCP 客户端和服务器必须位于相同的子网上。默认情况下，第 3 层设备（如路由器和防火墙）通常不会转发这些广播请求。
尝试将DHCP客户端和DHCP服务器定位在同一子网并不总是方便的。在这种情况下，可以使用 DHCP 中继。当安全设备上的 DHCP 中继代理收到来自内部接口上的主机的 DHCP 请求时，它会将该请求转发至外部接口上的其中一个指定 DHCP 服务器。当 DHCP 服务器答复客户端时，安全设备会将该中继转发回来。因此，在与 DHCP 服务器的对话中，DHCP 中继代理充当了 DHCP 客户端的代理。
数据包流
下图说明未使用DHCP中继代理时的DHCP数据包流：
ASA拦截这些数据包并将其包装为DHCP中继格式：
在ASA内部和外部接口上使用数据包捕获的DHCP中继
记下以红色突出显示的内容，因为ASA就是这样修改各个字段的。
- 要启动DHCP进程，请启动系统并向目标地址255.255.255.255 - UDP端口67发送广播消息(DHCPDISCOVER)。
- 通常，ASA会丢弃广播，但由于它被配置为充当DHCP中继，因此它将DHCPDISCOVER消息作为单播数据包转发到DHCP服务器的IP源（来自面向服务器的接口IP）。在本例中，它是外部接口IP地址。注意IP报头和中继代理字段的变化：
- 服务器将DHCPOFFER消息作为单播数据包发回ASA，目标为在DHCPDISCOVER- UDP端口67中设置的中继代理IP。在本例中，它是内部接口(giaddr)的IP地址，在该接口上启用了dhcprelay。注意第3层报头中的目的IP：
- ASA将此数据包发送到内部接口- UDP端口68。注意数据包离开内部接口时IP报头的变化：
- 收到DHCPOFFER消息后，请发送DHCPREQUEST消息以指示您接受该提议。
- ASA将DHCPREQUEST传递到DHCP服务器。
- 服务器收到DHCPREQUEST后，会发回DHCPACK以确认提供的IP。
- ASA将DHCPACK从DHCP服务器传送给您，这样便完成了事务。
DHCP中继事务的调试和系统日志
这是转发到DHCP服务器接口198.51.100.2的DHCP请求：
DHCPRA: relay binding created for client 0050.5684.396a.DHCPD:
setting giaddr to 192.0.2.1.
dhcpd_forward_request: request from 0050.5684.396a forwarded to 198.51.100.2.
DHCPD/RA: Punt 198.51.100.2/17152 --> 192.0.2.1/17152 to CP
DHCPRA: Received a BOOTREPLY from interface 2
DHCPRA: relay binding found for client 0050.5684.396a.
DHCPRA: Adding rule to allow client to respond using offered address 192.0.2.4
从DHCP服务器收到回复后，安全设备将其转发到MAC地址为0050.5684.396a的DHCP客户端，并将网关地址更改为自己的内部接口。
DHCPRA: forwarding reply to client 0050.5684.396a.
DHCPRA: relay binding found for client 0050.5684.396a.
DHCPD: setting giaddr to 192.0.2.1.
dhcpd_forward_request: request from 0050.5684.396a forwarded to 198.51.100.2.
DHCPD/RA: Punt 198.51.100.2/17152 --> 192.0.2.1/17152 to CP
DHCPRA: Received a BOOTREPLY from interface 2
DHCPRA: relay binding found for client 0050.5684.396a.
DHCPRA: exchange complete - relay binding deleted for client 0050.5684.396a.
DHCPD: returned relay binding 192.0.2.1/0050.5684.396a to address pool.
dhcpd_destroy_binding() removing NP rule for client 192.0.2.1
DHCPRA: forwarding reply to client 0050.5684.396a.
系统日志中也显示相同的事务：
%ASA-7-609001: Built local-host inside:0.0.0.0
%ASA-7-609001: Built local-host identity:255.255.255.255
%ASA-6-302015: Built inbound UDP connection 13 for inside:
0.0.0.0/68 (0.0.0.0/68) to identity:255.255.255.255/67 (255.255.255.255/67)
%ASA-7-609001: Built local-host identity:198.51.100.1
%ASA-7-609001: Built local-host outside:198.51.100.2
%ASA-6-302015: Built outbound UDP connection 14 for outside:
198.51.100.2/67 (198.51.100.2/67) to identity:198.51.100.1/67 (198.51.100.1/67)
%ASA-7-609001: Built local-host inside:192.0.2.4
%ASA-6-302020: Built outbound ICMP connection for
faddr 192.0.2.4/0 gaddr 198.51.100.2/1 laddr 198.51.100.2/1
%ASA-7-609001: Built local-host identity:192.0.2.1
%ASA-6-302015: Built inbound UDP connection 16 for outside:
198.51.100.2/67 (198.51.100.2/67) to identity:192.0.2.1/67 (192.0.2.1/67)
%ASA-6-302015: Built outbound UDP connection 17 for inside:
192.0.2.4/68 (192.0.2.4/68) to identity:192.0.2.1/67 (192.0.2.1/67)
%ASA-6-302021: Teardown ICMP connection for
faddr 192.0.2.4/0 gaddr 198.51.100.2/1 laddr 198.51.100.2/1
配置
本部分提供用于配置本文档所述功能的信息。
网络图
本文档使用以下网络设置：
配置
本文档使用以下配置：
- 使用CLI配置DHCP中继
- DHCP 中继最终配置
- DHCP 服务器配置
使用CLI配置DHCP中继
dhcprelay server 198.51.100.2 outside
dhcprelay enable inside
dhcprelay setroute inside
dhcprelay timeout 60
DHCP 中继最终配置
show run
!
hostname ASA
names
!
interface Ethernet0/0
nameif inside
security-level 0
ip address 192.0.2.1 255.255.255.0
!
interface Ethernet0/1
nameif outside
security-level 100
ip address 198.51.100.1 255.255.255.0
!
interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Ethernet0/3
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
no pager
logging enable
logging buffer-size 40960
logging buffered debugging
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
timeout xlate 0:30:00
timeout pat-xlate 0:00:30
timeout conn 3:00:00 half-closed 0:30:00 udp 0:15:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 0:30:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcprelay server 198.51.100.2 Outside
dhcprelay enable inside
dhcprelay setroute inside
//Defining DHCP server IP and interface//
//Enables DHCP relay on inside/client facing interface//
//Sets ASA inside as DG for clients in DHCP reply packets//
dhcprelay timeout 60
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:7ae5f655ffe399c8a88b61cb13425972
: end
DHCP 服务器配置
show run
Building configuration...
Current configuration : 1911 bytes
!
! Last configuration change at 18:36:05 UTC Tue May 28 2013
version 15.1
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Router
!
boot-start-marker
boot-end-marker
!
!
logging buffered 4096
!
no aaa new-model
!
crypto pki token default removal timeout 0
!
!
dot11 syslog
ip source-route
!
ip dhcp excluded-address 192.0.2.1 192.0.2.2
ip dhcp excluded-address 192.0.2.10 192.0.2.254
//IP addresses exluded from DHCP scope//
!
ip dhcp pool pool1
import all network 192.0.2.0 255.255.255.0
dns-server 192.0.2.10 192.0.2.11 domain-name cisco.com
//DHCP pool configuration and various parameters//
!
!
!
ip cef
no ipv6 cef
!
multilink bundle-name authenticated
!
!
!
license udi pid CISCO1811W-AG-A/K9 sn FCTxxxx
!
!
!
interface Dot11Radio0
no ip address
shutdown
speed basic-1.0 basic-2.0 basic-5.5 6.0 9.0 basic-11.0 12.0 18.0 24.0 36.0 48.0 54.0
station-role root
!
interface Dot11Radio1
no ip address
shutdown
speed basic-6.0 9.0 basic-12.0 18.0 basic-24.0 36.0 48.0 54.0
station-role root
!
interface FastEthernet0
ip address 198.51.100.2 255.255.255.0
duplex auto
speed auto
!
interface FastEthernet1
no ip address
duplex auto
speed auto
!
interface FastEthernet2
no ip address
!
interface FastEthernet3
no ip address
!
interface FastEthernet4
no ip address
!
interface FastEthernet5
no ip address
!
interface FastEthernet6
no ip address
!
interface FastEthernet7
no ip address
!
interface FastEthernet8
no ip address
!
interface FastEthernet9
no ip address
!
interface Vlan1
no ip address
!
interface Async1
no ip address
encapsulation slip
!
ip forward-protocol nd
no ip http server
no ip http secure-server
!
!
ip route 192.0.2.0 255.255.255.0 198.51.100.1
//Static route to ensure replies are routed to relay agent IP//
!
!
!
control-plane
!
!
line con 0
line 1
modem InOut
stopbits 1
speed 115200
flowcontrol hardware
line aux 0
line vty 0 4
login
transport input all
!
end
使用多个DHCP服务器的DHCP中继
您最多可以定义10个DHCP服务器。当客户端发送DHCP Discover数据包时，它被转发到所有DHCP服务器。
例如：
dhcprelay server 198.51.100.2 outside dhcprelay server 198.51.100.3 outside dhcprelay server 198.51.100.4 outside dhcprelay enable inside dhcprelay setroute inside
使用多个DHCP服务器进行调试
以下是使用多个DHCP服务器时的一些示例调试：
DHCP: Received a BOOTREQUEST from interface 2 (size = 300) DHCPRA: relay binding found for client 000c.291c.34b5. DHCPRA: setting giaddr to 192.0.2.1. dhcpd_forward_request: request from 000c.291c.34b5 forwarded to 198.51.100.2. dhcpd_forward_request: request from 000c.291c.34b5 forwarded to 198.51.100.3. dhcpd_forward_request: request from 000c.291c.34b5 forwarded to 198.51.100.4.
使用多个DHCP服务器进行捕获
以下是使用多个DHCP服务器时的数据包捕获示例：
ASA# show cap out 3 packets captured 1: 18:48:41.211628 192.0.2.1.67 > 198.51.100.2.67: udp 300
2: 18:48:41.211689 192.0.2.1.67 > 198.51.100.3.67: udp 300
3: 18:48:41.211704 192.0.2.1.67 > 198.51.100.4.67: udp 300
验证
使用本部分可确认配置能否正常运行。
要查看有关DHCP中继服务的统计信息，请在ASA CLI上输入show dhcprelay statistics命令：
ASA# show dhcprelay statistics
DHCP UDP Unreachable Errors: 1
DHCP Other UDP Errors: 0
Packets Relayed
BOOTREQUEST 0
DHCPDISCOVER 1
DHCPREQUEST 1
DHCPDECLINE 0
DHCPRELEASE 0
DHCPINFORM 0
BOOTREPLY 0
DHCPOFFER 1
DHCPACK 1
DHCPNAK 0
此输出提供有关若干DHCP消息类型的信息，例如DHCPDISCOVER、DHCP REQUEST、DHCP OFER、DHCP RELEASE和DHCP ACK。
- show dhcprelay state on ASA CLI
- show ip dhcp server statistics on router CLI
故障排除
本部分提供了可用于对配置进行故障排除的信息。
Router#show ip dhcp server statistics
Memory usage 56637
Address pools 1
Database agents 0
Automatic bindings 1
Manual bindings 0
Expired bindings 0
Malformed messages 0
Secure arp entries 0
Message Received
BOOTREQUEST 0
DHCPDISCOVER 1
DHCPREQUEST 1
DHCPDECLINE 0
DHCPRELEASE 0
DHCPINFORM 0
Message Sent
BOOTREPLY 0
DHCPOFFER 1
DHCPACK 1
DHCPNAK 0
ASA# show dhcprelay state
Context Configured as DHCP Relay
Interface inside, Configured for DHCP RELAY SERVER
Interface outside, Configured for DHCP RELAY
您还可以使用这些debug命令：
- debug dhcprelay packet
- debug dhcprelay event
- 捕获
- 系统日志
相关信息
修订历史记录
| 版本 | 发布日期 | 备注 |
|---|---|---|
2.0 |
17-May-2023 |
添加了Alt文本和新图像。
更新了简介、机器翻译、风格要求、动词和格式。 |
1.0 |
30-May-2013 |
初始版本 |
反馈