Manuals / Allied Telesis / Computer Equipment / Switch

Allied Telesis AT-8600 Series manual Example on a Rapier, X If ARP security is enabled, add

Models: AT-8700XL Series AT-8600 Series Rapier i Series

1 26

Download 26 pages 29.76 Kb

Page 13

Example on a Rapier 24i

DHCP filtering

a maximum of 13 leases and ports 3 to 8 given 1 lease each. After that, no port could have its leases increased because the filter resource is completely used up.

Note: On Allied Telesis switches, IGMP snooping and MLD snooping are enabled by default, which occupy 2 filter entries. To dedicate 119 entries to DHCP snooping, IGMP and MLD snooping would need to be disabled with disable igmpsnooping and disable mldsnooping. Disabling these services is not desirable if multicasting is used in the network.

If other hardware filters are used, they will eat into the filter resource and so your maximum leases (and also your QoS classifiers) would be reduced.

Example on a Rapier 24i

XIf leases are 2 on ports 1 and 2 but 5 on ports 3 to 8, then the number of filter resources used is:

(2 entries * 2 ports) + (5 entries * 6 ports) = 34 entries

XIf ARP security is enabled, add 1:

(2 entries * 2 ports) + (5 entries * 6 ports) + 1 = 35 entries

XSo, the number of available filter resources left for other hardware filters, QoS classifiers or more leases is:

(119 maximum entries) – (34 used) = 85 entries

Xor if ARP security is enabled, is:

(119 maximum entries) – (35 used) = 84 entries

Page 13 AlliedWare™ OS How To Note: DHCP Snooping on Rapier-style switches

Image 13

Allied Telesis AT-8600 Series Example on a Rapier, X If ARP security is enabled, add, X or if ARP security is enabled, is

Contents

AlliedWareTM OS Introductionz AT-8800 series z AT-8600 series z AT-8700XL series Which products and software version does this information apply to?z Rapier and Rapier i series Minimum configuration Related How To NotesDHCP snooping The database Database survival across rebootsDHCP snooping database time-out Verifying the status of snooped usersList of terms Enabling DHCP snooping Trusted and non-trusted portsStatic binding So the database is empty Completely removing the DHCP snooping databaseDHCP snooping DHCP Option DHCP OptionExample Packet Protocol detailsAnalysis Configuring OptionDHCP filtering Configuring filteringDHCP snooping filter show command X To enable DHCP snooping ARP securityARP security Resource considerationsX or if ARP security is enabled, is X If ARP security is enabled, addExample on a Rapier X Configure a private VLAN for customers Configuration examplesX Add the tagged uplink ports to the VLAN X Enable DHCP snooping and Option 82 supportX Add the untagged ports for the customers X Define the DHCP snooping trusted portsX Define the upstream QoS flow groups X Create a set of QoS classifiersX Create a traffic class for all upstream flow groups X Add ports to the VLANs X Configure two VLANs for layer 3 access to the DHCP servercreate vlan=Customers vid=48 create vlan=Network vid=50 add vlan=48 port=1-24 add vlan=50 port=25X Define the DHCP snooping trusted port X For layer 3 support, enable the BOOTP RelayX Enable DHCP snooping and Option 82 support X Configure the switch’s IPX Define the upstream QoS flow groups X Create a set of QoS classifiersX Create a traffic class for all upstream flow groups No trusted ports configured TroubleshootingMaximum number of leases is exceeded The DHCP client continually sends requests instead of a discoverDHCPSNProcess 0b47ee6c Error adding entry to DB DHCPSNDB Updating entryId 7. FlagsSwitch is dropping ARPs DHCPSNARP 02680e6c ARP to be forwarded, sender validated Troubleshootingtrusted ports UntaggedNoneThe show log command is also very useful Displaying log entriesTroubleshooting Appendix 1 ISC DHCP server Appendix 1 ISC DHCP serverif exists agent.circuit-id