topic dhcp binding + dhcp excluded in ExtremeSwitching (EXOS/Switch Engine)

dhcp binding + dhcp excluded

Alexandr_P — Wed, 18 May 2016 18:13:00 GMT

Hello, all!

Can you, please, give me explanation about DHCP-binding.

User Guide says "The DHCP bindings database contains the IP address, MAC Address, VLAN ID, and port number of the untrusted interface or client."
But as I understand dhcp binding - when we want to give to some client MAC address preconfigured IP address. Or I'm wrong?
If I wrong - how can we bind MAC-IP addresses pairs?

And last question: how can we exclude some addresses from switch DHCP-server?
As I remember - there wasn't so option.
But what we have to do if switch have dhcp-server with pool, for example, 10.0.0.50 - 10.0.0.100, but we have some clients which have static address 10.0.0.70 ???

RE: dhcp binding + dhcp excluded

Erik_Auerswald — Wed, 18 May 2016 18:38:00 GMT

The DHCP binding database of the switch pertains to DHCP snooping, where the switch records which IP address has been provided to and accepted by what MAC address.

RE: dhcp binding + dhcp excluded

Alexandr_P — Wed, 18 May 2016 18:38:00 GMT

OK.

In case if I want to map some clilent MAC to some IP, how can I do this on Summit?

Thank you!

RE: dhcp binding + dhcp excluded

Erik_Auerswald — Wed, 18 May 2016 18:38:00 GMT

I don't think this is possible. The "ip-security dhcp-binding" commands pertain to DHCP snooping as far as I know.

You would need to specify an address range that does not include statically assigned addresses.

RE: dhcp binding + dhcp excluded

Kawawa — Wed, 18 May 2016 18:38:00 GMT

Hi Alexandr P, is this what you're looking to deploy: http://documentation.extremenetworks.com/exos/EXOS_21_1/Security/c_configuring-dhcp-binding.shtml ?

RE: dhcp binding + dhcp excluded

Alexandr_P — Wed, 18 May 2016 18:38:00 GMT

Hi, Kawawa!

I look there. In this section "Configuring DHCP Binding" all clear.

But earlier, in section "DHCP Snooping and Trusted DHCP Server" was write that "The DHCP bindings database contains the IP address, MAC Address, VLAN ID, and port number of the untrusted interface or client." Word untrusted confused me.

RE: dhcp binding + dhcp excluded

Kawawa — Wed, 18 May 2016 18:38:00 GMT

Ahh yes, I now follow. My understanding is that all ports are untrusted unless listed as trusted, therefore the switch drops and logs a violation for any DHCP packets arriving from a DHCP server on that port!

RE: dhcp binding + dhcp excluded

Alexandr_P — Wed, 18 May 2016 18:38:00 GMT

OK.
Thank you!

RE: dhcp binding + dhcp excluded

Kawawa — Mon, 23 May 2016 18:45:00 GMT

To sum up this thread, the following article outlines some ideas around DHCP Snooping and the DHCP Bindings database: How to configure DHCP Snooping on EXOS

RE: dhcp binding + dhcp excluded

emanuel — Thu, 21 Jul 2016 19:09:00 GMT

Interesting article on the knowledge base.
A couple of question:
- Can I read via SNMP the table with the dhcp-snooping entries ?
- I am trying to delete the configure ip-security dhcp-bindings storage filename dhcpbind.xsf

command from my config but I can not. Any ideas ?

Thanks
Emanuel

RE: dhcp binding + dhcp excluded

Keith9 — Fri, 18 Oct 2019 23:24:00 GMT

I need more clarification on this line from the article:

For statically assigned IP addresses, entries, MUST be manually added to the bindings database

Ok thats great but why didn’t the author of the article friggin write HOW TO DO IT?

Example here is how to do it on a Cisco switch:

ip source binding <mac address> vlan # <ip address> interface <port its plugged into>

ip source binding aaaa.bbbb.cccc vlan 1 10.3.0.45 interface Gi3/0/44

RE: dhcp binding + dhcp excluded

ARPcPro — Mon, 29 Mar 2021 19:01:00 GMT

It has been 4 years. Anyone found a way to do this static binding “MAC address → IP” on these switches?

RE: dhcp binding + dhcp excluded

Keith9 — Sat, 10 Apr 2021 05:21:00 GMT

I think this is the command

configure ip-security dhcp-bindings add ip <ip address> mac <mac address> vlan <vlan name> server-port <port facing dhcp server> client-port <port where device resides> lease-time <0 if static>

example:
configure ip-security dhcp-bindings add ip 10.2.2.145 mac 00:26:AB:7B:42:66 vlan VL2 server-port 1:57 client-port 2:48 lease-time 0

Then if you made a mistake you could delete it

configure ip-security dhcp-bindings delete ip <ip address> vlan <vlan name>

example:
configure ip-security dhcp-bindings delete ip 10.2.2.145 vlan VL2