![Icon [all products]](https://www.thunder-link.com/tl-content/uploads/2022/05/Icon-all-products-1.svg "Icon [all products]"){kind=icon}
All productsAbstract
As we know Dynamic Host Configuration Protocol (DHCP) works in the client/server mode. The DHCP client can dynamically request the configuration data and the DHCP server can provide the data for the client.
MA5800 OLT supports DHCP Layer 2 and Layer 3 relay as well as DHCP Option82 to ensure DHCP security. In this article, we will focus on DHCP Option82 guide in terms of dhcp option82 function, parameters, modes, and etc.
Function: dhcp option82(profile-mode)
This command is used to enable or disable the DHCP option82 feature. The DHCP feature does not have any mechanism for authentication or security. Thus, the DHCP feature encounters many security problems when it is used in the network. To solve these problems, the DHCP option82is introduced. After the DHCP option82 feature is enabled, the BRAS can authenticate IDs of access users. After the DHCP option82 feature is disabled, the device does not process packets.
NOTE:
Disabling the DHCP Option82 feature will cause security risks. You are advised to enable it.
Format
In global config mode:
dhcp option82 { enable | disable | forward | rebuild }
dhcp option82 board frameid/slotid { enable | disable }
dhcp option82 port frameid/slotid/portid { enable | disable }
dhcp option82 port frameid/slotid/portid ont ontid gemport gemindex { enable | disable }
dhcp option82 port frameid/slotid/portid epon ontid { enable | disable }
In VLAN Service-profile mode:
dhcp option82 { enable | disable }
Parameters
| Parameter | Description | Value |
| port frameid/slotid/portid | Indicates the subrack ID, slot ID, and port ID. Enter a slash (/) between the subrack, slot, and port IDs. When you need to enable or disable the DHCP option82 feature for a physical port on a board, use this parameter. | Please see Differences Between Shelves. |
| board frameid/slotid | Indicates the subrack ID and slot ID. Enter a slash (/) between the subrack and slot IDs. When you need to enable or disable the DHCPoption82 feature for all ports on a board, use this parameter. | Please see Differences Between Shelves. |
| ont ontid | Indicates the ONT number. To enable or disable the DHCP option 82 function for a specific ONT, use this parameter. | Numeral type. Range: varies with the board type. |
| gemport gemindex | Indicates a GEM port ID. GEM ports of each PON port are numbered in a centralized way. | Numeral type. Range: 0-1023. |
| epon ontid | Indicates the ID of the ONT that is connected to the EPON port. | Numeral type. Range: varies with the board type. |
| enable | Enables the DHCP option82 feature. The option82 is an option of the DHCP packet. Its code is 82, which is used to identify the user. After the feature is enabled, the DHCP server can allocate IP addresses for users based on this DHCP option82 option and avoid the spoofing attacks to the DHCP server, such as the DHCP IP exhaustion.
For details, see the “Usage Guidelines.” |
– |
| disable | Disables the DHCP option82 feature. After the feature is disabled, the DHCP server does not process the option82 information for packets, and the packet is directly forwarded. | – |
| forward | Enables the DHCP option82 transparent transmission feature. DHCP option 82 is an option with the code 82 and is used to identify the physical location information of a user.
For details, see the “Usage Guidelines.” |
– |
| rebuild | Indicates the DHCP option 82 rebuild feature. It is used with the RAIO BBF, VNPT, CNTEL-XPON mode (configured by running the raio-modecommand) or user-defined format (configured by running the raio-format(profile-mode) command).
For details, see the “Usage Guidelines.” |
– |
Modes
Global config mode, VLAN service-profile mode
Usage Guidelines
The DHCP option82 can be configured at three levels: global level, port level, and VLAN level (configured in VLAN service profile).
- In global config mode, run thevlan service-profile command to enter the VLAN service-profile mode.
- By default, the DHCPoption82 at the global level is disabled, and the DHCP option82 at the port level and VLAN level is enabled.
- To enable or disable a port, or enable the DHCPoption82 transparent transmission feature for a port on a board, ensure that the board is not a control board and is in the normal or offline state.
- The network-side and user-side DHCP packet processing policy depends on whether DHCPoption82 is enabled and whether the user-side DHCP packets are allowed to carry the option82 information on a service port.
- The enabling status of DHCPoption82 depends on the status with the highest priority. Priorities of all levels of DHCP option82 are as follows: disable > rebuild > forward > enable. There are no priorities between global configuration and port-based configuration of DHCP option82. When DHCP option82 is disabled for a port whereas it is enabled both globally and for the service flow, DHCP option82 is disabled.
- Run thedhcp-option82 permit-forwarding service-port command to set whether user-side DHCP packets are allowed to carry the option82information on a service port. The policy of user-side DHCP packet processing of MA5800 is as follows:
| Enabling Status of DHCP option 82 | Whether the User-side DHCP Packets Are Allowed to Carry the option 82 Information on a Service Port | Whether the Packets Carry the option 82 Information | Processing Policy of the MA5800for the user-side DHCP packets | Processing Policy of the MA5800for the network-side DHCP packets | |
| enable | enable | Yes | The MA5800 removes the option 82 information carried in the user-side DHCP packets and adds the information about the local user to the packets. | If the network-side DHCP packets carry the option 82 information that added by the MA5800, the MA5800removes the option 82 information. Otherwise, the MA5800 directly forwards network-side DHCP packets without any processing. | |
| No | The MA5800 adds the information about the local user to the user-side DHCP packets. | The MA5800 directly forwards network-side DHCP packets without any processing. | |||
| disable | Yes | The MA5800 directly discards user-side DHCP packets. | The option 82 tag carried in the DHCP packet is removed. | ||
| No | The MA5800 adds the information about the local user to the user-side DHCP packets. | The MA5800 directly forwards network-side DHCP packets without any processing. | |||
| forward | enable | Yes | The MA5800 directly forwards user-side DHCP packets without any processing. | If the network-side DHCP packets carry the option 82 information that added by the MA5800, the MA5800removes the option 82 information. Otherwise, the MA5800 directly forwards network-side DHCP packets without any processing. | |
| No | The MA5800 adds the information about the local user to the user-side DHCP packets. | The MA5800 directly forwards network-side DHCP packets without any processing. | |||
| disable | Yes | The MA5800 directly discards user-side DHCP packets. | The option 82 tag carried in the DHCP packet is removed. | ||
| No | The MA5800 adds the information about the local user to the user-side DHCP packets. | The MA5800 directly forwards network-side DHCP packets without any processing. | |||
| rebuild | enable | Yes | The MA5800 rebuilds Tag to the user-side DHCP packets. | If the network-side DHCP packets carry the option 82 information that added by the MA5800, the MA5800removes the option 82 information. Otherwise, the MA5800 directly forwards network-side DHCP packets without any processing. | |
| No | The MA5800 rebuilds Tag to the user-side DHCP packets. | The MA5800 directly forwards network-side DHCP packets without any processing. | |||
| disable | Yes | The MA5800 directly discards user-side DHCP packets. | The option 82 tag carried in the DHCP packet is removed. | ||
| No | The MA5800 rebuilds Tag to the user-side DHCP packets. | The MA5800 directly forwards network-side DHCP packets without any processing. | |||
| disable | Any value | Any value | The MA5800 directly forwards user-side DHCP packets without any processing. | The MA5800 directly forwards network-side DHCP packets without any processing. |
- Principle for DHCP option82 based on Layer2 mode: In Layer2 mode, by default, the DHCP option82 feature of the device is disabled. In this case, the device does not capture DHCP packets. All DHCP packets are broadcast or unicast freely in the VLAN and the interaction between the client and server is free from any interference. If the DHCP option82 feature is enabled in Layer2 mode, related stream rules for capturing DHCP packets will be added to each board and the LAN switch.
- Principle for DHCP option82 based on Layer3 mode: Its principle is the same as that of the DHCP option82 feature in Layer2 mode. The device adds the extra option82 field to the packet when forwarding the packet.
After reading this article, hope you can better understand DHCP setting on OLT. Please be informed that DHCP parameters involve all equipments while OLT is only functional as the transparent transmission channel.
If any questions regarding Fiberhome FTTx solution or technical problem, please kindly contact our professional and experienced team: sales@thunder-link.com