ENSP 1.3 多网段 DHCP 中继配置：3个 VLAN 跨网段地址池实战 ENSP 1.3 多网段 DHCP 中继配置3个 VLAN 跨网段地址池实战在企业网络架构中多VLAN环境下的IP地址分配一直是网络工程师需要掌握的核心技能。传统的手动配置方式在面对成百上千台终端设备时显得力不从心而DHCP中继技术正是解决这一痛点的关键。本文将带您深入探索华为ENSP模拟器中如何为VLAN 2/3/4三个网段配置DHCP中继实现跨网段自动地址分配的全流程。1. 实验环境准备与拓扑构建在开始配置前我们需要先明确实验环境和网络拓扑。本次实验采用华为ENSP 1.3模拟器主要设备包括1台三层交换机作为DHCP中继设备1台路由器作为DHCP服务器3台PC分别属于VLAN 2/3/4必要的网线连接拓扑结构说明[PC1-VLAN2] --- [SW2] --- [SW1] --- [R1(DHCP Server)] [PC2-VLAN3] --- | | [PC3-VLAN4] --- | |设备接口规划表设备接口IP地址/配置连接对象SW2Eth0/0/1VLAN 2 AccessPC1SW2Eth0/0/2VLAN 3 AccessPC2SW1Gig0/0/1VLAN 4 AccessPC3SW1Gig0/0/2Trunk (允许所有VLAN)SW2SW1Vlanif2192.168.2.254/24-SW1Vlanif3192.168.3.254/24-SW1Vlanif4192.168.4.254/24-R1Gig0/0/0192.168.4.253/24SW1提示在实际配置前建议先在ENSP中绘制好拓扑图并标注各接口配置这样可以避免后续配置时出现混淆。2. 基础网络配置2.1 交换机VLAN与接口配置首先在SW2上创建VLAN并配置接入端口Huawei system-view [Huawei] sysname SW2 [SW2] vlan batch 2 3 4 [SW2] interface Ethernet0/0/1 [SW2-Ethernet0/0/1] port link-type access [SW2-Ethernet0/0/1] port default vlan 2 [SW2-Ethernet0/0/1] quit [SW2] interface Ethernet0/0/2 [SW2-Ethernet0/0/2] port link-type access [SW2-Ethernet0/0/2] port default vlan 3 [SW2-Ethernet0/0/2] quit接下来配置SW1的VLAN和接口Huawei system-view [Huawei] sysname SW1 [SW1] vlan batch 2 3 4 [SW1] interface GigabitEthernet0/0/1 [SW1-GigabitEthernet0/0/1] port link-type access [SW1-GigabitEthernet0/0/1] port default vlan 4 [SW1-GigabitEthernet0/0/1] quit [SW1] interface GigabitEthernet0/0/2 [SW1-GigabitEthernet0/0/2] port link-type trunk [SW1-GigabitEthernet0/0/2] port trunk allow-pass vlan all [SW1-GigabitEthernet0/0/2] quit2.2 三层接口IP配置在SW1上配置各VLAN的接口IP作为各网段的网关[SW1] interface Vlanif 2 [SW1-Vlanif2] ip address 192.168.2.254 24 [SW1-Vlanif2] quit [SW1] interface Vlanif 3 [SW1-Vlanif3] ip address 192.168.3.254 24 [SW1-Vlanif3] quit [SW1] interface Vlanif 4 [SW1-Vlanif4] ip address 192.168.4.254 24 [SW1-Vlanif4] quit路由器R1的基础配置Huawei system-view [Huawei] sysname R1 [R1] interface GigabitEthernet0/0/0 [R1-GigabitEthernet0/0/0] ip address 192.168.4.253 24 [R1-GigabitEthernet0/0/0] quit3. DHCP服务器与中继配置3.1 DHCP服务器配置在R1上配置DHCP服务并创建三个地址池[R1] dhcp enable [R1] ip pool vlan2 [R1-ip-pool-vlan2] network 192.168.2.0 mask 24 [R1-ip-pool-vlan2] gateway-list 192.168.2.254 [R1-ip-pool-vlan2] dns-list 114.114.114.114 [R1-ip-pool-vlan2] quit [R1] ip pool vlan3 [R1-ip-pool-vlan3] network 192.168.3.0 mask 24 [R1-ip-pool-vlan3] gateway-list 192.168.3.254 [R1-ip-pool-vlan3] dns-list 114.114.114.114 [R1-ip-pool-vlan3] quit [R1] ip pool vlan4 [R1-ip-pool-vlan4] network 192.168.4.0 mask 24 [R1-ip-pool-vlan4] gateway-list 192.168.4.254 [R1-ip-pool-vlan4] dns-list 114.114.114.114 [R1-ip-pool-vlan4] quit启用全局DHCP服务[R1] interface GigabitEthernet0/0/0 [R1-GigabitEthernet0/0/0] dhcp select global [R1-GigabitEthernet0/0/0] quit3.2 DHCP中继配置在SW1上启用DHCP中继功能[SW1] dhcp enable [SW1] interface Vlanif 2 [SW1-Vlanif2] dhcp select relay [SW1-Vlanif2] dhcp relay server-ip 192.168.4.253 [SW1-Vlanif2] quit [SW1] interface Vlanif 3 [SW1-Vlanif3] dhcp select relay [SW1-Vlanif3] dhcp relay server-ip 192.168.4.253 [SW1-Vlanif3] quit [SW1] interface Vlanif 4 [SW1-Vlanif4] dhcp select relay [SW1-Vlanif4] dhcp relay server-ip 192.168.4.253 [SW1-Vlanif4] quit4. 验证与排错4.1 PC端获取IP验证在各PC上执行DHCP获取命令PC ipconfig /renew查看获取的IP信息PC ipconfig IPv4 address......................: 192.168.2.100 Subnet mask.......................: 255.255.255.0 Gateway...........................: 192.168.2.254 DNS server........................: 114.114.114.1144.2 设备端验证命令在R1上查看地址池分配情况R1 display ip pool name vlan2 used在SW1上查看DHCP中继状态SW1 display dhcp relay statistics interface Vlanif 24.3 常见问题排查问题1PC无法获取IP地址排查步骤检查物理连接和VLAN配置验证DHCP中继配置是否正确检查DHCP服务器地址池是否配置正确使用display dhcp relay statistics查看中继报文统计问题2获取的IP地址不在预期范围内可能原因地址池配置错误中继指向了错误的DHCP服务器存在多个DHCP服务器干扰5. 高级配置与优化5.1 DHCP安全增强为防止非法DHCP服务器干扰可以启用DHCP Snooping[SW2] dhcp snooping enable [SW2] interface Ethernet0/0/1 [SW2-Ethernet0/0/1] dhcp snooping enable [SW2-Ethernet0/0/1] quit [SW2] interface Ethernet0/0/2 [SW2-Ethernet0/0/2] dhcp snooping enable [SW2-Ethernet0/0/2] quit5.2 地址租约管理调整地址租约时间以适应不同场景[R1] ip pool vlan2 [R1-ip-pool-vlan2] lease day 0 hour 8 [R1-ip-pool-vlan2] quit5.3 保留地址配置为特定设备分配固定IP[R1] ip pool vlan2 [R1-ip-pool-vlan2] static-bind ip-address 192.168.2.100 mac-address 5489-9851-036e [R1-ip-pool-vlan2] quit在实际项目部署中我发现DHCP中继配置最容易出错的地方往往在于VLAN接口的IP地址与DHCP地址池的网关地址不一致。曾经在一个客户现场因为SW1上Vlanif3的IP配置为192.168.3.254而DHCP地址池中却误配为192.168.3.253导致VLAN3的设备始终无法正常获取IP。通过display current-configuration interface Vlanif3和display ip pool name vlan3命令对比才发现了这个细微但关键的区别。