如何让接入层的交换机每个端口只能回去DHCP里面的一个IP

您好，做ip+mac绑定

根据交换机的端口分配固定地址的解决方法：
技术原理：开启DHCP Snooping的option82策略分配。为交换机每一个端口做一个option82的类标记，DHCP服务器根据option82的类标记分配固定地址。

这里以H3C交换机为例，为VLAN 10中的终端分配地址：
希望交换机端口1-24依次分配固定地址172.16.10.1-172.16.10.24/24的地址。

1、创建DHCP服务器并做option82类标记：
[H3C]dhcp enable
[H3C]dhcp server ip-pool vlan10
[H3C-dhcp-pool-vlan10]network 172.16.10.0 mask 255.255.255.0
[H3C-dhcp-pool-vlan10]gateway-list 172.16.10.254
[H3C-dhcp-pool-vlan10]dns-list 114.114.114.114
[H3C-dhcp-pool-vlan10]expired day 0 hour 2
[H3C-dhcp-pool-vlan10]class port1 range 172.16.10.1 172.16.10.1 #类port1标记地址172.16.10.1
[H3C-dhcp-pool-vlan10]class port2 range 172.16.10.2 172.16.10.2
[H3C-dhcp-pool-vlan10]class port3 range 172.16.10.3 172.16.10.3
[H3C-dhcp-pool-vlan10]class port4 range 172.16.10.4 172.16.10.4
[H3C-dhcp-pool-vlan10]quit

[H3C]interface range Ethernet 1/0/1 to Ethernet 1/0/4
[H3C-if-range]port link-type access
[H3C-if-range]port access vlan 10
[H3C-if-range]quit
[H3C]interface Vlan-interface 10
[H3C-Vlan-interface10]ip address 172.16.10.254 24
[H3C-Vlan-interface10]dhcp select server #开启dhcp服务

2、配置option82的参数信息：
[H3C]dhcp class port1
[H3C-dhcp-class-port1]if-match rule 1 option 82 hex 706f727431 offset 2 length 5
[H3C-dhcp-class-port1]quit
#hex代表十六进制；"706f727431"是十六进制值，转换后字符就是“port1”，如下同理；"offset 2 length 5"指的是option允许偏移量2，十六进制字符串长度为5。
在线转换网址：***.***/hexadecimal.html
[H3C]dhcp class port2
[H3C-dhcp-class-port2]if-match rule 1 option 82 hex 706f727432 offset 2 length 5
[H3C-dhcp-class-port2]quit
[H3C]dhcp class port3
[H3C-dhcp-class-port3]if-match rule 1 option 82 hex 706f727433 offset 2 length 5
[H3C-dhcp-class-port3]quit
[H3C]dhcp class port4
[H3C-dhcp-class-port4]if-match rule 1 option 82 hex 706f727434 offset 2 length 5
[H3C-dhcp-class-port4]quit

3、配置端口与类的关系：
[H3C]dhcp snooping enable #全局开启dhcp snooping功能
[H3C]interface Ethernet 1/0/1 #端口启用dhcp snooping支持option82功能，并配置circuit-id为port1
[H3C-Ethernet1/0/1]dhcp snooping information enable #开启支持option82字段功能
[H3C-Ethernet1/0/1]dhcp snooping information circuit-id string port1 #string后面是自定义字符
[H3C-Ethernet1/0/1]quit
[H3C]interface Ethernet 1/0/2
[H3C-Ethernet1/0/2]dhcp snooping information enable
[H3C-Ethernet1/0/2]dhcp snooping information circuit-id string port2
[H3C-Ethernet1/0/2]quit
[H3C]interface Ethernet 1/0/3
[H3C-Ethernet1/0/3]dhcp snooping information enable
[H3C-Ethernet1/0/3]dhcp snooping information circuit-id string port3
[H3C-Ethernet1/0/3]quit
[H3C]interface Ethernet 1/0/4
[H3C-Ethernet1/0/4]dhcp snooping information enable
[H3C-Ethernet1/0/4]dhcp snooping information circuit-id string port4
[H3C-Ethernet1/0/4]quit
----------------------------------------------------------------------------------------
4、插交换机4口测试如下：
terminal debugging
terminal monitor
debugging dhcp snooping information
*Oct 19 16:37:38:201 2019 H3C DHCPSP4/7/INFO: Received packet: Option 82 offset is 0, Option 82 handling strategy is Replace.
*Oct 19 16:37:38:201 2019 H3C DHCPSP4/7/INFO: Fill circuit-id in padding format string: Length is 7.
*Oct 19 16:37:38:201 2019 H3C DHCPSP4/7/INFO: Fill remote-id in padding format normal: Length is 10.
*Oct 19 16:37:38:201 2019 H3C DHCPSP4/7/INFO: Recalculated IP and UDP checksum.
*Oct 19 16:37:38:790 2019 H3C DHCPSP4/7/INFO: Stripping Option 82 succeeded: offset is 331, stripped length is 19.
*Oct 19 16:37:38:790 2019 H3C DHCPSP4/7/INFO: Padded packet: padded length is 14.
*Oct 19 16:37:38:790 2019 H3C DHCPSP4/7/INFO: Recalculated IP and UDP checksum.
*Oct 19 16:37:38:792 2019 H3C DHCPSP4/7/INFO: Received packet: Option 82 offset is 0, Option 82 handling strategy is Replace.
*Oct 19 16:37:38:792 2019 H3C DHCPSP4/7/INFO: Fill circuit-id in padding format string: Length is 7.
*Oct 19 16:37:38:792 2019 H3C DHCPSP4/7/INFO: Fill remote-id in padding format normal: Length is 10.
*Oct 19 16:37:38:792 2019 H3C DHCPSP4/7/INFO: Recalculated IP and UDP checksum.
*Oct 19 16:37:38:795 2019 H3C DHCPSP4/7/INFO: Stripping Option 82 succeeded: offset is 331, stripped length is 19.
*Oct 19 16:37:38:795 2019 H3C DHCPSP4/7/INFO: Padded packet: padded length is 14.
*Oct 19 16:37:38:795 2019 H3C DHCPSP4/7/INFO: Recalculated IP and UDP checksum.

display arp all
Type: S-Static D-Dynamic O-Openflow R-Rule M-Multiport I-Invalid
IP address MAC address VLAN/VSI Interface Aging Type
172.16.10.4 b00c-d16b-c771 10 Eth1/0/4 1191 D
————————————————
版权声明：本文为CSDN博主「zdl244」的原创文章，遵循CC 4.0 BY-SA版权协议，转载请附上原文出处链接及本声明。
原文链接：https://blog.csdn.net/zdl244/article/details/103172986

配置端口安全，每个接口最大学习MAC数量为1