Cisco MARS Configuration

For Cisco IPS 5.x, 6.x, and 7.x devices, MARS pulls the logs using SDEE over SSL. Therefore, MARS must have HTTPS access to the sensor. In order to prepare the sensor, you must enable the HTTP server on the sensor, enable TLS to allow HTTPS access, and make sure that the IP address of MARS is defined as an allowed host, one that can access the sensor and pull events. If the sensors have been configured to allow access from limited hosts or subnets on the network, you can use the access-list ip_address/netmask command in order to enable this access.
Components Used
The information in this document is based on these software and hardware versions:

• Cisco Secure MARS Device that runs software version 4.2.x and later
• Cisco 4200 Series IPS Device that runs software version 6.0 and later

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.
Related Products
This configuration can also be used with these sensors:

• IPS-4240
• IPS-4255
• IPS-4260
• IPS-4270-20

Configure
In this section, you are presented with the information on how to add and configure a Cisco Secure Intrusion Prevention System (IPS) sensor to a Cisco Security Monitoring, Analysis, and Response System (CS-MARS) device.
Add and Configure a Cisco IPS 6.x or 7.x Device in MARS
When you define a Cisco IPS 6.x or 7.x device in MARS, you can discover any virtual sensors configured on the device. When you discover these virtual sensors, this allows MARS to separate the reported events by virtual sensor. It also allows you to tune the list of monitored networks to each virtual sensor, which improves the accuracy of the desired reporting.
Complete these steps in order to add and configure a Cisco IPS 6.x or 7.x device in MARS:

1. Choose Admin > System Setup > Security and Monitor Devices. Then, click on Add.
2. Choose Cisco IPS 6.x or Cisco IPS 7.x from the Device Type list. Now enter the hostname of the sensor in the Device Name field as shown here. IPS1 is the Device Name used in this example. The Device Name value must be identical to the configured sensor name.
   
   
   Now enter the administrative IP address in the Reporting IP field. The Reporting IP address is the same address as the administrative IP address.
3. In the Login field, enter the username associated with the administrative account that is used to access the reporting device. Now, in the Password field, enter the password associated with the username specified in the Login field. The username is cisco and the password used is cisco123 in this example. Also enter the TCP port number on which the webserver running on the sensor listens in the Port field. The default HTTPS port is 443.
   
   
   Note: While it is possible to configure HTTP only, MARS requires HTTPS.
4. Now verify that NO is chosed in the Monitor Resource Usage list. While the Monitor Resource Usage option appears on this page, it does not function for Cisco IPS.
   
   
5. In order to pull the IP logs from the sensor, choose Yes from the Pull IP Logs list. This is an optional feature, which can be used if required.
   
   
   This setting applies to the entire sensor, which includes those logs generated for virtual sensors alerts.
6. Click Test Connectivity in order to verify the configuration and enable the discovery of virtual sensors.
   
   
7. Click Discover in order to discover any defined virtual sensors.
   
   
   Note: MARS is unaware of changes made to the sensor. Anytime you make changes to the virtual sensor settings, you must click Discover on that sensor configuration page in order to refresh the virtual sensor details in MARS.
8. Choose the checkbox next to the Virtual Sensor Name and click Edit in order to define the monitored networks for each virtual sensor. Now the IPS Module page appears as shown here.
   
   
9. For attack path calculation and mitigation, specify the networks being monitored by the sensor. Choose the Define a Network radio button in order to manually define the network. Then complete these steps in order to define a Network:
   1. Enter the network address in the Network IP field.
   2. Enter the corresponding network mask value in the Mask field.
   3. Click Add in order to move the specified network into the Monitored Networks field.
   4. Repeat the previous steps if there is a need to define more networks.
      
      
      Note: This is an optional feature available and can be skipped if not required.
10. Click the Select a Network radio button in order select the networks that are attached to the device. Then complete these steps in order to choose the networks:
    1. Choose a network from the Select a Network list.
    2. Click Add in order to move the specified network into the Monitored Networks field.
    3. Repeat the previous steps if there is a need to choose more networks.
       
       
       Note: This is an optional feature available and can be skipped if not required.
11. Repeat step 8 through step 10 for each virtual sensor.
12. Click Submit in order to save your changes. The device name appears under the Security and Monitoring Information list. The submit operation records the changes in the database tables. But, it does not load the changes into working memory of the MARS Appliance. The activate operation loads submitted changes into working memory.
13. Click Activate in order to enable MARS to start to sessionize events from this device.
    MARS begins to sessionize events generated by this module and evaluate those events using the defined inspection and drop rules. Any events published by the device to MARS before activation can be queried with the reporting IP address of the device as a match criterion..

Verify that MARS Pulls Events from a Cisco IPS Device
It is common to create benign events on the network in order to verify the data flow. Complete these steps in order to verify the data flow between a Cisco IPS device and MARS:

1. On the Cisco IPS device, enable and alert on the signatures 2000 and 2004. The signatures monitor ICMP messages (pings).
2. Ping a device on the subnet on which the Cisco IPS device is listening. The events are generated and pulled by MARS.
3. Verify that the events appear in the MARS web interface. You can perform a query with the Cisco IPS device.
4. Once the dataflow is verified, you can disable the 2000 and 2004 signatures on the Cisco IPS device.

Note: If the Test Connectivity operation does not fail during the configuration of a Cisco IPS device in the MARS web interface, then communications are enabled. This task allows you to further verify the alerts are generated and pulled correctly.

Configuring DHCP

DHCP supports three mechanisms for IP address allocation:

•Automatic allocation—DHCP assigns a permanent IP address to a client.

•Dynamic allocation—DHCP assigns an IP address to a client for a limited period of time (or until the client explicitly relinquishes the address).

•Manual allocation—The network administrator assigns an IP address to a client and DHCP is used simply to convey the assigned address to the client.

The format of DHCP messages is based on the format of Bootstrap Protocol (BOOTP) messages, which ensures support for BOOTP relay agent functionality and interoperability between BOOTP clients and DHCP Servers. BOOTP relay agents eliminate the need for deploying a DHCP Server on each physical network segment. BOOTP is explained in RFC 951, Bootstrap Protocol (BOOTP), and RFC 1542, Clarifications and Extensions for the Bootstrap Protocol.

To identify the hardware platform or software image information associated with a feature, use the Feature Navigator on Cisco.com to search for information about the feature or refer to the software release notes for a specific release. For more information, see the "Identifying Supported Platforms" section in the "Using Cisco IOS Software" chapter in this book.

DHCP Server Overview

The Cisco IOS DHCP Server feature is a full DHCP Server implementation that assigns and manages IP addresses from specified address pools within the router to DHCP clients. If the Cisco IOS DHCP Server cannot satisfy a DHCP request from its own database, it can forward the request to one or more secondary DHCP Servers defined by the network administrator.

the basic steps that occur when a DHCP client requests an IP address from a DHCP Server. The client, Host A, sends a DHCPDISCOVER broadcast message to locate a Cisco IOS DHCP Server. A DHCP Server offers configuration parameters (such as an IP address, a MAC address, a domain name, and a lease for the IP address) to the client in a DHCPOFFER unicast message.

Note A DHCP client may receive offers from multiple DHCP Servers and can accept any one of the offers; however, the client usually accepts the first offer it receives. Additionally, the offer from the DHCP Server is not a guarantee that the IP address will be allocated to the client; however, the server usually reserves the address until the client has had a chance to formally request the address.

 

The client returns a formal request for the offered IP address to the DHCP Server in a DHCPREQUEST broadcast message. The DHCP Server confirms that the IP address has been allocated to the client by returning a DHCPACK unicast message to the client.

 

Note The formal request for the offered IP address (the DHCPREQUEST message) that is sent by the client is broadcast so that all other DHCP Servers that received the DHCPDISCOVER broadcast message from the client can reclaim the IP addresses that they offered to the client.

If the configuration parameters sent to the client in the DHCPOFFER unicast message by the DHCP Server are invalid (a misconfiguration error exists), the client returns a DHCPDECLINE broadcast message to the DHCP Server.

The DHCP Server will send to the client a DHCPNAK denial broadcast message, which means the offered configuration parameters have not been assigned, if an error has occurred during the negotiation of the parameters or the client has been slow in responding to the DHCPOFFER message (the DHCP Server assigned the parameters to another client) of the DHCP Server.

 

DHCP defines a process by which the DHCP Server knows the IP subnet in which the DHCP client resides, and it can assign an IP address from a pool of valid IP addresses in that subnet.

The DHCP Server identifies which DHCP address pool to use to service a client request as follows:

•If the client is not directly connected (the gi-addr field of the DHCPDISCOVER broadcast message is non-zero), the DHCP Server matches the DHCPDISCOVER with a DHCP pool that has the subnet that contains the IP address in the gi-addr field.

•If the client is directly connected (the gi-addr field is zero), the DHCP Server matches the DHCPDISCOVER with DHCP pool(s) that contain the subnet(s) configured on the receiving interface. If the interface has secondary IP addresses, the subnets associated with the secondary IP addresses are examined for possible allocation only after the subnet associated with the primary IP address (on the interface) is exhausted.

The Cisco IOS DHCP Server feature offers the following benefits:

•Reduced Internet access costs

Using automatic IP address assignment at each remote site substantially reduces Internet access costs. Static IP addresses are considerably more expensive to purchase than are automatically allocated IP addresses.

•Reduced client configuration tasks and costs

Because DHCP is easy to configure, it minimizes operational overhead and costs associated with device configuration tasks and eases deployment by nontechnical users.

•Centralized management

Because the DHCP Server maintains configurations for several subnets, an administrator only needs to update a single, central server when configuration parameters change.

Before you configure the Cisco IOS DHCP Server feature, complete the following tasks:

•Identify an external File Transport Protocol (FTP), Trivial File Transfer Protocol (TFTP), or remote copy protocol (rcp) server that you will use to store the DHCP bindings database.

•Identify the IP addresses that you will enable the DHCP Server to assign, and the IP addresses that you will exclude.

•Identify DHCP options for devices where necessary, including the following:

–Default boot image name

–Default routers

–Domain Name System (DNS) servers

–NetBIOS name server

•Decide on a NetBIOS node type (b, p, m, or h).

•Decide on a DNS domain name.

DHCP Client Overview

The Cisco IOS DHCP client now enables you to obtain an IP address from a DHCP Server dynamically using the DHCP protocol as specified in RFC 2131. In Cisco IOS Release 12.2, only Ethernet interfaces are supported; work is in progress to support all interface types. The Cisco IOS DHCP client offers the following benefits:

•Reduces time to configure and deploy

•Reduces the number of configuration errors

•Enables customers to centrally control the IP address assigned to a Cisco IOS router

DHCP Relay Agent Overview

A DHCP relay agent is any host that forwards DHCP packets between clients and servers. Relay agents are used to forward requests and replies between clients and servers when they are not on the same physical subnet. Relay agent forwarding is distinct from the normal forwarding of an IP router, where IP datagrams are switched between networks somewhat transparently. Relay agents receive DHCP messages and then generate a new DHCP message to send out on another interface.

The Cisco IOS DHCP relay agent supports the use of unnumbered interfaces. The DHCP relay agent automatically adds a static host route specifying the unnumbered interface as the outbound interface.

DHCP Configuration Task List

The DHCP Server database is organized as a tree. The root of the tree is the address pool for natural networks, branches are subnetwork address pools, and leaves are manual bindings to clients. Subnetworks inherit network parameters and clients inherit subnetwork parameters. Therefore, common parameters, for example the domain name, should be configured at the highest (network or subnetwork) level of the tree.

 

Note Inherited parameters can be overridden. For example, if a parameter is defined in both the natural network and a subnetwork, the definition of the subnetwork is used.

Address leases are not inherited. If a lease is not specified for an IP address, by default, the DHCP Server assigns a one-day lease for the address.

 

To configure the Cisco IOS DHCP Server feature, perform the tasks described in the following sections. First configure a database agent or disable conflict logging, then specify IP addresses that the DHCP Server should not assign (excluded addresses) and should assign (a pool of available IP addresses) to requesting clients. The tasks in the first three sections are required. The tasks in the remaining sections are optional.

•Enabling the Cisco IOS DHCP Server and Relay Agent Features (Optional)

•Configuring a DHCP Database Agent or Disabling DHCP Conflict Logging (Required)

•Excluding IP Addresses (Required)

•Configuring a DHCP Address Pool (Required)

•Configuring Manual Bindings (Optional)

•Configuring a DHCP Server Boot File (Optional)

•Configuring the Number of Ping Packets (Optional)

•Configuring the Timeout Value for Ping Packets (Optional)

•Enabling the Cisco IOS DHCP Client on Ethernet Interfaces (Optional)

•Configuring DHCP Server Options Import and Auto configuration (Optional)

•Configuring the Relay Agent Information Option in BOOTREPLY Messages (Optional)

•Configuring a Relay Agent Information Reforwarding Policy (Optional)

•Enabling the DHCP Smart-Relay Feature (Optional)

Enabling the Cisco IOS DHCP Server and Relay Agent Features

By default, the Cisco IOS DHCP server and relay agent features are enabled on your router. To re-enable these features if they are disabled, use the following command in global configuration mode:

Command	Purpose
Router(config)# service dhcp	Enables the Cisco IOS DHCP server and relay features on your router. Use the no form of this command to disable the Cisco IOS DHCP server and relay features.

 

Configuring a DHCP Database Agent or Disabling DHCP Conflict Logging

A DHCP database agent is any host—for example, an FTP, TFTP, or rcp server—that stores the DHCP bindings database. You can configure multiple DHCP database agents and you can configure the interval between database updates and transfers for each agent. To configure a database agent and database agent parameters, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp database url [timeout seconds | write-delay seconds]	Configures the database agent and the interval between database updates and database transfers.

 

If you choose not to configure a DHCP database agent, disable the recording of DHCP address conflicts on the DHCP Server. To disable DHCP address conflict logging, use the following command in global configuration mode:

Command	Purpose
Router(config)# no ip dhcp conflict logging	Disables DHCP address conflict logging.

 

Excluding IP Addresses

The DHCP Server assumes that all IP addresses in a DHCP address pool subnet are available for assigning to DHCP clients. You must specify the IP address that the DHCP Server should not assign to clients. To do so, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp excluded-address low-address [high-address]	Specifies the IP addresses that the DHCP Server should not assign to DHCP clients.

 

Configuring a DHCP Address Pool

You can configure a DHCP address pool with a name that is a symbolic string (such as "engineering") or an integer (such as 0). Configuring a DHCP address pool also places you in DHCP pool configuration mode—identified by the (dhcp-config)# prompt—from which you can configure pool parameters (for example, the IP subnet number and default router list). To configure a DHCP address pool, complete the required tasks in the following sections.

Configuring the DHCP Address Pool Name and Entering DHCP Pool Configuration Mode

To configure the DHCP address pool name and enter DHCP pool configuration mode, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp pool name	Creates a name for the DHCP Server address pool and places you in DHCP pool configuration mode (identified by the dhcp-config# prompt).

 

Configuring the DHCP Address Pool Subnet and Mask

To configure a subnet and mask for the newly created DHCP address pool, which contains the range of available IP addresses that the DHCP Server may assign to clients, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# network network-number [mask | /prefix-length]	Specifies the subnet network number and mask of the DHCP address pool. The prefix length specifies the number of bits that comprise the address prefix. The prefix is an alternative way of specifying the network mask of the client. The prefix length must be preceded by a forward slash (/).

 

 

Note You can not configure manual bindings within the same pool that is configured with the network command. To configure manual bindings, see the "Configuring Manual Bindings" section.

 

Configuring the Domain Name for the Client

The domain name for a DHCP client places the client in the general grouping of networks that make up the domain. To configure a domain name string for the client, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# domain-name domain	Specifies the domain name for the client.

 

Configuring the IP Domain Name System Servers for the Client

DHCP clients query DNS IP servers when they need to correlate host names to IP addresses. To configure the DNS IP servers that are available to a DHCP client, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# dns-server address [address2 ... address8]	Specifies the IP address of a DNS server that is available to a DHCP client. One IP address is required; however, you can specify up to eight IP addresses in one command line.

 

Configuring the NetBIOS Windows Internet Naming Service Servers for the Client

Windows Internet Naming Service (WINS) is a name resolution service that Microsoft DHCP clients use to correlate host names to IP addresses within a general grouping of networks. To configure the NetBIOS WINS servers that are available to a Microsoft DHCP client, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# netbios-name-server address [address2 ... address8]	Specifies the NetBIOS WINS server that is available to a Microsoft DHCP client. One address is required; however, you can specify up to eight addresses in one command line.

 

Configuring the NetBIOS Node Type for the Client

The NetBIOS node type for Microsoft DHCP clients can be one of four settings: broadcast, peer-to-peer, mixed, or hybrid. To configure the NetBIOS node type for a Microsoft DHCP, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# netbios-node-type type	Specifies the NetBIOS node type for a Microsoft DHCP client.

 

Configuring the Default Router for the Client

After a DHCP client has booted, the client begins sending packets to its default router. The IP address of the default router should be on the same subnet as the client. To specify a default router for a DHCP client, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# default-router address [address2 ... address8]	Specifies the IP address of the default router for a DHCP client. One IP address is required; however, you can specify up to eight addresses in one command line.

 

Configuring the Address Lease Time

By default, each IP address assigned by a DHCP Server comes with a one-day lease, which is the amount of time that the address is valid. To change the lease value for an IP address, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# lease {days [hours][minutes] | infinite}	Specifies the duration of the lease. The default is a one-day lease. •Use the show ip dhcp binding to display the lease expiration time and date of the IP address of the host.

 

Configuring Manual Bindings

An address binding is a mapping between the IP address and MAC address of a client. The IP address of a client can be assigned manually by an administrator or assigned automatically from a pool by a DHCP server.

Manual bindings are IP addresses that have been manually mapped to the MAC addresses of hosts that are found in the DHCP database. Manual bindings are stored in NVRAM on the DHCP server. Manual bindings are just special address pools. There is no limit on the number of manual bindings, but you can only configure one manual binding per host pool.

Automatic bindings are IP addresses that have been automatically mapped to the MAC addresses of hosts that are found in the DHCP database. Automatic bindings are stored on a remote host called a database agent. The bindings are saved as text records for easy maintenance.

All DHCP clients send a client identifier (DHCP option 61) in the DHCP packet. To configure manual bindings, you must enter the client-identifier DHCP pool configuration command with the appropriate hexadecimal values identifying the DHCP client.

To configure a manual binding, first create a host pool, then specify the IP address of the client and client identifier or hardware address.

To configure manual bindings, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	Router(config)# ip dhcp pool name	Creates a name for the a DHCP Server address pool and places you in DHCP pool configuration mode—identified by the (dhcp-config)# prompt.
Step 2	Router(dhcp-config)# host address [mask | /prefix-length]	Specifies the IP address and subnet mask of the client. The prefix length specifies the number of bits that comprise the address prefix. The prefix is an alternative way of specifying the network mask of the client. The prefix length must be preceded by a forward slash (/).
Step 3	Router(dhcp-config)# client-identifier unique-identifier	Specifies the unique identifier for DHCP clients. This command is used for DHCP requests. •DHCP clients require client identifiers. The unique identification of the client is specified in dotted hexadecimal notation, for example, 01b7.0813.8811.66, where 01 represents the Ethernet media type.
Step 4	Router(dhcp-config)# hardware-address hardware-address type	(Optional) Specifies a hardware address for the client. This command is used for BOOTP requests. The type value: •Indicates the protocol of the hardware platform. Strings and values are acceptable. The string options are: –Ethernet –ieee802 •The value options are: –1 10Mb Ethernet –6 IEEE 802 If no type is specified, the default protocol is Ethernet.
Step 5	Router(dhcp-config)# client-name name	(Optional) Specifies the name of the client using any standard ASCII character. The client name should not include the domain name. For example, the name mars should not be specified as mars.cisco.com.

Troubleshooting Tips

You can determine the client identifier by using the debug ip dhcp server packet command. In the following example, the client is identified by the value 0b07.1134.a029.

Router# debug ip dhcp server packet

DHCPD:DHCPDISCOVER received from client 0b07.1134.a029 through relay 10.1.0.253.

DHCPD: assigned IP address 10.1.0.3 to client 0b07.1134.a029.

.

.

.

Configuring a DHCP Server Boot File

The boot file is used to store the boot image for the client. The boot image is generally the operating system the client uses to load. To specify a boot file for the DHCP client, use the following command in DHCP pool configuration mode:

Command	Purpose
Router(dhcp-config)# bootfile filename	Specifies the name of the file that is used as a boot image.

 

Configuring the Number of Ping Packets

By default, the DHCP Server pings a pool address twice before assigning a particular address to a requesting client. If the ping is unanswered, the DHCP Server assumes (with a high probability) that the address is not in use and assigns the address to the requesting client. To change the number of ping packets the DHCP Server should send to the pool address before assigning the address, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp ping packets number	Specifies the number of ping packets the DHCP Server sends to a pool address before assigning the address to a requesting client. The default is two packets. Setting the count argument to a value of 0 turns off DHCP Server ping operation completely.

 

Configuring the Timeout Value for Ping Packets

By default, the DHCP Server waits 500 milliseconds before timing out a ping packet. To change the amount of time the server waits, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp ping timeout milliseconds	Specifies the amount of time the DHCP Server must wait before timing out a ping packet. The default is 500 milliseconds.

 

Enabling the Cisco IOS DHCP Client on Ethernet Interfaces

To acquire an IP address via DHCP on an Ethernet interface, use the following command in interface configuration mode:

Command	Purpose
Router(config-if)# ip address dhcp [client-id interface name] [hostname host-name]	Specifies that the Ethernet interface acquires an IP address through DHCP.

 

Configuring DHCP Server Options Import and Autoconfiguration

The Cisco IOS DHCP server can dynamically configure options such as the DNS and WINS addresses to respond to DHCP requests from local clients behind the customer premises equipment (CPE).

Previously, network administrators needed to manually configure the Cisco IOS DHCP server on each device enabled with this feature. The Cisco IOS DHCP server was enhanced to allow configuration information to be updated automatically. Network administrators can configure one or more centralized DHCP servers to update specific DHCP options within the DHCP pools. The remote servers can request or "import" these option parameters from the centralized servers. See the section "DHCP Server Options Import and Auto configuration Example" later in this chapter for a configuration example.

To configure the central router to update specific DHCP options within the DHCP pools, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	Router(config)# ip dhcp pool name	Creates a name for the a DHCP Server address pool and places you in DHCP pool configuration mode—identified by the (dhcp-config)# prompt.
Step 2	Router(dhcp-config)# network network-number [mask | /prefix-length]	Specifies the subnet network number and mask of the DHCP address pool. The prefix length specifies the number of bits that comprise the address prefix. The prefix is an alternative way of specifying the network mask of the client. The prefix length must be preceded by a forward slash (/).
Step 3	Router(dhcp-config)# dns-server address [address2 ... address8]	Specifies the IP address of a DNS server that is available to a DHCP client. One IP address is required; however, you can specify up to eight IP addresses in one command line.

To configure the remote router to import DHCP options into the DHCP server database, use the following commands beginning in global configuration mode:

	Command	Purpose
Step 1	Router(config)# ip dhcp pool name	Creates a name for the a DHCP Server address pool and places you in DHCP pool configuration mode—identified by the (dhcp-config)# prompt.
Step 2	Router(dhcp-config)# network network-number [mask | /prefix-length]	Specifies the subnet network number and mask of the DHCP address pool. The prefix length specifies the number of bits that comprise the address prefix. The prefix is an alternative way of specifying the network mask of the client. The prefix length must be preceded by a forward slash (/).
Step 3	Router(dhcp-config)# import all	Import DHCP option parameters into the DHCP server database.
Step 4	Router(dhcp-config)# exit	Exits DHCP pool configuration mode.
Step 5	Router(config)# interface type number	Configures an interface and enters interface configuration mode.
Step 6	Router(config-if)# ip address dhcp [client-id interface name] [hostname host-name]	Specifies that the interface acquires an IP address through DHCP.

Configuring the Relay Agent Information Option in BOOTREPLY Messages

To configure the DHCP Server to validate the relay agent information option in forwarded BOOTREPLY messages, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp relay information check	Configures the DHCP Server to check that the relay agent information option in forwarded BOOTREPLY messages is valid.

 

Configuring a Relay Agent Information Reforwarding Policy

To configure a relay agent information reforwarding policy on the DHCP Server (what the DHCP Server should do if a forwarded message already contains relay information), use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp relay information policy {drop | keep |replace}	Determines the relay information reforwarding policy in a cable modem termination system.

 

Enabling the DHCP Smart-Relay Feature

By default, the DHCP smart-relay feature is disabled. To enable the smart-relay functionality, use the following command in global configuration mode:

Command	Purpose
Router(config)# ip dhcp smart-relay	Allows the DHCP relay agent to switch the gateway address (giaddr field of a DHCP packet) to secondary addresses when there is no DHCPOFFER message from a DHCP Server.

 

Monitoring and Maintaining the DHCP Server

To clear DHCP Server variables, use the following commands in privileged EXEC mode, as needed:

Command	Purpose
Router# clear ip dhcp binding {address | *}	Deletes an automatic address binding from the DHCP database. Specifying the address argument clears the automatic binding for a specific (client) IP address, whereas specifying an asterisk (*) clears all automatic bindings.
Router# clear ip dhcp conflict {address | *}	Clears an address conflict from the DHCP database. Specifying the address argument clears the conflict for a specific IP address, whereas specifying an asterisk (*) clears conflicts for all addresses.
Router# clear ip dhcp server statistics	Resets all DHCP Server counters to 0.
Router# clear ip route [vrf vrf-name] dhcp [ip-address]	Removes routes from the routing table added by the Cisco IOS DHCP Server and Relay Agent for the DHCP clients on unnumbered interfaces.

 

To enable DHCP Server debugging, use the following command in privileged EXEC mode:

Command	Purpose
Router# debug ip dhcp server {events | packets | linkage}	Enables debugging on the DHCP Server.

 

To display DHCP Server information, use the following commands in EXEC mode, as needed:

Command	Purpose
Router# show ip dhcp binding [address]	Displays a list of all bindings created on a specific DHCP Server. •Use the show ip dhcp binding to display the lease expiration time and date of the IP address of the host and the number. You can also use this command to display the IP addresses that have already been assigned.
Router# show ip dhcp conflict [address]	Displays a list of all address conflicts recorded by a specific DHCP Server.
Router# show ip dhcp database [url]	Displays recent activity on the DHCP database. Note Use this command in privileged EXEC mode.
Router# show ip dhcp server statistics	Displays count information about server statistics and messages sent and received.
Router# show ip dhcp import	Displays the option parameters that were imported into the DHCP Server database. Imported option parameters are not part of the router configuration and are not saved in NVRAM.
Router# show ip route [vrf vrf-name] dhcp [ip-address]	Displays the routes added to the routing table by the Cisco IOS DHCP Server and Relay Agent.

 

Configuration Examples

This section provides the following configuration examples:

•DHCP Database Agent Configuration Example

•DHCP Address Pool Configuration Example

•Manual Bindings Configuration Example

•Cisco IOS DHCP Client Example

•DHCP Server Options Import and Auto configuration Example

DHCP Database Agent Configuration Example

The following example stores bindings on host 172.16.4.253. The file transfer protocol is FTP. The server should wait 2 minutes (120 seconds) before writing database changes.

ip dhcp database ftp://user:password@172.16.4.253/router-dhcp write-delay 120

DHCP Address Pool Configuration Example

In the following example, three DHCP address pools are created: one in network 172.16.0.0, one in subnetwork 172.16.1.0, and one in subnetwork 172.16.2.0. Attributes from network 172.16.0.0—such as the domain name, DNS server, NetBIOS name server, and NetBIOS node type—are inherited in subnetworks 172.16.1.0 and 172.16.2.0. In each pool, clients are granted 30-day leases and all addresses in each subnetwork, except the excluded addresses, are available to the DHCP Server for assigning to clients. Table 5 lists the IP addresses for the devices in three DHCP address pools.

Table 5 DHCP Address Pool Configuration Example
Pool 0 (Network 172.16.0.0)		Pool 1 (Subnetwork 172.16.1.0)		Pool 2 (Subnetwork 172.16.2.0)
Device	IP Address	Device	IP Address	Device	IP Address
Default routers	-	Default routers	172.16.1.100 172.16.1.101	Default routers	172.16.2.100 172.16.2.101
DNS Server	172.16.1.102 172.16.2.102	—	—	—	—
NetBIOS name server	172.16.1.103 172.16.2.103	—	—	—	—
NetBIOS node type	h-node	—	—	—	—

 

ip dhcp database ftp://user:password@172.16.4.253/router-dhcp write-delay 120

ip dhcp excluded-address 172.16.1.100 172.16.1.103

ip dhcp excluded-address 172.16.2.100 172.16.2.103

!

ip dhcp pool 0

 network 172.16.0.0 /16

 domain-name cisco.com

 dns-server 172.16.1.102 172.16.2.102

 netbios-name-server 172.16.1.103 172.16.2.103

 netbios-node-type h-node

!

ip dhcp pool 1

 network 172.16.1.0 /24

 Default-router 172.16.1.100 172.16.1.101

 lease 30

!

ip dhcp pool 2

 network 172.16.2.0 /24

 default-router 172.16.2.100 172.16.2.101

 lease 30

Manual Bindings Configuration Example

The following example creates a manual binding for a client named Mars.cisco.com. The MAC address of the client is 02c7.f800.0422 and the IP address of the client is 172.16.2.254.

ip dhcp pool Mars

 host 172.16.2.254

 hardware-address 02c7.f800.0422 ieee802

 client-name Mars

 

Because attributes are inherited, the previous configuration is equivalent to the following:

ip dhcp pool Mars

 host 172.16.2.254 mask 255.255.255.0

 hardware-address 02c7.f800.0422 ieee802

 client-name Mars

 default-router 172.16.2.100 172.16.2.101

 domain-name cisco.com

 dns-server 172.16.1.102 172.16.2.102

 netbios-name-server 172.16.1.103 172.16.2.103

 Netbios-node-type h-node

Cisco IOS DHCP Client Example

Figure 15 shows a simple network diagram of a DHCP client on an Ethernet LAN.

Figure 15 Topology Showing DHCP Client with Ethernet Interface

On the DHCP Server, the configuration is as follows:

ip dhcp pool 1

 network 10.1.1.0 255.255.255.0

 lease 1 6

 

On the DHCP client, the configuration is as follows on interface E2:

interface Ethernet2

 ip address dhcp

 

This configuration allows the DHCP client to acquire an IP address from the DHCP Server through an Ethernet interface.

DHCP Server Options Import and Auto configuration Example

The following example shows a remote and central server configured to support DHCP options import and auto configuration. The central server is configured to automatically update DHCP options, such as DNS and WINs addresses, within the DHCP pools. In response to a DHCP request from a local client behind CPE equipment, the remote server can request or "import" these option parameters from the centralized server. See Figure 16 for a diagram of the network topology.

Figure 16 DHCP Example Network Topology

Central Router

!do not assign this range to DHCP clients

ip dhcp-excluded address 10.0.0.1 10.0.0.5

!

ip dhcp pool central

! Specifies network number and mask for DHCP clients

 network 10.0.0.0 255.255.255.0

! Specifes the domain name for the client

 domain-name central

! Specifies DNS server that will respond to DHCP clients when they need to correlate host

! name to ip address

 dns-server 10.0.0.2

! Specifies the NETBIOS WINS server

 netbios-name-server 10.0.0.2

!

interface FastEthernet0/0

 ip address 10.0.0.1 255.255.255.0

 Duplex auto

 speed auto

 

Remote Router

!

ip dhcp pool client

! Imports DHCP options parameters into DHCP server database

 Import all

 Network 20.0.0.0 255.255.255.0

!

Interface FastEthernet0/0

 ip address dhcp

 Duplex auto

 Speed auto