Example for Configuring MLAG with DHCP Snooping
Networking Requirements
Figure 1Â User Configuration Topology of MLAG with DHCP Snooping
As shown in Figure 1, Switch 1 and Switch 2 are Layer 2 switches and form a pair of MLAG peer devices. The DHCP client is connected to Switch3 which is dual-homed to the MLAG network. The DHCP server is connected to Switch4 which is dual-homed to the MLAG network. In the MLAG topology, to provide better services to DHCP client, the network administrator can configure DHCP snooping on Switch1, Switch2, Switch3 and Switch4, to defend against DHCP attacks.
When configuring the network, you need to pay attention to the following points:
- Switch3 is dual-homed to MLAG peer devices Switch 1 and Switch 2, the link ID is 1. Switch 4 is dual-homed to Switch 1 and Switch 2, the link ID is 2.
- DHCP snooping configuration should be identical on both MLAG peer devices.
- The peer link port should be configured as trust port on demand.
- On Switch1, Switch2, Switch3 and Switch4, configure the interfaces in the direction of the DHCP server as DHCP snooping trusted interfaces.
Procedure
Switch1
Step1Â Â Â Â Â Â Â Â Â Configure the VLANs.
          admin@Switch1# set vlans vlan-id 10
          admin@Switch1# set vlans vlan-id 4088 l3-interface vlan4088
          admin@Switch1# set interface aggregate-ethernet ae48 family ethernet-switching native-vlan-id 4088
          admin@Switch1# set interface aggregate-ethernet ae48 family ethernet-switching port-mode trunk
          admin@Switch1# set interface aggregate-ethernet ae48 family ethernet-switching vlan members 10
          admin@Switch1# set interface aggregate-ethernet ae71 family ethernet-switching port-mode trunk
          admin@Switch1# set interface aggregate-ethernet ae71 family ethernet-switching vlan members 10
          admin@Switch1# set interface aggregate-ethernet ae72 family ethernet-switching port-mode trunk
          admin@Switch1# set interface aggregate-ethernet ae72 family ethernet-switching vlan members 10
Step2Â Â Â Â Â Â Â Â Â Configure aggregation interfaces with LACP mode.
  admin@Switch1# set interface aggregate-ethernet ae71 aggregated-ether-options lacp enable true
  admin@Switch1# set interface aggregate-ethernet ae72 aggregated-ether-options lacp enable true
Step3Â Â Â Â Â Â Â Â Â Add member interfaces to a LAG.
          admin@Switch1# set interface gigabit-ethernet te-1/1/1 ether-options 802.3ad ae48
          admin@Switch1# set interface gigabit-ethernet te-1/1/2 ether-options 802.3ad ae48
          admin@Switch1# set interface gigabit-ethernet te-1/1/41 ether-options 802.3ad ae71
          admin@Switch1# set interface gigabit-ethernet te-1/1/42 ether-options 802.3ad ae72
Step4Â Â Â Â Â Â Â Â Â Configure an MLAG domain ID.
  admin@Switch1# set protocols mlag domain 10
  NOTE: Currently, only one MLAG domain is allowed to be configured on one MLAG device.
Step5Â Â Â Â Â Â Â Â Â Specify Switch1 as MLAG Node 0.
  admin@Switch1# set protocols mlag domain 10 node 0
Step6Â Â Â Â Â Â Â Â Â Configure the peer IP address and peer link port.
  admin@Switch1# set protocols mlag domain 10 peer-ip 10.10.0.2 peer-link ae48
  NOTE: Peer-link port should be configured as a LAG port.
Step7Â Â Â Â Â Â Â Â Â Configure the L3 interface IP address for peer link port on local MLAG peer device.
            admin@Switch1# set l3-interface vlan-interface vlan4088 address 10.10.0.1 prefix-length 24
Step8         Configure link ID for the MLAG member port.
          admin@Switch1# set protocols mlag domain 10 interface ae71 link 1
          admin@Switch1# set protocols mlag domain 10 interface ae72 link 2
  NOTE: The paired MLAG member ports must be bound to the same MLAG link ID.
Step9Â Â Â Â Â Â Â Â Â Configure MLAG peer VLAN.
  admin@Switch1# set protocols mlag domain 10 peer-ip 10.10.0.2 peer-vlan 4088
Step10Â Â Â Â Â Enable DHCP snooping function.
  admin@Switch1# set protocols dhcp snooping vlan 10 disable false
Step11Â Â Â Â Â Configure the interface connected to the DHCP server and peer-link port as DHCP snooping trusted interfaces.
  admin@Switch1# set protocols dhcp snooping trust-port ae48
  admin@Switch1# set protocols dhcp snooping trust-port ae72
Step12Â Â Â Â Â Commit the configuration.
      admin@Switch1# commit
Switch2
Step1Â Â Â Â Â Â Â Â Â Configure the VLANs.
          admin@Switch2# set vlans vlan-id 10
          admin@Switch2# set vlans vlan-id 4088 l3-interface vlan4088
          admin@Switch2# set interface aggregate-ethernet ae48 family ethernet-switching native-vlan-id 4088
          admin@Switch2# set interface aggregate-ethernet ae48 family ethernet-switching port-mode trunk
          admin@Switch2# set interface aggregate-ethernet ae48 family ethernet-switching vlan members 10
          admin@Switch2# set interface aggregate-ethernet ae71 family ethernet-switching port-mode trunk
          admin@Switch2# set interface aggregate-ethernet ae71 family ethernet-switching vlan members 10
          admin@Switch2# set interface aggregate-ethernet ae72 family ethernet-switching port-mode trunk
          admin@Switch2# set interface aggregate-ethernet ae72 family ethernet-switching vlan members 10
Step2Â Â Â Â Â Â Â Â Â Configure aggregation interfaces with LACP mode.
  admin@Switch2# set interface aggregate-ethernet ae71 aggregated-ether-options lacp enable true
  admin@Switch2# set interface aggregate-ethernet ae72 aggregated-ether-options lacp enable true
Step3Â Â Â Â Â Â Â Â Â Add member interfaces to a LAG.
          admin@Switch2# set interface gigabit-ethernet te-1/1/1 ether-options 802.3ad ae48
          admin@Switch2# set interface gigabit-ethernet te-1/1/2 ether-options 802.3ad ae48
          admin@Switch2# set interface gigabit-ethernet te-1/1/41 ether-options 802.3ad ae71
          admin@Switch2# set interface gigabit-ethernet te-1/1/42 ether-options 802.3ad ae72
Step4Â Â Â Â Â Â Â Â Â Configure an MLAG domain ID.
  admin@Switch2# set protocols mlag domain 10
  NOTE: Currently, only one MLAG domain is allowed to be configured on one MLAG device.
Step5Â Â Â Â Â Â Â Â Â Specify Switch2 as MLAG Node 1.
  admin@Switch2# set protocols mlag domain 10 node 1
Step6Â Â Â Â Â Â Â Â Â Configure the peer IP address and peer link port.
  admin@Switch2# set protocols mlag domain 10 peer-ip 10.10.0.1 peer-link ae48
  NOTE: Peer-link port should be configured as a LAG port.
Step7Â Â Â Â Â Â Â Â Â Configure the L3 interface IP address for peer link port on local MLAG peer device.
            admin@Switch2# set l3-interface vlan-interface vlan4088 address 10.10.0.2 prefix-length 24
Step8         Configure link ID for the MLAG member port.
          admin@Switch2# set protocols mlag domain 10 interface ae71 link 1
          admin@Switch2# set protocols mlag domain 10 interface ae72 link 2
  NOTE: The paired MLAG member ports must be bound to the same MLAG link ID.
Step9Â Â Â Â Â Â Â Â Â Configure MLAG peer VLAN.
  admin@Switch2# set protocols mlag domain 10 peer-ip 10.10.0.1 peer-vlan 4088
Step10Â Â Â Â Â Enable DHCP snooping function.
  admin@Switch2# set protocols dhcp snooping vlan 10 disable false
Step11Â Â Â Â Â Configure the interface connected to the DHCP server and peer-link port as DHCP snooping trusted interfaces.
  admin@Switch2# set protocols dhcp snooping trust-port ae48
  admin@Switch2# set protocols dhcp snooping trust-port ae72
Step12Â Â Â Â Â Commit the configuration.
      admin@Switch2# commit
Switch3
Step1Â Â Â Â Â Â Â Â Â Configure the VLANs.
          admin@Switch3# set vlans vlan-id 10
          admin@Switch3# set interface aggregate-ethernet ae1 family ethernet-switching port-mode trunk
          admin@Switch3# set interface aggregate-ethernet ae1 family ethernet-switching vlan members 10
  admin@Switch3# set interface gigabit-ethernet ge-1/1/3 family ethernet-switching native-vlan-id 10
         admin@Switch3# set interface gigabit-ethernet ge-1/1/3 description "to-client"
Step2Â Â Â Â Â Â Â Â Â Configure aggregation interfaces with LACP mode.
  admin@Switch3# set interface gigabit-ethernet ge-1/1/1 ether-options 802.3ad ae1
  admin@Switch3# set interface gigabit-ethernet ge-1/1/2 ether-options 802.3ad ae1
  admin@Switch3# set interface aggregate-ethernet ae1 aggregated-ether-options lacp enable true
Step3Â Â Â Â Â Â Â Â Â Enable DHCP snooping function.
  admin@Switch3# set protocols dhcp snooping vlan 10 disable false
Step4Â Â Â Â Â Â Â Â Â Configure ae1 as DHCP snooping trusted port.
  admin@Switch3# set protocols dhcp snooping trust-port ae1
Step5Â Â Â Â Â Â Â Â Â Commit the configuration.
      admin@Switch3# commit
Switch4
Step1Â Â Â Â Â Â Â Â Â Configure the VLANs.
          admin@Switch4# set vlans vlan-id 10
          admin@Switch4# set interface aggregate-ethernet ae2 family ethernet-switching port-mode trunk
          admin@Switch4# set interface aggregate-ethernet ae2 family ethernet-switching vlan members 10
  admin@Switch4# set interface gigabit-ethernet ge-1/1/3 family ethernet-switching native-vlan-id 10
      admin@Switch4# set interface gigabit-ethernet ge-1/1/3 description "to-server"
Step2Â Â Â Â Â Â Â Â Â Configure aggregation interfaces with LACP mode.
  admin@Switch4# set interface gigabit-ethernet ge-1/1/1 ether-options 802.3ad ae2
  admin@Switch4# set interface gigabit-ethernet ge-1/1/2 ether-options 802.3ad ae2
  admin@Switch4# set interface aggregate-ethernet ae2 aggregated-ether-options lacp enable true
Step3Â Â Â Â Â Â Â Â Â Enable DHCP snooping function.
  admin@Switch4# set protocols dhcp snooping vlan 10 disable false
Step4Â Â Â Â Â Â Â Â Â Configure ge-1/1/3 as DHCP snooping trusted port.
  admin@Switch4# set protocols dhcp snooping trust-port ge-1/1/3
Step5Â Â Â Â Â Â Commit the configuration.
      admin@Switch4# commit
Verify the Configuration
- You can use the run show mlag domain command to display the global MLAG domain information.
admin@Switch1# run show mlag domain summary Domain ID: 10   Domain MAC: 48:6E:73:FF:00:0a   Node ID: 0 ----------------------------------------------------------------------- Peer Link Peer IP Peer Vlan Neighbor Status Config Matched MAC Synced # of Links --------- -------- ------ --------- -------------- ----------- ---------- ae48   10.10.10.1 4088      ESTABLISHED    Yes  Yes    1 ae48   10.10.10.1 4088      ESTABLISHED    Yes  Yes    2
- You can use the run show mlag link command to display MLAG link information.
admin@Switch1# run show mlag link summary # of Links: 2 Link  Local LAG  Link Status  Local Status  Peer Status  Config Matched  Flood ----  ---------  -----------  ------------  -----------  --------------  ----- 1     ae71        IDLE         UP            UNKNOWN      No   No 2     ae72        IDLE         UP            UNKNOWN      No   No
- Run the run show dhcp snooping command to view the DHCP snooping binding table.
admin@Switch3# run show dhcp snooping binding Total count: 1 MAC Address IP Address Port VLAN ID Lease(sec) -------------------------------------------------------------------------------------------- 00:1b:57:60:11:d1   71.0.0.15    ge-1/1/3  10  599/600 admin@Switch4# run show dhcp snooping Total count:    1 MAC Address         IP Address  Port     VLAN ID      Lease(sec)               -----------------   ---------   -------- -------  ---------------           00:1b:57:60:11:d1   71.0.0.15    ae2   10          599/600 Â
Copyright © 2024 Pica8 Inc. All Rights Reserved.