NXOS DHCP 中继 - 在 DHCPDISCOVER 与 DHCPREQUEST 中以不同方式覆盖选项 54（服务器标识符）？

网络工程 思科 dhcp cisco-nexus cisco-nx-os
2021-07-19 08:18:50

我正在尝试解决 VLXAN/EVPN 环境（Cisco N9K、NXOS 9.3.2）中的 DHCP 中继问题。

我们似乎能够将 DHCPDISCOVERs 通过服务器并从那里返回 DHCPOFFERS。DHCPREQUEST 也被转发到服务器，但没有看到从服务器返回的 DHCPACK。

问题 A：此 DHCP 中继运行正常吗？它对 DHCPDISCOVER 的作用与对 DHCPREQUEST 的作用不同（参见文章的最后一部分）。

问题 B： DHCP 中继的行为是否是由服务器在其 DHCPOFFER 中提供的“下一个服务器”信息引起的？[1]

服务器维护者引用 RFC 5107 作为原因，对于类似于我可以观察到的症状的问题描述：在 DHCPREQUEST 中，在被中继后，选项 54（服务器标识符）与服务器 ID 覆盖值不同，（选项 82，子选项11)，从而被服务器丢弃。

请参阅http://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2018q1/011899.html ，其中维护者引用了 RFC 5107，由我高亮

那是旧代码，并且早于详细的 git 日志，但很明显该测试正在实现 RFC 5107 的这一部分

在为 DHCPREQUEST 消息提供服务时，DHCP 服务器通常会查看服务器标识符选项以验证指定的地址是否是与 DHCP 服务器关联的地址之一，如果 DHCPREQUEST 与配置的 DHCP 服务器接口地址不匹配，则静默忽略 DHCPREQUEST . 但是，如果 DHCPREQUEST 消息包含服务器标识符覆盖子选项，则应在该子选项中的地址和服务器标识符选项之间进行比较。 如果服务器标识符覆盖子选项和服务器标识符选项指定相同的地址， 那么服务器应该接受 DHCPREQUEST 消息进行处理，无论服务器标识符选项是否与 DHCP 服务器接口匹配。

所以问题是客户端在续订时将服务器 ID 发送为 10.36.20.19，这会导致上面指定的测试失败。

这是一个带有分布式任播网关的 VLXAN/EVPN 设置，因此我们不得不使用一些技巧，在叶子上使用特定于节点的环回地址作为 DHCP 中继数据包的源地址。

这记录在：https : //www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/vxlan/configuration/guide/b-cisco-nexus-9000-series -nx-os-vxlan-configuration-guide-93x/b-cisco-nexus-9000-series-nx-os-vxlan-configuration-guide-93x_appendix_010111.html#id_103141

所以我们配置了：

ip dhcp relay
ip dhcp relay information option
ip dhcp relay information option vpn

[...]

interface loopback32
  description DHCP Relay source address for VLAN3632
  vrf member MYVRF
  ip address 10.32.15.39/32

[...]

interface Vlan3632
  description SVI for VLAN 3632
  vrf member MYVRF
  no ip redirects
  ip address 10.32.96.1/20
  fabric forwarding mode anycast-gateway
  ip dhcp relay address 10.32.33.40 
  ip dhcp relay source-interface loopback32

可以假设整个 BGP/VXLAN 部分都在工作。此外，loopback32可以从 DHCP 服务器访问（毕竟我们正在获取 DHCPOFFERS），所以我省略了 VXLAN/EVPN 配置位。

我观察到的是以下行为（我将省略客户端的调试输出，否则这篇文章将超过 32k）。

步骤 1：中继上的 DHCPDISCOVER

DHCP 中继接收客户端的广播：这里没什么可期待的：

Internet Protocol, Src: 0.0.0.0 (0.0.0.0), Dst: 255.255.255.255 (255.255.255.255)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 339
    Identification: 0x6cdb (27867)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x4dbf [correct]
        [Good: True]
        [Bad : False]
    Source: 0.0.0.0 (0.0.0.0)
    Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port: bootps (67)
    Source port: bootpc (68)
    Destination port: bootps (67)
    Length: 319
    Checksum: 0x431d [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x00002384
    Seconds elapsed: 0
    Bootp flags: 0x8000 (Broadcast)
        1... .... .... .... = Broadcast flag: Broadcast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 0.0.0.0 (0.0.0.0)
    Next server IP address: 0.0.0.0 (0.0.0.0)
    Relay agent IP address: 0.0.0.0 (0.0.0.0)
    Client MAC address: 70:79:b3:ff:51:42 (70:79:b3:ff:51:42)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: (OK)
    Option: (t=53,l=1) DHCP Message Type = DHCP Discover
        Option: (53) DHCP Message Type
        Length: 1
        Value: 01
    Option: (t=57,l=2) Maximum DHCP Message Size = 1200
        Option: (57) Maximum DHCP Message Size
        Length: 2
        Value: 04B0
    Option: (t=61,l=25) Client identifier
        Option: (61) Client identifier
        Length: 25
        Value: 00636973636F2D373037392E623366662E353134322D4769...
    Option: (t=12,l=13) Host Name = "ExpDHCPClient"
        Option: (12) Host Name
        Length: 13
        Value: 45787044484350436C69656E74
    Option: (t=55,l=9) Parameter Request List
        Option: (55) Parameter Request List
        Length: 9
        Value: 01060F2C790321962B
        1 = Subnet Mask
        6 = Domain Name Server
        15 = Domain Name
        44 = NetBIOS over TCP/IP Name Server
        121 = Classless Static Route
        3 = Router
        33 = Static Route
        150 = TFTP server address
        43 = Vendor-Specific Information
    Option: (t=60,l=8) Vendor class identifier = "ciscopnp"
        Option: (60) Vendor class identifier
        Length: 8
        Value: 636973636F706E70
    End Option

步骤 2 中继 DHCPDISCOVER

然后发生这种情况：

  • DHCP 中继 VLXAN 对数据包进行验证，并在重写一些内容（未显示外部数据包头）后将其发送到远程出口 VTEP
  • 添加配置dhcp relay source-interface为 giaddr（中继代理 IP 地址
  • 添加/设置选项 82 子选项 5（链接选择）到 10.32.96.0
  • 添加/设置选项 82 子选项 11（服务器 ID 覆盖）到 10.32.96.1
  • 将 Option 82 Suboption 151 (Virtual Subnet Selection) 添加/设置到我无法解析的内容中（我相信它与当前问题无关。）

（接下来的部分让我头疼的是要获取预格式标签......）

Internet Protocol, Src: 10.32.15.39 (10.32.15.39), Dst: 10.32.33.40 (10.32.33.40)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 389
    Identification: 0xdb6c (56172)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x9a6c [correct]
        [Good: True]
        [Bad : False]
    Source: 10.32.15.39 (10.32.15.39)
    Destination: 10.32.33.40 (10.32.33.40)
User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67)
    Source port: bootps (67)
    Destination port: bootps (67)
    Length: 369
    Checksum: 0xf666 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet
    Hardware address length: 6
    Hops: 1
    Transaction ID: 0x00002384
    Seconds elapsed: 0
    Bootp flags: 0x8000 (Broadcast)
        1... .... .... .... = Broadcast flag: Broadcast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 0.0.0.0 (0.0.0.0)
    Next server IP address: 0.0.0.0 (0.0.0.0)
    Relay agent IP address: 10.32.15.39 (10.32.15.39)
    Client MAC address: 70:79:b3:ff:51:42 (70:79:b3:ff:51:42)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: (OK)
    Option: (t=53,l=1) DHCP Message Type = DHCP Discover
        Option: (53) DHCP Message Type
        Length: 1
        Value: 01
    Option: (t=57,l=2) Maximum DHCP Message Size = 1200
        Option: (57) Maximum DHCP Message Size
        Length: 2
        Value: 04B0
    Option: (t=61,l=25) Client identifier
        Option: (61) Client identifier
        Length: 25
        Value: 00636973636F2D373037392E623366662E353134322D4769...
    Option: (t=12,l=13) Host Name = "ExpDHCPClient"
        Option: (12) Host Name
        Length: 13
        Value: 45787044484350436C69656E74
    Option: (t=55,l=9) Parameter Request List
        Option: (55) Parameter Request List
        Length: 9
        Value: 01060F2C790321962B
        1 = Subnet Mask
        6 = Domain Name Server
        15 = Domain Name
        44 = NetBIOS over TCP/IP Name Server
        121 = Classless Static Route
        3 = Router
        33 = Static Route
        150 = TFTP server address
        43 = Vendor-Specific Information
    Option: (t=60,l=8) Vendor class identifier = "ciscopnp"
        Option: (60) Vendor class identifier
        Length: 8
        Value: 636973636F706E70
    Option: (t=82,l=48) Agent Information Option
        Option: (82) Agent Information Option
        Length: 48
        Value: 010409010E30020628AC9E65F84F9714004F5330312D5245...
        Agent Circuit ID: 09010E30
        Agent Remote ID: 28AC9E65F84F
        DHCPv4 Virtual Subnet Selection: 004F5330312D52454730312D444556312D5A3030
        Server Identifier Override: 0A206001
        Link selection: 10.32.96.0
    End Option

步骤 3 DHCPOFFER 从服务器

然后，我们从服务器获取 DHCPOFFER，有一个特殊性：

  • 从服务器 (10.32.33.40) 单播到我们的loopback32(10.32.15.39)
  • 选项 54（服务器标识符）设置为 10.32.96.1
  • 中继代理 IP 地址设置为 10.32.15.39
  • Next Server IP 设置为 10.32.33.40（实际 DHCP 服务器地址，与被中继相同）
  • 提供的地址是 10.32.96.104
  • 选项 82 信息被反射回继电器

（无意义的行在这里使预格式化工作......）

Internet Protocol, Src: 10.32.33.40 (10.32.33.40), Dst: 10.32.15.39 (10.32.15.39)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)
        1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 395
    Identification: 0x55ba (21946)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 61
    Protocol: UDP (0x11)
    Header checksum: 0xe159 [correct]
        [Good: True]
        [Bad : False]
    Source: 10.32.33.40 (10.32.33.40)
    Destination: 10.32.15.39 (10.32.15.39)
User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67)
    Source port: bootps (67)
    Destination port: bootps (67)
    Length: 375
    Checksum: 0xa7bb [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Bootstrap Protocol
    Message type: Boot Reply (2)
    Hardware type: Ethernet
    Hardware address length: 6
    Hops: 1
    Transaction ID: 0x00002384
    Seconds elapsed: 0
    Bootp flags: 0x8000 (Broadcast)
        1... .... .... .... = Broadcast flag: Broadcast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 10.32.96.104 (10.32.96.104)
    Next server IP address: 10.32.33.40 (10.32.33.40)
    Relay agent IP address: 10.32.15.39 (10.32.15.39)
    Client MAC address: 70:79:b3:ff:51:42 (70:79:b3:ff:51:42)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name: /undionly.kpxe
    Magic cookie: (OK)
    Option: (t=53,l=1) DHCP Message Type = DHCP Offer
        Option: (53) DHCP Message Type
        Length: 1
        Value: 02
    Option: (t=54,l=4) DHCP Server Identifier = 10.32.96.1
        Option: (54) DHCP Server Identifier
        Length: 4
        Value: 0A206001
    Option: (t=51,l=4) IP Address Lease Time = 1 hour
        Option: (51) IP Address Lease Time
        Length: 4
        Value: 00000E10
    Option: (t=118,l=4) Subnet Selection Option = 10.32.96.0
        Option: (118) Subnet Selection Option
        Length: 4
        Value: 0A206000
    Option: (t=58,l=4) Renewal Time Value = 30 minutes
        Option: (58) Renewal Time Value
        Length: 4
        Value: 00000708
    Option: (t=59,l=4) Rebinding Time Value = 52 minutes, 30 seconds
        Option: (59) Rebinding Time Value
        Length: 4
        Value: 00000C4E
    Option: (t=1,l=4) Subnet Mask = 255.255.240.0
        Option: (1) Subnet Mask
        Length: 4
        Value: FFFFF000
    Option: (t=28,l=4) Broadcast Address = 10.32.111.255
        Option: (28) Broadcast Address
        Length: 4
        Value: 0A206FFF
    Option: (t=15,l=13) Domain Name = "myvrf.internal"
        Option: (15) Domain Name
        Length: 13
        Value: 6465762E692E657763732E6368
    Option: (t=6,l=8) Domain Name Server
        Option: (6) Domain Name Server
        Length: 8
        Value: 0A08034A0A0803AE
        IP Address: 10.8.3.74
        IP Address: 10.8.3.174
    Option: (t=3,l=4) Router = 10.32.96.1
        Option: (3) Router
        Length: 4
        Value: 0A206001
    Option: (t=82,l=48) Agent Information Option
        Option: (82) Agent Information Option
        Length: 48
        Value: 010409010E30020628AC9E65F84F9714004F5330312D5245...
        Agent Circuit ID: 09010E30
        Agent Remote ID: 28AC9E65F84F
        DHCPv4 Virtual Subnet Selection: 004F5330312D52454730312D444556312D5A3030
        Server Identifier Override: 0A206001
        Link selection: 10.32.96.0
    End Option

步骤 4 DHCPOFFER 到客户端

DHCPOFFER 正在转发给客户端

  • 删除了选项 82 和子选项
  • 从 10.32.96.1 广播到所有路由广播
  • 选项 54（服务器标识符）保持为 10.32.96.1
  • Next Server 保持为 10.32.33.40

（接下来的部分让我头疼的是要获取预格式标签......）

Internet Protocol, Src: 10.32.96.1 (10.32.96.1), Dst: 255.255.255.255 (255.255.255.255)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00)
        1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 345
    Identification: 0xba55 (47701)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x955d [correct]
        [Good: True]
        [Bad : False]
    Source: 10.32.96.1 (10.32.96.1)
    Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port: bootpc (68)
    Source port: bootps (67)
    Destination port: bootpc (68)
    Length: 325
    Checksum: 0x202d [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Bootstrap Protocol
    Message type: Boot Reply (2)
    Hardware type: Ethernet
    Hardware address length: 6
    Hops: 2
    Transaction ID: 0x00002384
    Seconds elapsed: 0
    Bootp flags: 0x8000 (Broadcast)
        1... .... .... .... = Broadcast flag: Broadcast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 10.32.96.104 (10.32.96.104)
    Next server IP address: 10.32.33.40 (10.32.33.40)
    Relay agent IP address: 10.32.96.1 (10.32.96.1)
    Client MAC address: 70:79:b3:ff:51:42 (70:79:b3:ff:51:42)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name: /undionly.kpxe
    Magic cookie: (OK)
    Option: (t=53,l=1) DHCP Message Type = DHCP Offer
        Option: (53) DHCP Message Type
        Length: 1
        Value: 02
    Option: (t=54,l=4) DHCP Server Identifier = 10.32.96.1
        Option: (54) DHCP Server Identifier
        Length: 4
        Value: 0A206001
    Option: (t=51,l=4) IP Address Lease Time = 1 hour
        Option: (51) IP Address Lease Time
        Length: 4
        Value: 00000E10
    Option: (t=118,l=4) Subnet Selection Option = 10.32.96.0
        Option: (118) Subnet Selection Option
        Length: 4
        Value: 0A206000
    Option: (t=58,l=4) Renewal Time Value = 30 minutes
        Option: (58) Renewal Time Value
        Length: 4
        Value: 00000708
    Option: (t=59,l=4) Rebinding Time Value = 52 minutes, 30 seconds
        Option: (59) Rebinding Time Value
        Length: 4
        Value: 00000C4E
    Option: (t=1,l=4) Subnet Mask = 255.255.240.0
        Option: (1) Subnet Mask
        Length: 4
        Value: FFFFF000
    Option: (t=28,l=4) Broadcast Address = 10.32.111.255
        Option: (28) Broadcast Address
        Length: 4
        Value: 0A206FFF
    Option: (t=15,l=13) Domain Name = "myvrf.internal"
        Option: (15) Domain Name
        Length: 13
        Value: 6465762E692E657763732E6368
    Option: (t=6,l=8) Domain Name Server
        Option: (6) Domain Name Server
        Length: 8
        Value: 0A08034A0A0803AE
        IP Address: 10.8.3.74
        IP Address: 10.8.3.174
    Option: (t=3,l=4) Router = 10.32.96.1
        Option: (3) Router
        Length: 4
        Value: 0A206001
    End Option

第 5 步：中继上的 DHCPREQUEST

然后客户端生成 DHCPREQUEST 命中中继，如下所示：

  • 广播从 0.0.0.0 到 255.255.255.255
  • 客户端 IP 地址全为零
  • 下一个服务器 IP 地址全为零
  • 中继代理 IP 地址全为零
  • 选项 54（服务器 ID）设置为 10.32.96.1
  • 并且有一个请求的IP 10.32.96.104

（为什么有些部分总是拒绝接受 pre-format-tags？）

Internet Protocol, Src: 0.0.0.0 (0.0.0.0), Dst: 255.255.255.255 (255.255.255.255)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 351
    Identification: 0x6cdc (27868)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x4db2 [correct]
        [Good: True]
        [Bad : False]
    Source: 0.0.0.0 (0.0.0.0)
    Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port: bootps (67)
    Source port: bootpc (68)
    Destination port: bootps (67)
    Length: 331
    Checksum: 0x0453 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x00002384
    Seconds elapsed: 0
    Bootp flags: 0x8000 (Broadcast)
        1... .... .... .... = Broadcast flag: Broadcast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 0.0.0.0 (0.0.0.0)
    Next server IP address: 0.0.0.0 (0.0.0.0)
    Relay agent IP address: 0.0.0.0 (0.0.0.0)
    Client MAC address: 70:79:b3:ff:51:42 (70:79:b3:ff:51:42)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: (OK)
    Option: (t=53,l=1) DHCP Message Type = DHCP Request
        Option: (53) DHCP Message Type
        Length: 1
        Value: 03
    Option: (t=57,l=2) Maximum DHCP Message Size = 1200
        Option: (57) Maximum DHCP Message Size
        Length: 2
        Value: 04B0
    Option: (t=61,l=25) Client identifier
        Option: (61) Client identifier
        Length: 25
        Value: 00636973636F2D373037392E623366662E353134322D4769...
    Option: (t=54,l=4) DHCP Server Identifier = 10.32.96.1
        Option: (54) DHCP Server Identifier
        Length: 4
        Value: 0A206001
    Option: (t=50,l=4) Requested IP Address = 10.32.96.104
        Option: (50) Requested IP Address
        Length: 4
        Value: 0A206068
    Option: (t=12,l=13) Host Name = "ExpDHCPClient"
        Option: (12) Host Name
        Length: 13
        Value: 45787044484350436C69656E74
    Option: (t=55,l=9) Parameter Request List
        Option: (55) Parameter Request List
        Length: 9
        Value: 01060F2C790321962B
        1 = Subnet Mask
        6 = Domain Name Server
        15 = Domain Name
        44 = NetBIOS over TCP/IP Name Server
        121 = Classless Static Route
        3 = Router
        33 = Static Route
        150 = TFTP server address
        43 = Vendor-Specific Information
    Option: (t=60,l=8) Vendor class identifier = "ciscopnp"
        Option: (60) Vendor class identifier
        Length: 8
        Value: 636973636F706E70
    End Option

步骤 6 中继的 DHCPREQUEST

现在事情已经超出了我的范围：

  • 中继 VXLAN 将请求发送到远程出口 VTEP（未显示外部标头）
  • Next Server 地址全为零
  • 中继代理 IP 地址设置为 10.32.15.39
  • 请求的 IPO 地址保持在 10.32.96.104
  • 选项 54更改为 10.32.33.40
  • 再次添加选项 82 和子选项。

（啊……这些预格式标签令人伤脑筋） 

Internet Protocol, Src: 10.32.15.39 (10.32.15.39), Dst: 10.32.33.40 (10.32.33.40)
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
        0000 00.. = Differentiated Services Codepoint: Default (0x00)
        .... ..0. = ECN-Capable Transport (ECT): 0
        .... ...0 = ECN-CE: 0
    Total Length: 401
    Identification: 0xdc6c (56428)
    Flags: 0x00
        0.. = Reserved bit: Not Set
        .0. = Don't fragment: Not Set
        ..0 = More fragments: Not Set
    Fragment offset: 0
    Time to live: 255
    Protocol: UDP (0x11)
    Header checksum: 0x9960 [correct]
        [Good: True]
        [Bad : False]
    Source: 10.32.15.39 (10.32.15.39)
    Destination: 10.32.33.40 (10.32.33.40)
User Datagram Protocol, Src Port: bootps (67), Dst Port: bootps (67)
    Source port: bootps (67)
    Destination port: bootps (67)
    Length: 381
    Checksum: 0xf675 [validation disabled]
        [Good Checksum: False]
        [Bad Checksum: False]
Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet
    Hardware address length: 6
    Hops: 1
    Transaction ID: 0x00002384
    Seconds elapsed: 0
    Bootp flags: 0x8000 (Broadcast)
        1... .... .... .... = Broadcast flag: Broadcast
        .000 0000 0000 0000 = Reserved flags: 0x0000
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 0.0.0.0 (0.0.0.0)
    Next server IP address: 0.0.0.0 (0.0.0.0)
    Relay agent IP address: 10.32.15.39 (10.32.15.39)
    Client MAC address: 70:79:b3:ff:51:42 (70:79:b3:ff:51:42)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: (OK)
    Option: (t=53,l=1) DHCP Message Type = DHCP Request
        Option: (53) DHCP Message Type
        Length: 1
        Value: 03
    Option: (t=57,l=2) Maximum DHCP Message Size = 1200
        Option: (57) Maximum DHCP Message Size
        Length: 2
        Value: 04B0
    Option: (t=61,l=25) Client identifier
        Option: (61) Client identifier
        Length: 25
        Value: 00636973636F2D373037392E623366662E353134322D4769...
    Option: (t=54,l=4) DHCP Server Identifier = 10.32.33.40
        Option: (54) DHCP Server Identifier
        Length: 4
        Value: 0A202128
    Option: (t=50,l=4) Requested IP Address = 10.32.96.104
        Option: (50) Requested IP Address
        Length: 4
        Value: 0A206068
    Option: (t=12,l=13) Host Name = "ExpDHCPClient"
        Option: (12) Host Name
        Length: 13
        Value: 45787044484350436C69656E74
    Option: (t=55,l=9) Parameter Request List
        Option: (55) Parameter Request List
        Length: 9
        Value: 01060F2C790321962B
        1 = Subnet Mask
        6 = Domain Name Server
        15 = Domain Name
        44 = NetBIOS over TCP/IP Name Server
        121 = Classless Static Route
        3 = Router
        33 = Static Route
        150 = TFTP server address
        43 = Vendor-Specific Information
    Option: (t=60,l=8) Vendor class identifier = "ciscopnp"
        Option: (60) Vendor class identifier
        Length: 8
        Value: 636973636F706E70
    Option: (t=82,l=48) Agent Information Option
        Option: (82) Agent Information Option
        Length: 48
        Value: 010409010E30020628AC9E65F84F9714004F5330312D5245...
        Agent Circuit ID: 09010E30
        Agent Remote ID: 28AC9E65F84F
        DHCPv4 Virtual Subnet Selection: 004F5330312D52454730312D444556312D5A3030
        Server Identifier Override: 0A206001
        Link selection: 10.32.96.0
    End Option

... DHCPREQUEST 甚至没有出现在 dnsmasq.log 中。因此，我们甚至还没有开始（还）在服务器端进行 tcpdump/capture。

感谢您的建议、想法、想法和指点...

[1] 给定的服务器也恰好用作 DHCP 客户端的基于 HTTP（而非 tftp）的 PXE 引导服务器。然而，我很难在它的配置文件中找到任何清楚地说明为什么它会设置“下一个服务器”的内容——但话又说回来，这部分问题与服务器配置相关，必须在网络工程之外回答。

2个回答

只是想就我们的客户面临的类似问题分享一些信息。他们已经从 VSS 迁移到 NXOS VXLAN 结构，并且使用来自 SCCM 服务器的 BOOTP 的 PXE 引导停止在他们的 VDI 环境中工作。似乎选项 54 覆盖是原因。

我们注意到，根据他们的安全指南，NXOS 不支持 BOOTP 中继。 https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus9000/sw/93x/security/configuration/guide/b-cisco-nexus-9000-nx-os-security- configuration-guide-93x/b-cisco-nexus-9000-nx-os-security-configuration-guide-93x_chapter_01110.html#id_72567

这两件事可能是相关的。

SCCM 需要转发 UDP 端口 4011 的另一个相关问题是 NXOS 上的 ip forward-protocol 非常有限，无法转发任何 UDP 端口，只能转发特定端口。自 2015 年起填写了 TAC 增强功能，但其状态仍然是新的。

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCuu60491

HTH 阿列克谢。

“问题B”的部分答案

在 DHCPOFFER 的“Next Server”字段中拥有 DHCP 服务器自己的 IP 地址是完全正常的，这与使用（相同）服务器作为 http 或 tftp 引导服务器完全无关。

如果这导致继电器行为异常，那么这将是继电器的问题。

问题A的部分答案：

继电器可能工作正常。使用 Windows 2016 Server 的 DHCP 服务（我知道我们现在正在触及离题的边界），我们今天让它工作。这是不可能的最终解决方案，但至少它有效。

有趣的是，Windows DHCP 服务器在收到中继的 DHCPREQUEST 后首先返回 DHCP NAK（而 dnsmasq 静默丢弃数据包）。

然后我们为覆盖所有可能的 DHCP 中继源地址的 IP 范围设置了一个虚拟的DHCP 范围（如：排除所有地址），然后我们开始获取 DHCPACK。

这例如在这里解释：https : //social.technet.microsoft.com/Forums/en-US/20e50652-5a19-4dee-a6af-4c09f3fcfd1b/windows-dhcp-server-replying-with-dhcp-nak-rfc3527-link -selection-suboption?forum=winserveripamdhcpdns从这里引用：

https://docs.microsoft.com/en-us/windows-server/networking/technologies/dhcp/dhcp-subnet-options

所有中继代理 IP 地址 (GIADDR) 都必须是活动 DHCP 范围 IP 地址范围的一部分。DHCP 范围 IP 地址范围之外的任何 GIADDR 都被视为恶意中继，Windows DHCP 服务器不会确认来自这些中继代理的 DHCP 客户端请求。

可以创建一个特殊的范围来“授权”中继代理。使用 GIADDR 创建一个范围（如果 GIADDR 是连续 IP 地址，则创建多个），从分发中排除 GIADDR 地址，然后激活该范围。这将授权中继代理，同时防止分配 GIADDR 地址。

我们试图在 dnsmasq 上复制这个“虚拟范围”解决方案，但到目前为止，我们失败了。

如果有的话，我们现在可能会将这个讨论/调查转移到其他 SE 站点，因为它似乎已成为服务器端问题。

其它你可能感兴趣的问题
上一篇多端口适配器的实际网络速度 下一篇meraki 桥接模式：dhcp 未标记