next two relay agent hops ("B" and "C".) The server can then enforce an IP addressing policy based on the Option
82 field generated by the edge relay agent ("A".) In this example, the DHCP policy boundary is at relay agent 1.
Figure 52: Example configured to allow multiple relay agents to contribute an Option 82 field
This is an enhancement of the previous example. In this case, each hop for an accepted client request adds a
new Option 82 field to the request. A DHCP server capable of using multiple Option 82 fields can be configured to
use this approach to keep a more detailed control over leased IP addresses. In this example, the primary DHCP
policy boundary is at relay agent "A," but more global policy boundaries can exist at relay agents "B" and "C."
Figure 53: Example allowing only an upstream relay agent to contribute an Option 82 field
Like the first example, above, this configuration drops client requests with spurious Option 82 fields from clients
on the edge relay agent. However, in this case, only the Option 82 field from the last relay agent is retained for
use by the DHCP server. In this case the DHCP policy boundary is at relay agent "C." In the previous two
examples the boundary was with relay "A."
Validation of server response packets
A valid Option 82 server response to a client request packet includes a copy of the Option 82 fields the server
received with the request. With validation disabled, most variations of Option 82 information are allowed, and the
corresponding server response packets are forwarded.
Server response validation is an option you can specify when configuring Option 82 DHCP for
append
,
replace
,
or
drop
on page 303. Enabling validation on the routing switch can enhance
protection against DHCP server responses that are either from untrusted sources or are carrying invalid Option 82
information.
With validation enabled, the relay agent applies stricter rules to variations in the Option 82 fields of incoming
server responses to determine whether to forward the response to a downstream device or to drop the response
due to invalid (or missing) Option 82 information. The following table describes relay agent management of DHCP
server responses with optional validation enabled and disabled
306
Aruba 3810 / 5400R Multicast and Routing Guide for ArubaOS-
Switch 16.08
