blocks|key|2184141|text|很可能您的核心交换机具有子网的网关ip，如192.168.1.1。如果要在访问交换机上启用ip助手，则需要将ip分配给访问交换机上的vlan，类似于192.168.1.2至192.168.1.6。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2184142|在这种情况下，所有6个交换机都会将广播DHCP发现转换为单播，并发送到DHCP服务器。DHCP服务器将收到6份发现，并以6份报价回复。这6个DHCP报价将由所有交换机转发到主机，因此主机PC将收到6个报价。这意味着对每个人来说都是一个没有好处的过程。|2184143|DHCP继电器并不是造成高cpu负载的原因。在为子网配置网关ip的情况下，启用ip助手始终是最佳实践。|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|G|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|H|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|I|8|@]|9|@]|A|$]]]|F|$]]

Most probably your core switch has the gateway ip of the subnet like 192.168.1.1. If you want to enable ip-helper on your access switches, then you need to assign ip to the vlan on access switches something like from 192.168.1.2 to 192.168.1.6. 

In this case all 6 switches will translate broadcast DHCP discover to unicast and send to DHCP server. DHCP server will receive 6 Discover and reply with 6 Offer. These 6 DHCP Offer will be relayed by all switches to the host so host PC will receive 6 offer. This means a lot of process for everyone without a benefit. 

DHCP relay is not something cause high cpu load. It is always best practice to enable ip-helper where your gateway ip is configured for the subnet.

blocks|key|2183976|text|ip助手地址位于第三层(vlan)接口上。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

The ip helper address goes on the layer 3 (vlan) interface.

blocks|key|2225033|text|IP+Helper+(在配置模式下:+ip助手-地址)在网络层上工作，因为它将dhcp客户端转发到另一个网络(lan段或VLAN)上的dhcp服务器。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2225034|因此，如果您将核心交换机称为第三层交换机，那么只在核心交换机上配置IP助手地址，而不是在所有交换机上配置ip助手地址(顺便说一句，对于第二层交换机，您甚至不能打开ip路由)。|entityMap^0|0^^$0|@$1|2|3|4|5|6|7|E|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|F|8|@]|9|@]|A|$]]]|D|$]]

IP Helper (in configuration mode: ip helper-address) is functioning on network layer, because it forwards dhcp clients to the dhcp server on another network (lan segment or VLAN).

SO if you are talking about core switch as Layer 3 switch then configure IP Helper Addressing only on the CORE SWITCH, not on all the switches (btw, for layer 2 switches you cannot even turn on the ip routing)

blocks|key|2224993|text|IP助手用于将DHCP广播转换为要在广播域外转发的Unicast消息。因此，需要在广播域的边缘配置此助手，该域将是第3层接口。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

IP Helpers are used to translate a DHCP Broadcast into a Unicast message to be forwarded outside of a Broadcast domain. As a result, this helper needs to be configured on the edge of the Broadcast domain which will be a Layer 3 interface.

blocks|key|2184067|text|如果您想在第二层交换机上设置IP辅助配置，则该交换机需要在该VLAN上有一个SVI+IP地址。第二层交换机仍将使用核心层-3交换机将请求发送到DHCP服务器。第二层交换机唯一能做的就是将广播请求转换成单播.您将不会取得任何好的结果，您将有更多的安全考虑，有交换机IP地址上的用户VLAN。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|entityMap^0^^$0|@$1|2|3|4|5|6|7|C|8|@]|9|@]|A|$]]]|B|$]]

If you want to set IP helper configuration on layer-2 switches, that switch needs to have an SVI IP address on that VLAN. Layer 2 switch will still use the core layer-3 switch to send the request to the DHCP server. The only thing layer-2 switch will do is to convert the broadcast request to unicast. You won't achieve anything good and you will have additional security concerns for having switch IP addresses on user VLAN.

blocks|key|2225124|text|如果启用DHCP窥探功能以在这些交换机上启用ip助手时停止在交换机之间的广播，则将允许您终止给定交换机中的DHCP广播，并通过网络的其余部分发送单个单播。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2225125|这减少了通过持有给定网段的其他交换机重新广播启动-p广播的开销，从而减少了恶意或配置错误的客户端从引导-p请求淹没整个网段的影响。|2225126|这还将帮助您定位插入的设备所在的源交换机，因为它的本地访问开关将是服务器接收的单播DHCP请求的源。|2225127|但是，如果您不使用DHCP，那么在没有提供这些额外好处的同时，任何给定网络上的额外开销是可以忽略不计的。|2225128|服务器将只对几个单播请求使用一个IP地址进行答复，因为一个正确实现的DHCP服务器必须通过其MAC地址跟踪客户端请求。|2225129|如果你在网段上有30个交换机，那么你将只添加30个单播包，服务器的30个回复都是相同的IP报价，以及30个对客户端的回复，这只会回复其中一个报价，完成接受握手。|2225130|因此，唯一真正的缺点是在网络的工作负载中增加了少量的单播通信，几乎不需要过多的开销，这是一个小问题。|2225131|然而，如前所述，在使用DHCP窥探限制每个交换机的广播时，它从“如果做了也不是什么大事”转向积极提供好处，减少不必要的广播流量，并通过DHCP限制DOS到各个交换机。|entityMap^0|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|R|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|S|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|T|8|@]|9|@]|A|$]]|$1|H|3|I|5|6|7|U|8|@]|9|@]|A|$]]|$1|J|3|K|5|6|7|V|8|@]|9|@]|A|$]]|$1|L|3|M|5|6|7|W|8|@]|9|@]|A|$]]|$1|N|3|O|5|6|7|X|8|@]|9|@]|A|$]]]|P|$]]

If you enable DHCP snooping to stop broadcasts between switches when enabling ip helper on those switches, it will allow you to terminate the DHCP broadcasting in the given switch, and send a single unicast onward through the remainder of the network.
This reduces the overhead of re-broadcasting the boot-p broadcasts through the rest of the switches that hold the given network segment, and thus reduces the impact of malicious or misconfigured clients from flooding the entire network segment with boot-p requests.
This will also help you locate the source switch where the device being plugged in is located, as it's local access switch will be the source of the unicast DHCP request received by the server.
If, however, you don't use DHCP, then while not providing these additional benefits, the additional overhead on any given network is negligible.
The Server will reply with only 1 IP address to the several unicast requests as a decently implemented DHCP server must needs track the client requests by their MAC addresses.
ie: If you have 30 switches on the segment, then you will only be adding 30 unicast packets out, 30 replies by the server all with the same IP offer, and 30 responses to the client, which will only reply to one of the offers, finishing the acceptance hand-shake.
Thus, the only real drawback is adding a small number of unicast communications for almost no over-head to the workload of the network, which is a minor matter.
However, as noted, when coupled with limiting the broadcasts per switch using DHCP snooping it moves from merely 'not a big deal if done' to actively providing benefits by reducing unneeded broadcast traffic and limiting DOS via DHCP to individual switches.

Just a dumb question..

I have 1 core switch and 5 access switches.

Just wondering if it would be best to setup the IP helper on all access switches rather than just on the core switch?

Does this take a lot of processing resources for about 400 desks?

Thanks!

IP Helper in Multiple Access Switches

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋

腾讯云代码助手

云原生构建

TAPD 敏捷项目管理

Cloud Studio

SDK中心

API中心

命令行工具

涵盖代码开发、场景应用、自动测试全流程，助你从零构建专属AI助手

一站式MCP教程库，解锁AI应用新玩法

一个愚蠢的问题..。我有一个核心交换机和5个接入交换机。只是想知道是否最好在所有接入交换机上设置IP助手，而不是仅仅在核心交换机上设置IP助手？这大约400张桌子需要大量的处理资源吗？谢谢!

问多接入交换机中的IP助手
EN

回答 6

Network Engineering用户

Network Engineering用户

Network Engineering用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问多接入交换机中的IP助手EN

回答 6

Network Engineering用户

Network Engineering用户

Network Engineering用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问多接入交换机中的IP助手
EN