Edge-Core ECS4110-28T, Management Manual, Page: 931 / 1514

C
HAPTER
25
| General Security Measures
DHCPv6 Snooping
– 931 –
C
OMMAND
U
SAGE
When the switch receives DHCPv6 packets from clients that already include
DHCP Option 37 information, the switch can be configured to set the action
policy for these packets. The switch can either drop the DHCPv6 packets,
keep the existing information, or replace it with the switch’s relay agent
information.
E
XAMPLE
This example configures the switch to keep existing remote-id option 37
information within DHCPv6 client packets and forward it.
Console(config)#ipv6 dhcp snooping option remote-id policy replace
Console(config)#
ipv6 dhcp snooping
vlan
This command enables DHCPv6 snooping on the specified VLAN. Use the
no form to restore the default setting.
S
YNTAX
[ no ] ipv6 dhcp snooping vlan { vlan-id | vlan-range }
vlan-id - ID of a configured VLAN (Range: 1-4094)
vlan-range - A consecutive range of VLANs indicated by the use a
hyphen, or a random group of VLANs with each entry separated by
a comma.
D
EFAULT
S
ETTING
Disabled
C
OMMAND
M
ODE
Global Configuration
C
OMMAND
U
SAGE
◆
When DHCPv6 snooping enabled globally using the ipv6 dhcp snooping
command, and enabled on a VLAN with this command, DHCPv6 packet
filtering will be performed on any untrusted ports within the VLAN as
specified by the ipv6 dhcp snooping trust command.
◆
When the DHCPv6 snooping is globally disabled, DHCPv6 snooping can
still be configured for specific VLANs, but the changes will not take
effect until DHCPv6 snooping is globally re-enabled.
◆
When DHCPv6 snooping is enabled globally, and then disabled on a
VLAN, all dynamic bindings learned for this VLAN are removed from the
binding table.