Edge-Core ECS4810-12M Layer 2, Management Manual

Page: 373 / 1236

C
HAPTER
14
| Security Measures
DHCP Snooping
– 373 –
the DHCP client request, including the port and VLAN ID. This allows
DHCP client-server exchange messages to be forwarded between the
server and client without having to flood them to the entire VLAN.
◆
If DHCP Snooping Information Option 82 is enabled on the switch,
information may be inserted into a DHCP request packet received over
any VLAN (depending on DHCP snooping filtering rules). The
information inserted into the relayed packets includes the circuit-id and
remote-id, as well as the gateway Internet address.
◆
When the switch receives DHCP packets from clients that already
include DHCP Option 82 information, the switch can be configured to
set the action policy for these packets. The switch can either drop the
DHCP packets, keep the existing information, or replace it with the
switch’s relay information.
DHCP S
NOOPING
C
ONFIGURATION
Use the IP Service > DHCP > Snooping (Configure Global) page to enable
DHCP Snooping globally on the switch, or to configure MAC Address
Verification.
CLI R
EFERENCES
◆
"DHCP Snooping" on page 769
P
ARAMETERS
These parameters are displayed:
◆
DHCP Snooping Status – Enables DHCP snooping globally.
(Default: Disabled)
◆
DHCP Snooping MAC-Address Verification – Enables or disables
MAC address verification. If the source MAC address in the Ethernet
header of the packet is not same as the client's hardware address in the
DHCP packet, the packet is dropped. (Default: Enabled)
◆
DHCP Snooping Information Option Status – Enables or disables
DHCP Option 82 information relay. (Default: Disabled)
◆
DHCP Snooping Information Option Policy – Specifies how to
handle DHCP client request packets which already contain Option 82
information.
■
Drop – Drops the client’s request packet instead of relaying it.
■
Keep – Retains the Option 82 information in the client request, and
forwards the packets to trusted ports.
■
Replace – Replaces the Option 82 information circuit-id and
remote-id fields in the client’s request with information about the
relay agent itself, inserts the relay agent’s address (when DHCP
snooping is enabled), and forwards the packets to trusted ports.
(This is the default policy.)