Chapter 9
| General Security Measures
DHCPv4 Snooping
– 276 –
the binding table when it receives an ACK message from a DHCP server.
Also, when the switch sends out DHCP client packets for itself, no filtering
takes place. However, when the switch receives any messages from a
DHCP server, any packets received from untrusted ports are dropped.
Example
This example enables DHCP snooping globally for the switch.
Console(config)#ip dhcp snooping
Console(config)#
Related Commands
ip dhcp snooping vlan (282)
ip dhcp snooping trust (286)
ip dhcp snooping
information option
This command enables the use of DHCP Option 82 information for the switch,
and specifies the frame format to use for the remote-id when Option 82
information is generated by the switch. Use the
no
form without any keywords
to disable this function, the no form with the encode no-subtype keyword to
enable use of sub-type and sub-length in CID/RID fields, or the
no
form with
the
remote-id
keyword to set the remote ID to the switch’s MAC address
encoded in hexadecimal.
Syntax
ip dhcp snooping information option
[
encode no-subtype
] [
remote-id
{
ip-address
[
encode
{
ascii
|
hex
}] |
mac-address
[
encode
{
ascii
|
hex
}] |
string
string
}]
no ip dhcp snooping information option
[
encode no-subtype
]
[
remote-id
[
ip-address
encode
] | [
mac-address
encode
]]
encode
no-subtype
- Disables use of sub-type and sub-length
fields in circuit-ID (CID) and remote-ID (RID) in Option 82
information.
mac-address
- Inserts a MAC address in the remote ID sub-option
for the DHCP snooping agent (that is, the MAC address of the
switch’s CPU).
ip-address
- Inserts an IP address in the remote ID sub-option for
the DHCP snooping agent (that is, the IP address of the
management interface).
encode
- Indicates encoding in ASCII or hexadecimal.
string
- An arbitrary string inserted into the remote identifier field.
(Range: 1-32 characters)
