Chapter 24: General Security Measures
DHCPv4 Snooping
– 845 –
•
If a DHCP packet from a client passes the filtering criteria above, it
will only be forwarded to trusted ports in the same VLAN.
•
If a DHCP packet is from server is received on a trusted port, it will
be forwarded to both trusted and untrusted ports in the same VLAN.
•
If DHCP snooping is globally disabled, all dynamic bindings are
removed from the binding table.
•
Additional considerations when the switch itself is a DHCP client
– The
port(s) through which the switch submits a client request to the DHCP
server must be configured as trusted (using the
command). Note that the switch will not add a dynamic entry for itself
to the binding table when it receives an ACK message from a DHCP
server. Also, when the switch sends out DHCP client packets for itself,
no filtering takes place. However, when the switch receives any
messages from a DHCP server, any packets received from untrusted
ports are dropped.
E
XAMPLE
This example enables DHCP snooping globally for the switch.
Console(config)#ip dhcp snooping
Console(config)#
R
ELATED
C
OMMANDS
ip dhcp snooping
information option
This command enables the use of DHCP Option 82 information for the
switch, and specifies the frame format to use for the remote-id when
Option 82 information is generated by the switch. Use the
no
form without
any keywords to disable this function, the no form with the encode no-
subtype keyword to enable use of sub-type and sub-length in CID/RID
fields, or the
no
form with the
remote-id
keyword to set the remote ID to
the switch’s MAC address encoded in hexadecimal.
S
YNTAX
ip dhcp snooping information option
[
encode no-subtype
]
[
remote-id
{
ip-address
[
encode
{
ascii
|
hex
}] |
mac-address
[
encode
{
ascii
|
hex
}] |
string string
}]
no ip dhcp snooping information option
[
encode no-subtype
]
[
remote-id
[
ip-address
encode
] | [
mac-address
encode
]]
encode no-subtype - Disables use of sub-type and sub-length fields
in circuit-ID (CID) and remote-ID (RID) in Option 82 information.
mac-address
- Inserts a MAC address in the remote ID sub-option
for the DHCP snooping agent (that is, the MAC address of the
switch’s CPU).
Summary of Contents for SSE-G2252
Page 42: ...44 General IP Routing on page 627...
Page 603: ...Chapter 16 IP Configuration Setting the Switch s IP Address IP Version 6 609...
Page 883: ...Chapter 24 General Security Measures Port based Traffic Segmentation 894...
Page 989: ...Chapter 30 Congestion Control Commands Automatic Traffic Control Commands 1000 Console...
Page 1007: ...Chapter 33 Address Table Commands 1019...
Page 1137: ...Chapter 38 Quality of Service Commands 1150...
