Configuration Guide 556
Configuring Network Security
DHCP Snooping Configuration
Step 5
end
Return to privileged EXEC mode.
Step 6
copy running-config startup-config
Save the settings in the configuration file.
The following example shows how to enable DHCP Snooping globally and on VLAN 5:
Switch#configure
Switch(config)#ip dhcp snooping
Switch(config)#ip dhcp snooping vlan
5
Switch(config)#show ip dhcp snooping
Global Status: Enable
VLAN ID: 5
Switch(config-if)#end
Switch#copy running-config startup-config
3.2.2 Configuring DHCP Snooping on Ports
Follow these steps to configure DHCP Snooping on the specified ports.
Step 1
configure
Enter global configuration mode.
Step 2
interface {
fastEthernet
port
|
range fastEthernet
port-list
|
gigabitEthernet
port
|
range
gigabitEthernet
port-list
|
interface port-channel
port-channel-id
|
interface range
port-
channel
port-channel-id-list
}
Enter interface configuration mode.
Step 3
ip dhcp snooping trust
Set the port that is connected to the DHCP server as a trusted port. The switch can forward
the DHCP packets on the trusted port and discard the DHCP response packets on the
distrusted port, so as to ensure that users get proper IP addresses from the legal DHCP
server.
Step 4
ip dhcp snooping mac-verify
Enable the MAC Verify feature. There are two fields in the DHCP packet that contain the
MAC address of the host. The MAC Verify feature compares the two fields of a DHCP
packet and discards the packet if the two fields are different. This prevents the IP address
resource on the DHCP server from being exhausted by forged MAC addresses.
