9
Configuring DHCP snooping
Introduction
The following example describes the basic procedure to configure DHCP snooping.
Network configuration
As shown in
, the switch is connected to the authorized DHCP server through
GigabitEthernet 1/0/1, to the unauthorized DHCP server through GigabitEthernet 1/0/3, and to the
DHCP client through GigabitEthernet 1/0/2. Configure the network to meet the following
requirements:
•
Only the port connected to the authorized DHCP server can forward the responses from the
DHCP server.
•
The DHCP snooping device records clients' IP-to-MAC bindings by reading DHCP-ACK
messages received from the trusted port and the DHCPREQUEST messages.
Figure 3 Network diagram
Procedure
# Enable global DHCP snooping.
<Switch> system-view
[Switch] dhcp snooping enable
# Configure GigabitEthernet 1/0/1 as a trusted port.
[Switch] interface gigabitethernet 1/0/1
[Switch-GigabitEthernet1/0/1] dhcp snooping trust
[Switch-GigabitEthernet1/0/1] quit
# Enable recording clients' IP-to-MAC bindings on GigabitEthernet 1/0/2.
[Switch] interface gigabitethernet 1/0/2
[Switch-GigabitEthernet1/0/2] dhcp snooping binding record
[Switch-GigabitEthernet1/0/2] quit
GE1/0/1
DHCP server
Switch
DHCP snooping
GE1/0/2
GE1/0/3
Unauthorized
DHCP server
