D-Link DGS-1510 Series Reference Manual page 178

DGS-1510 Series Gigabit Ethernet SmartPro Switch CLI Reference Guide
Command Default Level
Level: 12.
Usage Guideline
This command is available for physical port and port-channel interface configuration.
Ports connected to the DHCP server or to other switches should be configured as trusted interfaces.
The ports connected to DHCP clients should be configured as untrusted interfaces. DHCP snooping
acts as a firewall between untrusted interfaces and DHCP servers.
When a port is configured as a untrusted interface, the DHCP message arrives at the port on a VLAN
that is enabled for DHCP snooping. The Switch forwards the DHCP packet unless any of the following
conditions occur (in which case the packet is dropped):

The Switch port receives a packet (such as a DHCPOFFER, DHCPACK, or DHCPNAK
packet) from a DHCP server outside the firewall.

If ip dhcp snooping verify mac-address is enabled, the source MAC in the Ethernet header
must be the same as the DHCP client hardware address to pass the validation.

The untrusted interface receives a DHCP packet that includes a relay agent IP address that is
not 0.0.0.0 or the relay agent forward a packet that includes Option 82 to an untrusted
interface.

The router receives a DHCPRELEASE or DHCPDECLINE message from an untrusted host
with an entry in the DHCP snooping binding table, and the interface information in the binding
table does not match the interface on which the message was received.
In addition to doing the validation, DHCP snooping also create a binding entry based on the IP
address assigned to client by the server in DHCP snooping binding database. The binding entry
contains information including MAC address, IP address, the VLAN ID and port ID where the client is
located, and the expiry of the lease time.
Example
This example shows how to enable DHCP snooping trust for port 3/0/3.
Switch# configure terminal
Switch(config)# interface eth3/0/3
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)#
18-9 ip dhcp snooping limit entries
This command is used to configure the number of the DHCP snooping binding entries that an
interface can learn. Use the no form of this command to reset the DHCP message entry limit.
ip dhcp snooping limit entries NUMBER
no ip dhcp snooping limit entries
Parameters
NUMBER
Default
By default, this option is no-limit.
Command Mode
Interface Configuration Mode.
Command Default Level
Level: 12.
Specifies the number of DHCP snooping binding entries limited on a
port. The range of value is from 0 to 1024.
175