Table of Contents
Advertisement
Chapter 19
Configuring DHCP Features and IP Source Guard Features
Enabling DHCP Snooping and Option 82
Beginning in privileged EXEC mode, follow these steps to enable DHCP snooping on the switch:
Command
Step 1
configure terminal
Step 2
ip dhcp snooping
Step 3
ip dhcp snooping vlan vlan-range
Step 4
ip dhcp snooping information option
Step 5
ip dhcp snooping information option
allow-untrusted
Step 6
interface interface-id
Step 7
ip dhcp snooping trust
Step 8
ip dhcp snooping limit rate rate
Step 9
exit
Step 10
ip dhcp snooping verify mac-address
Step 11
end
Step 12
show running-config
Step 13
copy running-config startup-config
OL-23389-01
Purpose
Enter global configuration mode.
Enable DHCP snooping globally.
Enable DHCP snooping on a VLAN or range of VLANs. The range is
1 to 4094.
You can enter a single VLAN ID identified by VLAN ID number, a series
of VLAN IDs separated by commas, a range of VLAN IDs separated by
hyphens, or a range of VLAN IDs separated by entering the starting and
ending VLAN IDs separated by a space.
Enable the switch to insert and to remove DHCP relay information
(option-82 field) in forwarded DHCP request messages to the DHCP
server. This is the default setting.
(Optional) If the switch is an aggregation switch connected to an edge
switch, enable the switch to accept incoming DHCP snooping packets
with option-82 information from the edge switch.
The default setting is disabled.
Enter this command only on aggregation switches that are
Note
connected to trusted devices.
Specify the interface to be configured, and enter interface configuration
mode.
(Optional) Configure the interface as trusted or as untrusted. Use the no
keyword to configure an interface to receive messages from an untrusted
client. The default setting is untrusted.
(Optional) Configure the number of DHCP packets per second that an
interface can receive. The range is 1 to 2048. By default, no rate limit is
configured.
We recommend an untrusted rate limit of not more than 100
Note
packets per second. If you configure rate limiting for trusted
interfaces, you might need to increase the rate limit if the port is
a trunk port assigned to more than one VLAN with DHCP
snooping.
Return to global configuration mode.
(Optional) Configure the switch to verify that the source MAC address in
a DHCP packet received on untrusted ports matches the client hardware
address in the packet. The default is to verify that the source MAC
address matches the client hardware address in the packet.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Catalyst 2928 Switch Software Configuration Guide
Configuring DHCP Snooping
19-11
Advertisement
Table of Contents
Troubleshooting
