Dhcp Snooping Commands - D-Link DXS-1210-12TC Reference Manual

13. DHCP Snooping Commands

13-1
This command is used to configure a port as a trusted interface for DHCP snooping. Use the no form
of this command to revert to the default setting.
ip dhcp snooping trust
no ip dhcp snooping trust
Parameters
None.
Default
By default, this option is disabled.
Command Mode
Interface Configuration Mode.
Command Default Level
Level: 12.
Usage Guideline
This command is available for physical port and port-channel interface configuration.
Ports connected to the DHCP server or to other switches should be configured as trusted interfaces.
The ports connected to DHCP clients should be configured as untrusted interfaces. DHCP snooping
acts as a firewall between untrusted interfaces and DHCP servers.
When a port is configured as a untrusted interface, the DHCP message arrives at the port on a VLAN
that is enabled for DHCP snooping. The Switch forwards the DHCP packet unless any of the following
conditions occur (in which case the packet is dropped):
•
•
•
•
In addition to doing the validation, DHCP snooping also create a binding entry based on the IP
address assigned to client by the server in DHCP snooping binding database. The binding entry
contains information including MAC address, IP address, the VLAN ID and port ID where the client is
located, and the expiry of the lease time.
Example
This example shows how to enable DHCP snooping trust for port 3/0/3.
Switch# configure terminal
Switch(config)#interface eth3/0/3
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)#
DXS-1210 Series Smart Managed Switch CLI Reference Guide
ip dhcp snooping trust
The Switch port receives a packet (such as a DHCPOFFER, DHCPACK, or DHCPNAK
packet) from a DHCP server outside the firewall.
If ip dhcp snooping verify mac-address is enabled, the source MAC in the Ethernet header
must be the same as the DHCP client hardware address to pass the validation.
The untrusted interface receives a DHCP packet that includes a relay agent IP address that is
not 0.0.0.0 or the relay agent forward a packet that includes Option 82 to an untrusted
interface.
The router receives a DHCPRELEASE or DHCPDECLINE message from an untrusted host
with an entry in the DHCP snooping binding table, and the interface information in the binding
table does not match the interface on which the message was received.
104