Cisco Catalyst 3750-X Software Configuration Manual page 635

Chapter 24 Configuring DHCP Features and IP Source Guard
Command
Step 6
ip dhcp snooping information option
allow-untrusted
Step 7
interface interface-id
Step 8
ip dhcp snooping vlan vlan information
option format-type circuit-id
[override] string ASCII-string
Step 9 ip dhcp snooping trust
Step 10 ip dhcp snooping limit rate rate
Step 11 exit
Step 12
ip dhcp snooping verify mac-address
Step 13 end
Step 14
show running-config
Step 15
copy running-config startup-config
To disable DHCP snooping, use the no ip dhcp snooping global configuration command. To disable
DHCP snooping on a VLAN or range of VLANs, use the no ip dhcp snooping vlan vlan-range global
configuration command. To disable the insertion and removal of the option-82 field, use the no ip dhcp
snooping information option global configuration command. To configure an aggregation switch to
drop incoming DHCP snooping packets with option-82 information from an edge switch, use the no ip
dhcp snooping information option allow-untrusted global configuration command.
OL-21521-01
Purpose
(Optional) If the switch is an aggregation switch connected to an edge
switch, enable the switch to accept incoming DHCP snooping packets
with option-82 information from the edge switch.
The default setting is disabled.
Enter this command only on aggregation switches that are
Note
connected to trusted devices.
Specify the interface to be configured, and enter interface configuration
mode.
(Optional) Configure the circuit-ID suboption for the specified interface.
Specify the VLAN and port identifier, using a VLAN ID in the range of 1
to 4094. The default circuit ID is the port identifier, in the format
vlan-mod-port.
You can configure the circuit ID to be a stri n g of 3 to 63 ASCII characters
(no spaces).
(Optional) Use the override keyword when you do not want the
circuit-ID suboption inserted in TLV format to define subscriber
information.
(Optional) Configure the interface as trusted or untrusted. Use the no
keyword to configure an interface to receive messages from an untrusted
client. The default setting is untrusted.
(Optional) Configure the number of DHCP packets per second that an
interface can receive. The range is 1 to 2048. By default, no rate limit is
configured.
We recommend an untrusted rate limit of not more than 100
Note
packets per second. If you configure rate limiting for trusted
interfaces, you might need to increase the rate limit if the port is
a trunk port assigned to more than one VLAN with DHCP
snooping.
Return to global configuration mode.
(Optional) Configure the switch to verify that the source MAC address in
a DHCP packet received on untrusted ports matches the client hardware
address in the packet. The default is to verify that the source MAC
address matches the client hardware address in the packet.
Return to privileged EXEC mode.
Verify your entries.
(Optional) Save your entries in the configuration file.
Catalyst 3750-X and 3560-X Switch Software Configuration Guide
Configuring DHCP Features
24-13