Dhcp Snooping Overview; Chapter 6 Dhcp Snooping Configuration - Huawei Quidway S3500 Series Operation Manual

Operation Manual - Network Protocol
Quidway S3500 Series Ethernet Switches

Chapter 6 DHCP Snooping Configuration

Note:
This chapter only applies to S3552G, S3552P, S3528G, S3528P, S3552F, S3526E,
S3526E FM, S3526E FS and S3526C in S3500 series switches.

6.1 DHCP Snooping Overview

For security, the IP addresses used by online users may be recorded to confirm the
association between the users' IP addresses and their MAC addresses. The Layer 3
switch records the IP addresses obtained by the clients with DHCP relay, while the
Layer 2 switch listens to the DHCP broadcast packets for this purpose.
The client broadcasts DHCPREQUEST packet to request DHCP server to assign
address. So snooping DHCPREQUEST is a way to know the clients' IP
addresses.
To assign IP addresses to the clients, DHCP server transmits DHCPACK packets.
After receiving the packets, the client can obtain an IP address. The IP address
requested through DHCPREQUEST is the same as that assigned through
DHCPACK. So snooping DHCPACK is another way to know the clients' IP
addresses.
In addition, pseudo-DHCP servers in the network may cause users to get incorrect IP
addresses. To guarantee that users can obtain IP address from the legal DHCP servers,
DHCP-Snooping allows ports to be set as trusted or distrusted. The former ports
connect DHCP servers or other switches and the latter ports connect users or network.
Distrusted ports discard the DHCPACK and DHCPOFF packets from DHCP servers,
whereas trusted ports forward these types of packets. In this way, users can get correct
IP address.
Note:
The S3500 series provide Layer 3 functions (DHCP relay can be enabled on them), but
DHCP snooping is a Layer 2 function. Therefore, you must first disable DHCP relay (no
DHCP server is configured on any Layer 3 port) before enabling DHCP snooping.
Huawei Technologies Proprietary
6-1
Chapter 6 DHCP Snooping Configuration