HP 5120 SI Series Security Configuration Manual page 310

Enable DHCP and DHCP snooping on the device, so that the host (with the MAC address of
0001-0203-0406) can obtain an IP address through the DHCP server and the IP address and MAC
address of the host can be recorded in a DHCP snooping entry.
Enable the dynamic IPv4 source guard on port GigabitEthernet 1/0/1 of the device, allowing only
packets from a client that obtains an IP address through the DHCP server to pass.
NOTE:
For detailed configuration of a DHCP server, see the
Figure 101 Network diagram
Configuration procedure
Configure DHCP snooping
1.
# Configure IP addresses for the interfaces. (Omitted)
# Enable DHCP snooping.
<Device> system-view
[Device] dhcp-snooping
# Configure port GigabitEthernet 1/0/2, which is connected to the DHCP server, as a trusted port.
[Device] interface gigabitethernet1/0/2
[Device-GigabitEthernet1/0/2] dhcp-snooping trust
[Device-GigabitEthernet1/0/2] quit
2. Configure the dynamic IPv4 source guard
# Configure dynamic IPv4 source guard on port GigabitEthernet 1/0/1 to filter packets based on both
the source IP address and MAC address.
[Device] interface gigabitethernet1/0/1
[Device-GigabitEthernet1/0/1] ip check source ip-address mac-address
[Device-GigabitEthernet1/0/1] quit
Verification
# Display IPv4 source guard entries on port GigabitEthernet 1/0/1.
[Device-GigabitEthernet1/0/1] display ip check source
Total entries found: 1
MAC Address
0001-0203-0406
# Display DHCP snooping entries on GigabitEthernet 1/0/1.
[Device-GigabitEthernet1/0/1] display dhcp-snooping
DHCP Snooping is enabled.
The client binding table for all untrusted ports.
Type : D--Dynamic , S--Static
Type IP Address
==== =============== ============== ============ ==== =================
IP Address VLAN
192.168.0.1 1
MAC Address Lease
298
Layer 3—IP Services Configuration Guide.
Interface
GE1/0/1
VLAN Interface
Type
DHCP-SNP