Alcatel-Lucent OmniSwitch 9900 Series Network Configuration Manual page 498

Configuring DHCP Relay
Switch-level DHCP Snooping
By default, DHCP Snooping is disabled for the switch. To enable this feature at the switch level, use the
dhcp-snooping admin-state
-> dhcp-snooping admin-state enable
When DHCP Snooping is enabled at the switch level, all DHCP packets received on all switch ports are
screened/filtered by DHCP Snooping. By default, only client DHCP traffic is allowed on the ports, unless
the trust mode for a port is configured to block or allow all DHCP traffic. See
Mode" on page 21-19
In addition, the following functionality is also activated by default when switch-level DHCP Snooping is
enabled:
•
The DHCP Snooping binding table is created and maintained. To configure the status or add a static
entry to this table, use the
•
MAC address verification is performed to compare the source MAC address of the DHCP packet with
the client hardware address contained in the packet. To configure the status of MAC address
verification, use the
•
Option-82 data is inserted into the packet and then DHCP reply packets are only sent to the port from
where the DHCP request originated, instead of flooding these packets to all ports. To configure the
status of Option-82 data insertion, use the
•
The base MAC address of the switch is inserted into the Circuit ID and Remote ID suboptions of the
Option-82 field. To configure the type of data (base MAC address, system name, or user-defined) that
is inserted into the Option-82 suboptions, use the
system name and user-defined text are reported in ASCII text format, but the MAC address is still
reported in hex-based format.
Note. On disabling DHCP Snooping functionality:
•
Disabling Option-82 is not allowed if the binding table is enabled.
•
Enabling the binding table is not allowed if Option-82 data insertion is not enabled at either the switch
or VLAN level.
VLAN-Level DHCP Snooping
To enable DHCP Snooping at the VLAN level, use the
following command enables DHCP Snooping for VLAN 200:
-> dhcp-snooping vlan 200 admin-state enable
When this feature is enabled at the VLAN level, DHCP Snooping functionality is only applied to ports
that are associated with a VLAN that has this feature enabled. Up to 64 VLANs can have DHCP Snooping
enabled.
Note. Enabling DHCP Snooping at the switch level is not allowed if it is enabled for one or more VLANs.
By default, when DHCP Snooping is enabled for a specific VLAN, MAC address verification and Option-
82 data insertion is also enabled for the VLAN by default. To disable or enable either of these two
features, use the dhcp-snooping vlan
data-insertion parameters. For example:
OmniSwitch AOS Release 8 Network Configuration Guide
command. For example:
for more information.
dhcp-snooping binding
dhcp-snooping mac-address-verification
dhcp-snooping option-82-data-insertion
command with either the mac-address-verification or option-82-
command.
command.
dhcp-snooping option-82 format
dhcp-snooping vlan command. For example, the
December 2017
Configuring UDP Port Relay
"Configuring the Port Trust
command.
command. The
page 21-18