Configuring Dhcp Snooping; Overview Of Dhcp Snooping - Cisco WS-SUP32-GE-3B - Supervisor Engine 32 Software Configuration Manual

Configuring DHCP Snooping

This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping on
Catalyst 6500 series switches.
This chapter consists of the following major sections:
•
•
•
Note For complete syntax and usage information for the commands used in this chapter, refer to the
Catalyst Supervisor Engine 32 PISA Cisco IOS Command Reference, Release 12.2ZY, at this URL:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2ZY/command/reference/cmdref.h
tml

Overview of DHCP Snooping

DHCP snooping is a DHCP security feature that provides network security by filtering untrusted DHCP
messages and by building and maintaining a DHCP snooping binding database (also referred to as a
DHCP snooping binding table).
DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You can use DHCP
snooping to differentiate between untrusted interfaces connected to the end user and trusted interfaces
connected to the DHCP server or another switch.
Note For DHCP snooping to function properly, all DHCP servers must be connected to the switch through
trusted interfaces, as untrusted DHCP messages will be forwarded only to trusted interfaces.
An untrusted message is a message that is received from outside the network or firewall. When you use
DHCP snooping in a service-provider environment, an untrusted message is sent from a device that is
not in the service-provider network, such as a customer's switch. Messages from unknown devices are
untrusted because they can be sources of traffic attacks.
OL-11439-03
Overview of DHCP Snooping, page 34-1
Default Configuration for DHCP Snooping, page 34-5
Configuring DHCP Snooping, page 34-7
Catalyst Supervisor Engine 32 PISA Cisco IOS Software Configuration Guide, Release 12.2ZY
34
C H A P T E R
34-1