Preserving Dhcp Option 82; Verifying The Dhcp Relay Configuration - Cisco 7604 Configuration Manual

Chapter 8 Configuring IP Routing and DHCP Services
hostname(config)# dhcprelay setroute inside2
The following example enables the FWSM to forward DHCP requests from clients connected to the
inside1 interface (on vlan 20) to an interface-specific DHCP server (on the outside interface). The
inside2 interface uses the global DHCP servers on the outside and DMZ interfaces. Note that the global
DHCP server on the outside interface is the same as the interface-specific server for inside1
hostname(config)# interface vlan 20
hostname(config-if)# dhcprelay server 209.165.200.225
hostname(config)# dhcprelay server 209.165.200.225 outside
hostname(config)# dhcprelay server 209.165.201.4 dmz
hostname(config)# dhcprelay enable inside1
hostname(config)# dhcprelay setroute inside1
hostname(config)# dhcprelay enable inside2
hostname(config)# dhcprelay setroute inside2

Preserving DHCP Option 82

This section describes the DHCP option 82 feature. This feature enables the DHCP relay agent to include
information about itself and the attached client when forwarding DHCP requests from a DHCP client to
a DHCP server.
If the DHCP relay agent receives a DHCP packet from untrusted sources with option 82 already set, but
the giaddr (the DHCP relay agent address that will be set by the relay agent before it forwards the packet
to the server) field set to zero, or when it is behind DSLAM devices, then it will drop that packet by
default. You can optionally preserve option 82 and forward the packet by identifying an interface as a
trusted interface. This feature makes sure that DHCP snooping and IP source guard features on the
switch work along with the FWSM.
DHCP snooping is a DHCP security feature that provides network security by filtering untrusted DHCP
messages and by building and maintaining a DHCP snooping binding table.
You can enable this feature on interfaces configured with IPv4 and IPv6 addresses.
To configure a particular interface as a trusted interface that preserves option 82, enter the following
commands:
hostname(config)# interface interface {vlan vlan_id | mapped_name}
hostname(config-if)# dhcprelay information trusted
To configure all interfaces as trusted interfaces, enter the following command:
hostname(config)# dhcprelay information trust-all
All the interfaces will be set as trusted interfaces except interfaces which are shared and the interface on
which the DHCP server is configured.
The interface-specific trusted configuration and global trusted configuration can exist together. For
example there are three interfaces A, B and C, and a user configures interface A as trusted using the
interface-specific command.Then the user configures the global command also.
Now all the three interfaces A, B, and C are trusted interfaces. If you enter the no dhcprelay
information trust-all command, then interfaces B and C will become non-trusted interfaces. Interface
A will continue to be a trusted interface, since the interface-specific trusted configuration is not removed.

Verifying the DHCP Relay Configuration

To view the interface-specific DHCP relay configuration, enter the following command:
hostname# show running-config dhcprelay interface [vlan vlan_id | mapped_name]
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
Configuring DHCP
.
8-41