Ip Dhcp Snooping Trust - D-Link DGS-6600-48TS Manual

DGS-6604

ip dhcp snooping trust

ip dhcp snooping trust
no ip dhcp snooping trust
Default
Command Mode
Usage Guideline
Example
Switch(config)# interface eth3.3
Switch(config-if)# ip dhcp snooping trust
Switch(config)#
CLI Reference Guide
Use this command to configure a port as interface trusted for DHCP snooping.
Use the no form of this command to return to the default setting.
Disabled
Interface configuration
The command is available for physical port configuration.
Normally, the ports connected to DHCP server or to other switches should be
configured as a trusted interface. The ports connected to DHCP clients should be
configured as un-trusted interface.
When a port is configured as an un-trusted interface, the DHCP message arrives
at the port on a vlan that is enabled for DHCP and snooping will be validated by
the following checks.
(1)The received message should be all sent by the client. If the message is sent
by the DHCP server, the message will be dropped.
(2)If ip dhcp snooping verify mac-address is enabled, the source MAC in the
Ethernet header must be the same as the DHCP client hardware address to pass
the validation.
(3)For the received release and decline packets, the received port is also
checked against the binding database entry. The packet will be dropped if
inconsistent.
(4)If gateway address!=0 or option 82 is present, the packet is dropped
In addition to doing the validation, DHCP snooping also create a binding entry
based on the IP address assigned to client by the server in DHCP snooping
binding database. The binding entry contains information including MAC
address, IP address, the VLAN ID and port ID where the client is located, and the
expiry of the lease time.
This example shows how to enable DHCP snooping trust for port 3.3:
ip dhcp snooping trust
235