Displaying Dhcp Snooping Status And Ports; Dhcp Snooping Configuration Example; Ip Source Guard - Dell PowerConnect B-RX Configuration Manual

35

IP source guard

Displaying DHCP snooping status and ports

To display the DHCP snooping status for a VLAN and the trusted or untrusted ports in the VLAN,
enter the following command.
BigIron RX#show ip dhcp snooping vlan 172
IP DHCP snooping VLAN 172: Enabled
Trusted Ports : ethe 5/2 ethe 5/4
Untrusted Ports : ethe 4/24 ethe 9/4 to 9/5 ethe 9/12 ethe 9/14
Syntax: show ip dhcp snooping [vlan <vlan-id>]

DHCP snooping configuration example

The following example configures VLAN 2 and VLAN 20, and changes the CLI to the global
configuration level to enable DHCP snooping on the two VLANs. The commands are as follows.
BigIron RX(config)#vlan 2
BigIron RX(config-vlan-2)#untagged ethe 1/3 to 1/4
BigIron RX(config-vlan-2)#router-interface ve 2
BigIron RX(config-vlan-2)#exit
BigIron RX(config)# ip dhcp snooping vlan 2
BigIron RX(config)#vlan 20
BigIron RX(config-vlan-20)#untagged ethe 1/1 to 1/2
BigIron RX(config-vlan-20)#router-interface ve 20
BigIron RX(config-vlan-20)#exit
BigIron RX(config)#ip dhcp snooping vlan 20
On VLAN 2, client ports 1/3 and 1/4 are untrusted by default, all client ports are untrusted. Hence,
only DHCP client request packets received on ports 1/3 and 1/4 are forwarded.
On VLAN 20, ports 1/1 and 1/2 are connected to a DHCP server. DHCP server ports are set to
trusted.
BigIron RX(config)#interface ethernet 1/1
BigIron RX(config-if-e1000-1/1)#dhcp snooping trust
BigIron RX(config-if-e1000-1/1)#exit
BigIron RX(config)#interface ethernet 1/2
BigIron RX(config-if-e1000-1/2)#dhcp snooping trust
BigIron RX(config-if-e1000-1/2)#exit
Hence, DHCP sever reply packets received on ports 1/1 and 1/2 are forwarded, and client IP/MAC
binding information is collected.
The example also sets the DHCP server address for the local relay agent.
BigIron RX(config)# interface ve 2
BigIron RX(config-vif-2)#ip address 20.20.20.1/24
BigIron RX(config-vif-2)#ip helper-address 30.30.30.4
BigIron RX(config-vif-2)#interface ve 20
BigIron RX(config-vif-20)#ip address 30.30.30.1/24
IP source guard
You can use IP Source Guard together with Dynamic ARP Inspection on untrusted ports. Refer to
"DHCP snooping"
1010
on page 1006 and "Dynamic ARP inspection" on page 1001.
BigIron RX Series Configuration Guide
53-1002253-01