H3C S5100-SI Operation Manual page 351

user end and the MAC address of the user end do not match any entries (including the entries
dynamically tracked by the DHCP relay agent and the manually configured static entries) in the user
address table on the DHCP relay agent.
Follow these steps to configure address checking:
To do...
Enter system view
Create a static
IP-to-MAC binding
Enter interface view
Enable the address
checking function
The address-check enable command is independent of other commands of the DHCP relay
agent. That is, the invalid address check takes effect when this command is executed, regardless
of whether other commands (such as the command to enable DHCP) are used.
Before executing the address-check enable command on the interface connected to the DHCP
server, you need to configure the static binding of the IP address to the MAC address of the DHCP
server. Otherwise, the DHCP client will fail to obtain an IP address.
Enabling unauthorized DHCP server detection
If there is an unauthorized DHCP server in the network, when a client applies for an IP address, the
unauthorized DHCP server may assign an incorrect IP address to the DHCP client.
With this feature enabled, upon receiving a DHCP message with the siaddr field (IP addresses of the
servers offering IP addresses to the client) not being 0 from a client, the DHCP relay agent will record
the value of the siaddr field and the receiving interface. The administrator can use this information to
check out any DHCP unauthorized servers.
Follow these steps to enable unauthorized DHCP server detection:
To do...
Enter system view
Enable unauthorized DHCP
server detection
Use the command...
system-view
dhcp-security static
ip-address mac-address
interface interface-type
interface-number
address-check enable
Use the command...
system-view
dhcp-server detect
1-5
Remarks
—
Optional
Not created by default.
—
Required
Disabled by default.
Remarks
—
Required
Disabled by default.