Configuring Ip Filtering; Displaying Dhcp Snooping Configuration - H3C S5100-SI Operation Manual

Configuring IP Filtering

Follow these steps to configure IP filtering:
To do...
Enter system view
Enter Ethernet port view
Enable IP filtering
Create a static binding
Enable DHCP snooping and specify trusted ports on the switch before configuring IP filtering.
You are not recommended to configure IP filtering on the ports of an aggregation group.
To create a static binding after IP filtering is enabled with the mac-address keyword specified on a
port, the mac-address argument must be specified; otherwise, the packets sent from this IP
address cannot pass the IP filtering.
A static entry has a higher priority than the dynamic DHCP snooping entry that has the same IP
address as the static one. That is, if the static entry is configured after the dynamic entry is
recorded, the static entry overwrites the dynamic entry; if the static entry is configured before
DHCP snooping is enabled, no DHCP client can obtain the IP address of the static entry, that is, the
dynamic DHCP snooping entry cannot be generated.
The VLAN ID of the IP static binding configured on a port is the VLAN ID of the port.

Displaying DHCP Snooping Configuration

To do...
Display the user IP-MAC
address mapping entries
recorded by the DHCP
snooping function
Display the (enabled/disabled)
state of the DHCP snooping
function and the trusted ports
Display the IP static binding
table
Use the command...
system-view
interface interface-type
interface-number
ip check source ip-address
[ mac-address ]
ip source static binding
ip-address ip-address
[ mac-address mac-address ]
Use the command...
display dhcp-snooping [ unit
unit-id ]
display dhcp-snooping trust
display ip source static
binding [ vlan vlan-id |
interface interface-type
interface-number ]
3-10
Remarks
—
—
Required
By default, this function is
disabled.
Optional
By default, no static binding
entry is created.
Remarks
Available in any view