Chapter 4 Dhcp Snooping Configuration; Dhcp Snooping Overview; Introduction To Dhcp Snooping - H3C S5600 Series Operation Manual

Operation Manual – DHCP
H3C S5600 Series Ethernet Switches

Chapter 4 DHCP Snooping Configuration

When configuring DHCP snooping, go to these sections for information you are
interested in:

DHCP Snooping Overview

Configuring DHCP Snooping
DHCP Snooping Configuration Examples
Displaying DHCP Snooping Configuration
4.1 DHCP Snooping Overview

4.1.1 Introduction to DHCP Snooping

For the sake of security, the IP addresses used by online DHCP clients need to be
tracked for the administrator to verify the corresponding relationship between the IP
addresses the DHCP clients obtained from DHCP servers and the MAC addresses of
the DHCP clients.
Switches can track DHCP clients' IP addresses through the security function of the
DHCP relay agent operating at the network layer.
Switches can track DHCP clients' IP addresses through the DHCP snooping
function at the data link layer.
When an unauthorized DHCP server exists in the network, a DHCP client may obtains
an illegal IP address. To ensure that the DHCP clients obtain IP addresses from valid
DHCP servers, you can specify a port to be a trusted port or an untrusted port by the
DHCP snooping function.
Trusted: A trusted port is connected to an authorized DHCP server directly or
indirectly. It forwards DHCP messages to guarantee that DHCP clients can obtain
valid IP addresses.
Untrusted: An untrusted port is connected to an unauthorized DHCP server. The
DHCP-ACK or DHCP-OFFER packets received from the port are discarded,
preventing DHCP clients from receiving invalid IP addresses.
Figure 4-1
Switch A is an S5600 series Ethernet switch.
illustrates a typical network diagram for DHCP snooping application, where
Chapter 4 DHCP Snooping Configuration
4-1