Table of Contents
Advertisement
| General Security Measures
C
26
HAPTER
DHCP Snooping
ip dhcp snooping
verify mac-address
C
U
OMMAND
SAGE
When the switch receives DHCP packets from clients that already include
DHCP Option 82 information, the switch can be configured to set the action
policy for these packets. The switch can either drop the DHCP packets,
keep the existing information, or replace it with the switch's relay
information.
E
XAMPLE
Console(config)#ip dhcp snooping information policy drop
Console(config)#
This command verifies the client's hardware address stored in the DHCP
packet against the source MAC address in the Ethernet header. Use the no
form to disable this function.
S
YNTAX
[no] ip dhcp binding verify mac-address
D
S
EFAULT
ETTING
Enabled
C
M
OMMAND
ODE
Global Configuration
C
U
OMMAND
SAGE
If MAC address verification is enabled, and the source MAC address in the
Ethernet header of the packet is not same as the client's hardware address
in the DHCP packet, the packet is dropped.
E
XAMPLE
This example enables MAC address verification.
Console(config)#ip dhcp snooping verify mac-address
Console(config)#
R
C
ELATED
OMMANDS
ip dhcp snooping (770)
ip dhcp snooping vlan (775)
ip dhcp snooping trust (775)
– 774 –
Advertisement
Table of Contents
Troubleshooting
