Configuring DHCP Relay Configuring UDP Port Relay
OmniSwitch AOS Release 8 Network Configuration Guide December 2017 page 21-18
Switch-level DHCP Snooping
By default, DHCP Snooping is disabled for the switch. To enable this feature at the switch level, use the
dhcp-snooping admin-state command. For example:
-> dhcp-snooping admin-state enable
When DHCP Snooping is enabled at the switch level, all DHCP packets received on all switch ports are
screened/filtered by DHCP Snooping. By default, only client DHCP traffic is allowed on the ports, unless
the trust mode for a port is configured to block or allow all DHCP traffic. See “Configuring the Port Trust
Mode” on page 21-19 for more information.
In addition, the following functionality is also activated by default when switch-level DHCP Snooping is
enabled:
• The DHCP Snooping binding table is created and maintained. To configure the status or add a static
entry to this table, use the dhcp-snooping binding command.
• MAC address verification is performed to compare the source MAC address of the DHCP packet with
the client hardware address contained in the packet. To configure the status of MAC address
verification, use the dhcp-snooping mac-address-verification command.
• Option-82 data is inserted into the packet and then DHCP reply packets are only sent to the port from
where the DHCP request originated, instead of flooding these packets to all ports. To configure the
status of Option-82 data insertion, use the dhcp-snooping option-82-data-insertion command.
• The base MAC address of the switch is inserted into the Circuit ID and Remote ID suboptions of the
Option-82 field. To configure the type of data (base MAC address, system name, or user-defined) that
is inserted into the Option-82 suboptions, use the dhcp-snooping option-82 format command. The
system name and user-defined text are reported in ASCII text format, but the MAC address is still
reported in hex-based format.
VLAN-Level DHCP Snooping
To enable DHCP Snooping at the VLAN level, use the dhcp-snooping vlan command. For example, the
following command enables DHCP Snooping for VLAN 200:
-> dhcp-snooping vlan 200 admin-state enable
When this feature is enabled at the VLAN level, DHCP Snooping functionality is only applied to ports
that are associated with a VLAN that has this feature enabled. Up to 64 VLANs can have DHCP Snooping
enabled.
By default, when DHCP Snooping is enabled for a specific VLAN, MAC address verification and Option-
82 data insertion is also enabled for the VLAN by default. To disable or enable either of these two
features, use the dhcp-snooping vlan command with either the mac-address-verification or option-82-
data-insertion parameters. For example:
Note. On disabling DHCP Snooping functionality:
• Disabling Option-82 is not allowed if the binding table is enabled.
• Enabling the binding table is not allowed if Option-82 data insertion is not enabled at either the switch
or VLAN level.
Note. Enabling DHCP Snooping at the switch level is not allowed if it is enabled for one or more VLANs.
To Next Page
Loading...
