Cisco Catalyst 4500 Series Administration Guide

53-12
Software Configuration Guide—Release IOS XE 3.6.0E and IOS 15.2(2)E
OL_28731-01
Chapter 53 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
Configuring DHCP Snooping
This example shows how to configure the Option 82 circuit-ID override suboption:
Switch(config-if)# ip dhcp snooping vlan 250 information option format-type circuit-id
override string testcustomer
Enabling DHCP Snooping on Private VLAN
DHCP snooping can be enabled on private VLANs, which provide isolation between Layer 2 ports
within the same VLAN. If DHCP snooping is enabled (or disabled), the configuration is propagated to
both the primary VLAN and its associated secondary VLANs. You cannot enable (or disable) DHCP
snooping on a primary VLAN without reflecting this configuration change on the secondary VLANs.
Configuring DHCP snooping on a secondary VLAN is still allowed, but it does not take effect if the
associated primary VLAN is already configured. If the associated primary VLAN is configured, the
effective DHCP snooping mode on the secondary VLAN is derived from the corresponding primary
VLAN. Manually configuring DHCP snooping on a secondary VLAN causes the switch to issue this
warning message:
DHCP Snooping configuration may not take effect on secondary vlan XXX
The show ip dhcp snooping command displays all VLANs (both primary and secondary) that have
DHCP snooping enabled.
Configuring DHCP Snooping on Private VLAN
DHCP snooping, IPSG, and DAI are Layer 2-based security features that can be enabled and disabled
on an individual VLAN, including auxiliary or voice VLAN. You need to enable DHCP snooping on a
voice VLAN for a Cisco IP phone to function properly.
Configuring DHCP Snooping with an Ethernet Channel Group
When you configure DHCP snooping, you need to configure trunk interfaces that transmit DHCP packets
as trusted interfaces by adding ip dhcp snooping trust to the physical interface configuration. However,
if DHCP packets will be transmitted over an Ethernet channel group, you must configure
ip dhcp snooping trust on the logical port channel interface, for example:
Switch# show run int port-channel50
Building configuration...
Current configuration : 150 bytes
!
interface Port-channel50
switchport
switchport trunk native vlan 4092
switchport mode trunk
switchport nonegotiate
ip dhcp snooping trust
end
Switch#

Cisco Catalyst 4500 Series Specifications

General

Series	Catalyst 4500 Series
Category	Switch
Layer Support	Layer 2, Layer 3
Form Factor	Modular chassis
Stackable	No
Chassis Slots	3, 6, 7, 10
Power Supply Options	AC, DC
Redundancy	Power supply, Supervisor engine
Network Management	Cisco IOS Software CLI, SNMP, Cisco Prime Infrastructure
Features	Security, QoS
Port Density	Up to 384 ports per chassis
Security Features	802.1X, ACLs, DHCP Snooping, Dynamic ARP Inspection, IP Source Guard
Supervisor Engine	8-E