389
Cisco Systems, Inc. www.cisco.com
Configuring DHCP
Information About Configuring DHCP
This chapter describes how to configure Dynamic Host Configuration Protocol (DHCP) snooping and option-82 data
insertion, and the DHCP server port-based address allocation features on the switch. It also describes how to configure
the IP source guard feature.
DHCP Snooping
DHCP is widely used in LAN environments to dynamically assign host IP addresses from a centralized server, which
significantly reduces the overhead of administration of IP addresses. DHCP also helps conserve the limited IP address
space because IP addresses no longer need to be permanently assigned to hosts; only those hosts that are connected
to the network consume IP addresses.
DHCP Server
The DHCP server assigns IP addresses from specified address pools on a switch or router to DHCP clients and manages
them. If the DHCP server cannot give the DHCP client the requested configuration parameters from its database, it
forwards the request to one or more secondary DHCP servers defined by the network administrator.
DHCP Relay Agent
A DHCP relay agent is a Layer 3 device that forwards DHCP packets between clients and servers. Relay agents forward
requests and replies between clients and servers when they are not on the same physical subnet. Relay agent forwarding
is different from the normal Layer 2 forwarding, in which IP datagrams are switched transparently between networks.
Relay agents receive DHCP messages and generate new DHCP messages to send on output interfaces.
DHCP Snooping
DHCP snooping is a DHCP security feature that provides network security by filtering untrusted DHCP messages and by
building and maintaining a DHCP snooping binding database, also referred to as a DHCP snooping binding table.
DHCP snooping acts like a firewall between untrusted hosts and DHCP servers. You use DHCP snooping to differentiate
between untrusted interfaces connected to the end user and trusted interfaces connected to the DHCP server or another
switch.
Note: For DHCP snooping to function properly, all DHCP servers must be connected to the switch through trusted
interfaces.
An untrusted DHCP message is a message that is received from outside the network or firewall. When you use DHCP
snooping in a service-provider environment, an untrusted message is sent from a device that is not in the
service-provider network, such as a customer’s switch. Messages from unknown devices are untrusted because they
can be sources of traffic attacks.
To Next Page
Loading...
Need help?
General