C
HAPTER
25
| General Security Measures
DHCP Snooping
– 677 –
COMMAND MODE
Global Configuration
COMMAND USAGE
◆ DHCP provides a relay mechanism for sending information about the
switch and its DHCP clients to the DHCP server. Known as DHCP Option
82, it allows compatible DHCP servers to use the information when
assigning IP addresses, or to set other services or policies for clients.
◆ When the DHCP Snooping Information Option is enabled, the
requesting client (or an intermediate relay agent that has used the
information fields to describe itself) can be identified in the DHCP
request packets forwarded by the switch and in reply packets sent back
from the DHCP server.
◆ When the DHCP Snooping Information Option is enabled, clients can be
identified by the switch port to which they are connected rather than
just their MAC address. DHCP client-server exchange messages are
then forwarded directly between the server and client without having to
flood them to the entire VLAN.
◆ DHCP snooping must be enabled for the DHCP Option 82 information to
be inserted into packets. When enabled, the switch will only add/
remove option 82 information in incoming DCHP packets but not relay
them. Packets are processed as follows:
■
If an incoming packet is a DHCP request packet with option 82
information, it will modify the option 82 information according to
settings specified with ip dhcp snooping information policy
command.
■
If an incoming packet is a DHCP request packet without option 82
information, enabling the DHCP snooping information option will
add option 82 information to the packet.
■
If an incoming packet is a DHCP reply packet with option 82
information, enabling the DHCP snooping information option will
remove option 82 information from the packet.
EXAMPLE
This example enables the DHCP Snooping Information Option.
Console(config)#ip dhcp snooping information option
Console(config)#
To Next Page
Loading...
