set dhcpsnooping trust
17-6 DHCP Snooping and Dynamic ARP Inspection
Mode
Switchcommand,read‐write.
Usage
Whenaswitchlearnsofnewbindingsorwhenitlosesbindings,theswitchupdatestheentriesin
thebindingsdatabaseaccordingtothewritedelaytimer.Theswitchalsoupdatestheentriesin
thebindingfile.The frequencyatwhichthefileisupdatedisbasedonthedelayconfigured
with
thiscommand,andtheupdatesarebatched.
Example
Thefollowingexamplespecifies thatthestoreddatabaseshouldbeupdatedonceanhour.
B5(rw)->set dhcpsnooping database write-delay 3600
set dhcpsnooping trust
UsethiscommandtoenableordisableaportasaDHCPsnoopingtrustedport.
Syntax
set dhcpsnooping trust port port-string {enable | disable}
Parameters
Defaults
Bydefault,portsareuntrusted.
Mode
Switchcommand,read‐write.
Usage
InorderforDHCPsnoopingtooperate,snoopinghastobeenabledgloballyandonspecific
VLANs,andtheportswithintheVLANshavetobeconfiguredastrustedoruntrusted.On
trustedports,DHCPclientmessagesareforwardeddirectlybythehardware.Onuntrustedports,
clientmessagesaregivento
theDHCPsnoopingapplication.
TheDHCPsnoopingapplicationbuildsthebindingsdatabasefromclient messagesreceivedon
untrustedports.DHCPsnoopingcreatesa“tentativebinding” fromDHCPDISCOVERand
REQUESTmessages.Tentativebindingstieaclienttotheportonwhichthemessagepacketwas
received.Tentativebindingsarecompletedwhen
DHCPsnoopinglearnstheclient’sIPaddress
fromaDHCPACKmessageonatrustedport.
TheportsontheswitchthroughwhichDHCPserversarereachedmustbeconfiguredastrusted
portssothatpacketsreceivedfromthoseportswillbeforwardedtoclients.DCHPpacketsfroma
DHCP
server(DHCPOFFER,DHCPACK,DHCPNAK)aredroppedifreceivedonanuntrusted
port.
portport‐string Specifiestheportorportstobe enabledordisabledastrustedports.The
portscanbephysicalportsorLAGsthat aremembersofaVLAN.
enable|disable Enablesordisablesthe
specifiedportsastrustedports.