298
Enable DHCP and DHCP snooping on the device, so that the host (with the MAC address of
0001-0203-0406) can obtain an IP address through the DHCP server and the IP address and MAC
address of the host can be recorded in a DHCP snooping entry.
Enable the dynamic IPv4 source guard on port GigabitEthernet 1/0/1 of the device, allowing only
packets from a client that obtains an IP address through the DHCP server to pass.
NOTE:
For detailed configuration of a DHCP server, see the
Layer 3—IP Services Configuration Guide.
Figure 101 Network diagram
Configuration procedure
1. Configure DHCP snooping
# Configure IP addresses for the interfaces. (Omitted)
# Enable DHCP snooping.
<Device> system-view
[Device] dhcp-snooping
# Configure port GigabitEthernet 1/0/2, which is connected to the DHCP server, as a trusted port.
[Device] interface gigabitethernet1/0/2
[Device-GigabitEthernet1/0/2] dhcp-snooping trust
[Device-GigabitEthernet1/0/2] quit
2. Configure the dynamic IPv4 source guard
# Configure dynamic IPv4 source guard on port GigabitEthernet 1/0/1 to filter packets based on both
the source IP address and MAC address.
[Device] interface gigabitethernet1/0/1
[Device-GigabitEthernet1/0/1] ip check source ip-address mac-address
[Device-GigabitEthernet1/0/1] quit
Verification
# Display IPv4 source guard entries on port GigabitEthernet 1/0/1.
[Device-GigabitEthernet1/0/1] display ip check source
Total entries found: 1
MAC Address IP Address VLAN Interface Type
0001-0203-0406 192.168.0.1 1 GE1/0/1 DHCP-SNP
# Display DHCP snooping entries on GigabitEthernet 1/0/1.
[Device-GigabitEthernet1/0/1] display dhcp-snooping
DHCP Snooping is enabled.
The client binding table for all untrusted ports.
Type : D--Dynamic , S--Static
Type IP Address MAC Address Lease VLAN Interface
==== =============== ============== ============ ==== =================
To Next Page
Loading...
