102
◆ When DHCP snooping is enabled, DHCP messages entering an untrusted interface are
filtered based upon dynamic entries learned via DHCP snooping.
◆ Filtering rules are implemented as follows:
■ If the global DHCP snooping is disabled, all DHCP packets are forwarded.
■ If DHCP snooping is enabled globally, all DHCP packets are forwarded for a trusted
port. If the received packet is a DHCP ACK message, a dynamic DHCP snooping entry is
also added to the binding table.
■ If DHCP snooping is enabled globally, but the port is not trusted, it is processed as
follows:
■ If the DHCP packet is a reply packet from a DHCP server (including OFFER, ACK or
NAK messages), the packet is dropped.
■ If a DHCP DECLINE or RELEASE message is received from a client, the switch
forwards the packet only if the corresponding entry is found in the binding table.
■ If a DHCP DISCOVER, REQUEST or INFORM message is received from a client, the
packet is forwarded.
■ If the DHCP packet is not a recognizable type, it is dropped.
■ If a DHCP packet from a client passes the filtering criteria above, it will only be
forwarded to trusted ports in the same VLAN.
■ If a DHCP packet is from server is received on a trusted port, it will be forwarded to both
trusted and untrusted ports in the same VLAN.
■ If the DHCP snooping is globally disabled, all dynamic bindings are removed from the
binding table.
■ Additional considerations when the switch itself is a DHCP client – The port(s) through
which the switch submits a client request to the DHCP server must be configured as
trusted. Note that the switch will not add a dynamic entry for itself to the binding table
when it receives an ACK message from a DHCP server. Also, when the switch sends out
DHCP client packets for itself, no filtering takes place. However, when the switch receives
any messages from a DHCP server, any packets received from untrusted ports are
dropped.
PARAMETERS
These parameters are displayed:
◆ Snooping Mode – Enables DHCP snooping globally. When DHCP snooping is enabled,
DHCP request messages will be forwarded to trusted ports, and reply packets only
allowed from trusted ports. (Default: Disabled)
◆ Port – Port identifier
◆ Mode – Enables or disables a port as a trusted source of DHCP messages. (Default:
Trusted)
To Next Page
Loading...
