Chapter 8
| General Security Measures
DHCP Snooping
– 242 –
DHCP Snooping
DHCP snooping allows a switch to protect a network from rogue DHCP servers or
other devices which send port-related information to a DHCP server. This
information can be useful in tracking an IP address back to a physical port. This
section describes commands used to configure DHCP snooping.
ip dhcp snooping This command enables DHCP snooping globally. Use the no form to restore the
default setting.
Syntax
[no] ip dhcp snooping
Default Setting
Disabled
Command Mode
Global Configuration
Command Usage
â—† Network traffic may be disrupted when malicious DHCP messages are received
from an outside source. DHCP snooping is used to filter DHCP messages
received on an unsecure interface from outside the network or fire wall. When
DHCP snooping is enabled globally by this command, and enabled on a VLAN
interface by the ip dhcp snooping vlan command, DHCP messages received on
Table 50: DHCP Snooping Commands
Command Function Mode
ip dhcp snooping Enables DHCP snooping globally GC
ip dhcp snooping information
option
Enables or disables DHCP Option 82 information relay GC
ip dhcp snooping information
policy
Sets the information option policy for DHCP client
packets that include Option 82 information
GC
ip dhcp snooping verify
mac-address
Verifies the client’s hardware address stored in the DHCP
packet against the source MAC address in the Ethernet
header
GC
ip dhcp snooping vlan Enables DHCP snooping on the specified VLAN GC
ip dhcp snooping trust Configures the specified interface as trusted IC
clear ip dhcp snooping
database flash
Removes all dynamically learned snooping entries from
flash memory.
PE
ip dhcp snooping database
flash
Writes all dynamically learned snooping entries to flash
memory
PE
show ip dhcp snooping Shows the DHCP snooping configuration settings PE
show ip dhcp snooping
binding
Shows the DHCP snooping binding table entries PE
To Next Page
Loading...
Need help?
General
