135
(QCT) (if-port-channel ch1)#exit
3. Enter interface configuration mode for all untrusted interfaces (ports 1-20) and limit the number of
DHCP packets that an interface can receive to 100 packets per second. Port-channel 1 is a trusted port and
keeps the default value for rate limiting (unlimited).
(QCT) (Config)#interface range 0/1-0/20
(QCT) (Interface 0/1-0/20)#ip dhcp snooping limit rate 100
(QCT) (Interface 0/1-0/20)#exit
4. Specify that the DHCP snooping database is to be stored remotely in a file called dsDb.txt on a TFTP server
with and IP address of 10.131.11.1.
(QCT) (Config)#ip dhcp snooping database tftp://10.131.11.1/dsDb.txt
5. Enable DHCP snooping for the switch
(QCT) (Config)#ip dhcp snooping
(QCT) (Config)#exit
6. View DHCP snooping information.
(QCT) #show ip dhcp snooping
DHCP snooping is Enabled
DHCP snooping source MAC verification is enabled
DHCP snooping is enabled on the following VLANs:
100
Interface Trusted Log Invalid Pkts
----------- ---------- ----------------
4.2.6. Configuring IPSG
This example builds on the previous example and uses the same topology shown in Figure 20. In this
configuration example, IP source guard is enabled on ports 1-20. DHCP snooping must also be enabled on
these ports. Additionally, because the ports use IP source guard with source IP and MAC address filtering,
port security must be enabled on the ports as well.
To configure the switch:
1. Enter interface configuration mode for the host ports and enable IPSG.
(QCT) #config
(QCT) (Config)#interface range 0/1-0/20
(QCT) (Interface 0/1-0/20)#ip verify source port-security
2. Enable port security on the ports.
To Next Page
Loading...
Need help?
General