Installation guide

General Security Measures

3-117

configured as trusted. Note that the switch will not add a dynamic entry for itself

to the binding table when it receives an ACK message from a DHCP server.

Also, when the switch sends out DHCP client packets for itself, no filtering takes

place. However, when the switch receives any messages from a DHCP server,

any packets received from untrusted ports are dropped.

Configuring DHCP Snooping

Use the DHCP Snooping Configuration page to enable DHCP Snooping globally on

the switch, or to configure MAC Address Verification.

Command Attributes

• DHCP Snooping Status – Enables DHCP snooping globally. (Default: Disabled)

• DHCP Snooping MAC-Address Verification – Enables or disables MAC address

verification. If MAC address verification is enabled, and the source MAC address

in the Ethernet header of the packet is not same as the client's hardware address

in the DHCP packet, the packet is dropped.

Web – Click DHCP Snooping, Configuration. Select the required options and click

Apply.

Figure 3-69 DHCP Snooping Configuration

CLI – This example first enables DHCP Snooping, and then enables DHCP

Snooping MAC-Address Verification.

Configuring VLANs for DHCP Snooping

Use the DHCP Snooping VLAN Configuration page to enable or disable DHCP

snooping on specific VLANs.

Command Usage

• When DHCP snooping is enabled globally on the switch, and enabled on the

specified VLAN, DHCP packet filtering will be performed on any untrusted ports

within the VLAN.

• When the DHCP snooping is globally disabled, DHCP snooping can still be

configured for specific VLANs, but the changes will not take effect until DHCP

snooping is globally re-enabled.

Console(config)#ip dhcp snooping 4-159

Console(config)#ip dhcp snooping verify mac-address 4-162

Console(config)#