ECS4660-28F_Management Guide-R03

C HAPTER 29 | General Security Measures
DHCPv4 Snooping
– 1120 –
policy for these packets. The switch can either drop the DHCP packets,
keep the existing information, or replace it with the switch’s relay
information.
EXAMPLE
Console(config)#ip dhcp snooping information policy drop
Console(config)#
ip dhcp snooping
verify mac-address
This command verifies the client’s hardware address stored in the DHCP
packet against the source MAC address in the Ethernet header. Use the no
form to disable this function.
SYNTAX
[no] ip dhcp binding verify mac-address
DEFAULT SETTING
Enabled
COMMAND MODE
Global Configuration
COMMAND USAGE
If MAC address verification is enabled, and the source MAC address in the
Ethernet header of the packet is not same as the client’s hardware address
in the DHCP packet, the packet is dropped.
EXAMPLE
This example enables MAC address verification.
Console(config)#ip dhcp snooping verify mac-address
Console(config)#
RELATED COMMANDS
ip dhcp snooping (1116)
ip dhcp snooping vlan (1121)
ip dhcp snooping trust (1123)