User's Manual

Table Of Contents
350
Users Manual of CS-6306R
35.1.1.2 Enabling DHCP-Snooping in a VLAN
If DHCP snooping is enabled in a VLAN, the DHCP packets which are received from all distrusted physical
ports in a VLAN will be legally checked. The DHCP response packets which are received from distrusted
physical ports in a VLAN will then be dropped, preventing the faked or mis-configured DHCP server from
providing address distribution services. For the DHCP request packet from distrusted ports, if the hardware
address field in the DHCP request packet does not match the MAC address of this packet, the DHCP request
packet is then thought as a fake packet which is used as the attack packet for DHCP DOS and then the switch
will drop it.
Run the following commands in global configuration mode.
Command Purpose
Ip dhcp-relay snoopingvlanvlan_id
Enables DHCP-snooping in a VLAN.
no ip dhcp-snooping vlanvlan_id
Disables DHCP-snooping in a VLAN.
35.1.1.3 Setting an Interface to a DHCP-Trusting Interface
If an interface is set to be a DHCP-trusting interface, the DHCP packets received from this interface will not be
checked.
Run the following commands in physical interface configuration mode.
Command Purpose
dhcp snooping trust
Sets an interface to a DHCP-trusting interface.
no dhcp snooping trust
Resumes an interface to a DHCP-distrusted interface.
The interface is a distrusted interface by default.
35.1.1.4 Enabling DAI in a VLAN
When dynamic ARP monitoring is conducted in all physical ports of a VLAN, a received ARP packet will be
rejected if the source MAC address and the source IP address of this packet do not match up with the
configured MAC-IP binding relationship. The binding relationship on an interface can be dynamically bound by
DHCP or configured manually. If no MAC addresses are bound to IP addresses on a physical interface, the
switch rejects forwarding all ARP packets.
Command Purpose
ip arp inspection vlan vlanid
Enables dynamic ARP monitoring on all distrusted ports in
a VLAN.
no ip arp inspection vlan
vlanid
Disables dynamic ARP monitoring on all distrusted ports in
a VLAN.