User's Manual

Configuration Guide of XGS-5240-Series
40-7
40.3 DHCP Snooping Typical Application
Fig 5-1 Sketch Map of TRUNK
As showed in the above chart, Mac-AA device is the normal user, connected to the
non-trusted port 1/0/1 of the switch. It operates via DHCP Client, IP 1.1.1.5; DHCP Server and
GateWay are connected to the trusted ports 1/0/11 and 1/0/12 of the switch; the malicious user
Mac-BB is connected to the non-trusted port 1/0/10, trying to fake a DHCP Server（by sending
DHCPACK）. Setting DHCP Snooping on the switch will effectively detect and block this kind of
network attack.
Configuration sequence is:
switch#
switch#config
switch(config)#ip dhcp snooping enable
switch(config)#interface ethernet 1/0/11
switch(Config-Ethernet1/0/11)#ip dhcp snooping trust
switch(Config-Ethernet1/0/11)#exit
switch(config)#interface ethernet 1/0/12
ip dhcp snooping information
option allow-untrusted (replace|)
no ip dhcp snooping information
option allow-untrusted (replace|)
This command is used to set that allow
untrusted ports of DHCP snooping to receive
DHCP packets with option82 option. When the
"replace" is setting, the potion82
option is
allowed to replace. When disabling this
command, all untrusted ports will drop DHCP
packets with option82 option.