User's Manual

149
15.13 DHCP Snooping Configuration
15.13.1 DHCP Snooping Global Attribute Configuration
If you click Layer-2 Config -> DHCP Snooping Config -> DHCP Snooping Global Config on the
navigation bar, the DHCP Snooping Global Config page appears.
Enable global DHCP Snooping protocol, the switch is to monitor all DHCP packets and form the
corresponding binding relationship. If the client obtains the address of a switch before the global DHCP
Snooping protocol is enabled, the switch cannot add the corresponding binding relationship.
After the switch configuration is rebooted, the previously-configured interface binding will be lost. In
this case, there is no binding relationship on this interface. After source IP address monitoring is enabled,
the switch rejected forwarding all IP packets. After the TFTP server is configured for interface binding
backup, the binding relationship will be backed up to the server through the TFTP protocol. After the
switch is restarted, the switch automatically downloads the binding list from the TFTP server, securing
the normal running of the network.
When backing up the interface binding relationship, the corresponding file name will be saved on
the TFTP server. In this way, different switches can back up their own interface binding relationships to
the same TFTP server.
The MAC-to-IP binding relationship on an interface changes dynamically. Hence, you need check
whether the binding relationship updates after a certain interval. If the binding relationship updates, it
need be backed up again. The default time interval is 30mins.
15.13.2 DHCP Snooping VLAN Attribute Configuration
If you click Layer-2 Config -> DHCP Snooping Config -> DHCP Snooping VLAN Config on the
navigation bar, the DHCP Snooping VLAN Config page appears.
If DHCP snooping is enabled in a VLAN, the DHCP packets which are received from all distrusted
physical ports in a VLAN will be legally checked. The DHCP response packets which are received from
distrusted physical ports in a VLAN will then be dropped, preventing the faked or mis-configured DHCP
server from providing address distribution services. For the DHCP request packet from distrusted ports,
if the hardware address field in the DHCP request packet does not match the MAC address of this packet,