Filter
Top Products
Configuring DHCP Security Features Configuring DHCP Relay
page 18-20 OmniSwitch 6600 Family Network Configuration Guide April 2006
VLAN-Level DHCP Snooping
To enable DHCP Snooping at the VLAN level, use the ip helper dhcp-snooping vlan command. For
example, the following command enables DHCP Snooping for VLAN 200:
-> ip helper dhcp-snooping vlan 200
When this feature is enabled at the VLAN level, DHCP Snooping functionality is only applied to ports that
are associated with a VLAN that has this feature enabled. Up to 64 VLANs can have DHCP Snooping
enabled. Note that enabling DHCP Snooping at the switch level is not allowed if it is enabled for one or
more VLANs.
By default, when DHCP Snooping is enabled for a specific VLAN, MAC address verification and Option-
82 data insertion is also enabled for the VLAN by default. To disable or enable either of these two
features, use the ip helper dhcp-snooping vlan command with either the mac-address verification or
option-82 data-insertion parameters. For example:
-> ip helper dhcp-snooping vlan 200 mac-address verification disable
-> ip helper dhcp-snooping vlan 200 option-82 data-insertion disable
Note that if the binding table functionality is enabled, disabling Option-82 data insertion for the VLAN is
not allowed. See “Configuring the DHCP Snooping Binding Table” on page 18-21 for more information.
Note. If DHCP Snooping is not enabled for a VLAN, then all ports associated with the VLAN are consid-
ered trusted ports. VLAN-level DHCP Snooping does not filter DHCP traffic on ports associated with a
VLAN that does not have this feature enabled.
Configuring the Port Trust Mode
The DHCP Snooping trust mode for a port determines whether or not the port accepts all DHCP traffic,
client-only DHCP traffic, or blocks all DHCP traffic. The following trust modes for a port are config-
urable using the ip helper dhcp-snooping port command:
• client-only—The default mode applied to ports when DHCP Snooping is enabled. This mode restricts
DHCP traffic on the port to only DHCP client-related traffic. When this mode is active for the port, the
port is considered an untrusted interface.
• trust—This mode does not restrict DHCP traffic on the port. When this mode is active on a port, the
port is considered a trusted interface. In this mode the port behaves as if DHCP Snooping is not
enabled.
• block—This mode blocks all DHCP traffic on the port. When this mode is active for the port, the port
is considered an untrusted interface.
To configure the trust mode for one or more ports, use the ip helper dhcp-snooping port command. For
example, the following command changes the trust mode for port 1/12 to blocked:
-> ip helper dhcp-snooping port 1/12 block
It is also possible to specify a range of ports. For example, the following command changes the trust mode
for ports 2/1 through 2/10 to trusted:
-> ip helper dhcp-snooping port 2/1-10 trust