D-Link DGS-6600-48T Product Manual - Page 235

DGS-6604 ip dhcp snooping trust ip dhcp snooping trust Use this command to configure a port as interface trusted for DHCP snooping. Use the no form of this command to return to the default setting. ip dhcp snooping trust no ip dhcp snooping trust Default Disabled Command Mode Interface configuration Usage Guideline The command is available for physical port configuration. Normally, the ports connected to DHCP server or to other switches should be configured as a trusted interface. The ports connected to DHCP clients should be configured as un-trusted interface. When a port is configured as an un-trusted interface, the DHCP message arrives at the port on a vlan that is enabled for DHCP and snooping will be validated by the following checks. (1)The received message should be all sent by the client. If the message is sent by the DHCP server, the message will be dropped. (2)If ip dhcp snooping verify mac-address is enabled, the source MAC in the Ethernet header must be the same as the DHCP client hardware address to pass the validation. (3)For the received release and decline packets, the received port is also checked against the binging database entry. The packet will be dropped if inconsistent. (4)If gateway addr !=0 or option 82 is present, the packet is dropped In addition to doing the validation, DHCP snooping also create a binding entry based on the IP address assigned to client by the server in DHCP snooping binding database. The binding entry contains information including MAC address, IP address, the VLAN ID and port ID where the client is located, and the expiry of the lease time. Example This example shows how to enable DHCP snooping trust for port 3.3: Switch(config)# interface eth3.3 Switch(config-if)# ip dhcp snooping trust Switch(config)# CLI Reference Guide 225