HP 6125G HP 6125G & 6125G/XG Blade Switches Layer 3 - IP Services Conf - Page 60

Configuring DHCP snooping basic functions, Configuring DHCP snooping to support Option 82

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 60 highlights

Task Enabling DHCP-REQUEST message attack protection Remarks Optional Configuring DHCP snooping basic functions Follow these guidelines when configure DHCP snooping basic functions: • You must specify the ports connected to the authorized DHCP servers as trusted to make sure that DHCP clients can obtain valid IP addresses. The trusted port and the port connected to the DHCP client must be in the same VLAN. • You can specify Layer 2 Ethernet ports and Layer 2 aggregate interfaces as trusted ports. For more information about aggregate interfaces, see Layer 2-LAN Switching Configuration Guide. • If a Layer 2 Ethernet port is added to an aggregation group, the DHCP snooping configuration of the interface will not take effect. After the interface quits the aggregation group, the configuration will be effective. • DHCP snooping can work with basic QinQ or flexible QinQ. When receiving a packet without any VLAN tag from the DHCP client to the DHCP server, the DHCP snooping device adds a VLAN tag to the packet. If the packet has one VLAN tag, the device adds another VLAN tag to the packet and records the two VLAN tags in a DHCP snooping entry. The newly added VLAN tag is the outer tag. If the packet has two VLAN tags, the device directly forwards the packet to the DHCP server without adding any tag. • If you need to add a new VLAN tag and meanwhile modify the original VLAN tag for the packet, DHCP snooping cannot work with flexible QinQ. To configure DHCP snooping basic functions: Step Command 1. Enter system view. 2. Enable DHCP snooping. system-view dhcp-snooping 3. Enter Ethernet interface view. 4. Specify the port as a trusted port that records the IP-to-MAC bindings of clients. 5. Return to system view. interface interface-type interface-number dhcp-snooping trust quit 6. Enter interface view. interface interface-type interface-number 7. Specify the port as a trusted port that does not record the IP-to-MAC dhcp-snooping trust bindings of clients. no-user-binding Remarks N/A Disabled by default. The interface connects to the DHCP server. After DHCP snooping is enabled, a port is an untrusted port by default. N/A The interface indirectly connects to the DHCP client. Optional. After DHCP snooping is enabled, a port is an untrusted port by default. Configuring DHCP snooping to support Option 82 Follow these guidelines when configure DHCP snooping to support Option 82: 52

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
52
Task
Remarks
Enabling DHCP-REQUEST message attack protection
Optional
Configuring DHCP snooping basic functions
Follow these guidelines when configure DHCP snooping basic functions:
•
You must specify the ports connected to the authorized DHCP servers as trusted to make sure that
DHCP clients can obtain valid IP addresses. The trusted port and the port connected to the DHCP
client must be in the same VLAN.
•
You can specify Layer 2 Ethernet ports and Layer 2 aggregate interfaces as trusted ports. For more
information about aggregate interfaces, see
Layer 2—LAN Switching Configuration Guide
.
•
If a Layer 2 Ethernet port is added to an aggregation group, the DHCP snooping configuration of
the interface will not take effect. After the interface quits the aggregation group, the configuration
will be effective.
•
DHCP snooping can work with basic QinQ or flexible QinQ. When receiving a packet without any
VLAN tag from the DHCP client to the DHCP server, the DHCP snooping device adds a VLAN tag
to the packet. If the packet has one VLAN tag, the device adds another VLAN tag to the packet and
records the two VLAN tags in a DHCP snooping entry. The newly added VLAN tag is the outer tag.
If the packet has two VLAN tags, the device directly forwards the packet to the DHCP server without
adding any tag.
•
If you need to add a new VLAN tag and meanwhile modify the original VLAN tag for the packet,
DHCP snooping cannot work with flexible QinQ.
To configure DHCP snooping basic functions:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enable DHCP snooping.
dhcp-snooping
Disabled by default.
3.
Enter Ethernet interface view.
interface
interface-type
interface-number
The interface connects to the DHCP
server.
4.
Specify the port as a trusted port
that records the IP-to-MAC
bindings of clients.
dhcp-snooping trust
After DHCP snooping is enabled, a
port is an untrusted port by default.
5.
Return to system view.
quit
N/A
6.
Enter interface view.
interface
interface-type
interface-number
The interface indirectly connects to the
DHCP client.
7.
Specify the port as a trusted port
that does not record the IP-to-MAC
bindings of clients.
dhcp-snooping trust
no-user-binding
Optional.
After DHCP snooping is enabled, a
port is an untrusted port by default.
Configuring DHCP snooping to support Option 82
Follow these guidelines when configure DHCP snooping to support Option 82: