Cisco 7604 Configuration Guide - Page 183

Chapter 8 Configuring IP Routing and DHCP Services Configuring DHCP hostname(config)# dhcprelay setroute inside2 The following example enables the FWSM to forward DHCP requests from clients connected to the inside1 interface (on vlan 20) to an interface-specific DHCP server (on the outside interface). The inside2 interface uses the global DHCP servers on the outside and DMZ interfaces. Note that the global DHCP server on the outside interface is the same as the interface-specific server for inside1. hostname(config)# interface vlan 20 hostname(config-if)# dhcprelay server 209.165.200.225 hostname(config)# dhcprelay server 209.165.200.225 outside hostname(config)# dhcprelay server 209.165.201.4 dmz hostname(config)# dhcprelay enable inside1 hostname(config)# dhcprelay setroute inside1 hostname(config)# dhcprelay enable inside2 hostname(config)# dhcprelay setroute inside2 Preserving DHCP Option 82 This section describes the DHCP option 82 feature. This feature enables the DHCP relay agent to include information about itself and the attached client when forwarding DHCP requests from a DHCP client to a DHCP server. If the DHCP relay agent receives a DHCP packet from untrusted sources with option 82 already set, but the giaddr (the DHCP relay agent address that will be set by the relay agent before it forwards the packet to the server) field set to zero, or when it is behind DSLAM devices, then it will drop that packet by default. You can optionally preserve option 82 and forward the packet by identifying an interface as a trusted interface. This feature makes sure that DHCP snooping and IP source guard features on the switch work along with the FWSM. DHCP snooping is a DHCP security feature that provides network security by filtering untrusted DHCP messages and by building and maintaining a DHCP snooping binding table. You can enable this feature on interfaces configured with IPv4 and IPv6 addresses. To configure a particular interface as a trusted interface that preserves option 82, enter the following commands: hostname(config)# interface interface {vlan vlan_id | mapped_name} hostname(config-if)# dhcprelay information trusted To configure all interfaces as trusted interfaces, enter the following command: hostname(config)# dhcprelay information trust-all All the interfaces will be set as trusted interfaces except interfaces which are shared and the interface on which the DHCP server is configured. The interface-specific trusted configuration and global trusted configuration can exist together. For example there are three interfaces A, B and C, and a user configures interface A as trusted using the interface-specific command.Then the user configures the global command also. Now all the three interfaces A, B, and C are trusted interfaces. If you enter the no dhcprelay information trust-all command, then interfaces B and C will become non-trusted interfaces. Interface A will continue to be a trusted interface, since the interface-specific trusted configuration is not removed. Verifying the DHCP Relay Configuration To view the interface-specific DHCP relay configuration, enter the following command: hostname# show running-config dhcprelay interface [vlan vlan_id | mapped_name] OL-20748-01 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM 8-41