D-Link DGS-3630 Emulator 1 - Page 474

DGS-3630 Layer 3 Stackable Managed Switch CLI Reference Guide Usage Guideline Use this command to create a dynamic DHCP snooping entry. Example This example shows how to configure a DHCP snooping entry with IP address 10.1.1.1 and MAC address 00-0102-03-04-05 at VLAN 2 and port 10 with an expiry time of 100 seconds. Switch# ip dhcp snooping binding 00-01-02-03-04-05 vlan 2 10.1.1.1 interface eth1/0/10 expiry 100 Switch# 27-8 ip dhcp snooping trust This command is used to configure a port as a trusted interface for DHCP snooping. Use the no form of this command to revert to the default setting. ip dhcp snooping trust no ip dhcp snooping trust Parameters None. Default By default, this option is disabled. Command Mode Interface Configuration Mode. Command Default Level Level: 12. Usage Guideline This command is available for physical port and port-channel interface configuration. Ports connected to the DHCP server or to other switches should be configured as trusted interfaces. The ports connected to DHCP clients should be configured as untrusted interfaces. DHCP snooping acts as a firewall between untrusted interfaces and DHCP servers. When a port is configured as a untrusted interface, the DHCP message arrives at the port on a VLAN that is enabled for DHCP snooping. The Switch forwards the DHCP packet unless any of the following conditions occur (in which case the packet is dropped): • The Switch port receives a packet (such as a DHCPOFFER, DHCPACK, DHCPNAK, or DHCPLEASEQUERY packet) from a DHCP server outside the firewall. • If the ip dhcp snooping verify mac-address command is enabled, the source MAC in the Ethernet header must be the same as the DHCP client hardware address to pass the validation. • The untrusted interface receives a DHCP packet that includes a relay agent IP address that is not 0.0.0.0 or the relay agent forward a packet that includes Option 82 to an untrusted interface. • The router receives a DHCPRELEASE or DHCPDECLINE message from an untrusted host with an entry in the DHCP snooping binding table, and the interface information in the binding table does not match the interface on which the message was received. In addition to doing the validation, DHCP snooping also create a binding entry based on the IP address assigned to client by the server in DHCP snooping binding database. The binding entry contains information including MAC address, IP address, the VLAN ID and port ID where the client is located, and the expiry of the lease time. 469