Dell MX9116n EMC SmartFabric OS10 User Guide - Page 186

View local system domain name information OS10# show running-configuration ! Version 10.2.9999E ! Last configuration change at Feb 20 04:50:33 2017 ! username admin password $6$q9QBeYjZ$jfxzVqGhkxX3smxJSH9DDz7/3OJc6m5wjF8nnLD7/ VKx8SloIhp4NoGZs0I/UNwh8WVuxwfd9q4pWIgNs5BKH. aaa authentication system:local ip domain-name dell.com ip domain-list f10.com ip name-server 1.1.1.1 2::2 ip host dell-f10.com 10.10.10.10 snmp-server community public read-only snmp-server contact http://www.dell.com/support/ snmp-server location United States debug radius false DHCP snooping DHCP snooping is a layer 2 security feature that helps networking devices to monitor DHCP messages and block untrusted or rogue DHCP servers. When you enable DHCP snooping on a switch, it begins monitoring transactions between trusted DHCP servers and DHCP clients and uses the information to build the DHCP snooping binding table. You configure interfaces that connect to DHCP servers as trusted interfaces. All other interfaces are untrusted by default. The DHCP snooping binding table contains the following information: • Client IP addresses • Client MAC addresses • Interface facing the clients • Client VLAN • Lease time • DHCP binding type - static or dynamic The switch considers DHCP servers connected to trusted interfaces on the switch as legitimate servers. When a switch receives DHCP server-initiated packets (UDP destination port 67) on an untrusted interface, it drops the packet. When a switch receives DHCP renew, release, or decline messages from a client, it checks the DHCP snooping binding table for a match. If the information in the DHCP message matches the table, the switch forwards the message to the DHCP server. If the information does not match, the switch interprets the client as an unauthorized client and drops the packet. The DHCP snooping switch removes a dynamically-learned DHCP snooping binding entry when one of the following occurs: • Lease expiry • DHCP RELEASE packet received from the client • DHCP DECLINE packet received from the client • User actions, such as DHCP clear or disabling DHCP snooping You can add a static DHCP snooping binding entry using the CLI. If you add a static entry for a client, any dynamic entry that is present for the same client is overwritten. The switch does not remove static entries if it receives DHCP RELEASE or DHCP DECLINE packets. By default, DHCP snooping is disabled globally and enabled on VLANs. For the DHCP snooping feature to work, enable it globally. NOTE: If you move a DHCP client from an untrusted interface to another untrusted interface within the VLAN, the DHCP snooping binding database is not updated. The switch drops subsequent packets from the client. However, if you move a DHCP client from an untrusted interface to a trusted interface, there is no impact to the traffic from the client. Restrictions for DHCP snooping • DHCP snooping is not supported for the management VLAN. • DHCP snooping is not supported with VxLAN bridges. • The maximum number of supported DHCP snooping binding entries is 4000. • OS10 does not support multi-hop DHCP snooping. • For the DHCP snooping functionality to work properly, ensure that the DHCP server supports option 82 (RFC 3046). • Enable option 82 (RFC 3046) on the DHCP server for the DHCP Snooping functionality to work properly. 186 System management