Dell PowerSwitch S5212F-ON EMC SmartFabric OS10 User Guide Release 10.5.0 - Page 205

Total Number of Entries in the Table = 1 DHCP relay agent A DHCP relay agent relays DHCP messages to and from a remote DHCP server, even if the client and server are on different IP networks. You can configure the IP address of the remote DHCP server. You can configure a device either as a DHCP server or a DHCP relay agent - but not both. If routes are not leaked between VRFs, the DHCP relay agent supports multi-virtual routing and forwarding (VRF) instances. The clientfacing and server-facing interfaces must be in the same VRF. The DHCPv6 relay agent performs the same role as that of a DHCP relay agent, but in an IPv6 network. The DHCP relay agent forwards the DHCPv4/DHCPv6 messages from the configured interface to the DHCPv6 server as a unicast message. The DHCP relay agent then forwards the server's response to the client. When you configure DHCPv6 relay on an interface, you must: • Configure an IPv6 address on the interface. • Ensure that the DHCPv6 server is reachable. Option 82 for security DHCP, as defined by RFC 2131, provides no authentication or security mechanisms. To ensure security, the DHCP relay agent supports Option-82 with the Circuit ID sub-option, which is the printable name of the interface where the client request was received. This option secures all DHCP traffic that goes through a DHCP relay agent, and ensures that communication between the DHCP relay agent and the DHCP server is not compromised. The DHCP relay agent inserts Option 82 before forwarding DHCP packets to the DHCP server. The DHCP server includes Option 82 back in its response to the relay agent. The relay agent uses this information to forward a reply out the interface on which the request was received rather than flooding it on the entire VLAN. However, the relay agent removes Option 82 from its DHCP responses before forwarding the responses to the client. NOTE: Option 82 is supported, but not configurable. DHCP snooping DHCP snooping is a layer 2 security feature that helps networking devices to monitor DHCP messages and block untrusted or rogue DHCP servers. When you enable DHCP snooping on a switch, it begins monitoring transactions between trusted DHCP servers and DHCP clients and uses the information to build the DHCP snooping binding table. You configure interfaces that connect to DHCP servers as trusted interfaces. All other interfaces are untrusted by default. The DHCP snooping binding table contains the following information: • Client IP addresses • Client MAC addresses • Interface facing the clients • Client VLAN • Lease time • DHCP binding type - static or dynamic The switch considers DHCP servers connected to trusted interfaces on the switch as legitimate servers. When a switch receives DHCP server-initiated packets (UDP destination port 67) on an untrusted interface, it drops the packet. When a switch receives DHCP renew, release, or decline messages from a client, it checks the DHCP snooping binding table for a match. If the information in the DHCP message matches the table, the switch forwards the message to the DHCP server. If the information does not match, the switch interprets the client as an unauthorized client and drops the packet. The DHCP snooping switch removes a dynamically-learned DHCP snooping binding entry when one of the following occurs: • Lease expiry • DHCP RELEASE packet received from the client • DHCP DECLINE packet received from the client System management 205