Home » Dell Manuals » Hubs & Switches » Dell C9010 Modular Chassis Switch » Manual Viewer

Dell C9010 Modular Chassis Switch Networking Configuration Guide for the C9000 - Page 361

DHCP Snooping for a Multi-Tenant Host, DHCP Snooping in a VLT Setup, Enabling DHCP Snooping

View all Dell C9010 Modular Chassis Switch manuals

Add to My Manuals
Save this manual to your list of manuals

Page 361 highlights

this check are forwarded to the server for validation. This checkpoint prevents an attacker from spoofing a client and declining or releasing the real client's address. Server-originated packets (DHCPOFFER, DHCPACK, and DHCPNACK) that arrive on a not trusted port are also dropped. This checkpoint prevents an attacker from acting as an imposter as a DHCP server to facilitate a man-in-the-middle attack. Binding table entries are deleted when a lease expires, or the relay agent encounters a DHCPRELEASE, DHCPNACK, or DHCPDECLINE. DHCP snooping is supported on Layer 2 and Layer 3 traffic. DHCP snooping on Layer 2 interfaces does not require a relay agent. Binding table entries are deleted when a lease expires or when the relay agent encounters a DHCPRELEASE. Line cards maintain a list of snooped VLANs. When the binding table is exhausted, DHCP packets are dropped on snooped VLANs, while these packets are forwarded across non-snooped VLANs. Because DHCP packets are dropped, no new IP address assignments are made. However, DHCPRELEASE and DHCPDECLINE packets are allowed so that the DHCP snooping table can decrease in size. After the table usage falls below the maximum limit of 4000 entries, new IP address assignments are allowed. NOTE: DHCP server packets are dropped on all non-trusted interfaces of a system configured for DHCP snooping. To prevent these packets from being dropped, configure ip dhcp snooping trust on the server-connected port. DHCP Snooping for a Multi-Tenant Host You can configure the DHCP snooping feature such that multiple IP addresses are expected for the same MAC address. You can use the ip dhcp snooping command multiple times to map the same MAC address with different IP addresses. This configuration is also used for dynamic ARP inspection (DAI) and source address validation (SAV). The DAI and SAV tables reflect the same entries in the DHCP snooping binding table. NOTE: If you enable DHCP Option 82 using the ip dhcp relay command, by default, the remote-ID field contains the MAC address of the relay agent. If you configure the remote ID as the host name in a VLT setup, configure different host names on both VLT peers. If you configure the remote ID with your own string, ensure that your strings are different on both VLT peers. DHCP Snooping in a VLT Setup In a VLT setup, the DHCP snooping binding table synchronizes between the VLT nodes. Similarly, the DAI and SAV tables also synchronize between VLT nodes. For this feature to work in a VLT setup, make sure that DHCP relay, DHCP snooping, SAV, and DAI configurations are identical between the VLT peer nodes. Enabling DHCP Snooping To enable DHCP snooping, use the following commands. 1 Enable DHCP snooping globally. CONFIGURATION mode ip dhcp snooping 2 Specify ports connected to DHCP servers as trusted. INTERFACE mode ip dhcp snooping trust 3 Enable DHCP snooping on a VLAN. CONFIGURATION mode ip dhcp snooping vlan name Dynamic Host Configuration Protocol (DHCP) 361

Section	Page
Dell EMC Networking Configuration Guide for the C9010 Series Version 9.14.0.0	3
About this Guide	37
Audience	37
Conventions	37
Related Documents	37
Configuration Fundamentals	38
Accessing the Command Line	38
CLI Modes	38
Navigating CLI Modes	40
The do Command	43
Undoing Commands	44
Obtaining Help	44
Entering and Editing Commands	44
Command History	45
Filtering show Command Outputs	45
Multiple Users in Configuration Mode	47
Getting Started	48
Console Access	48
Serial Console	49
Mounting an NFS File System	50
Important Points to Remember	50
Default Configuration	51
Configuring a Host Name	51
Accessing the System Remotely	52
Accessing the System Remotely	52
Configure the Management Port IP Address	52
Configure a Management Route	52
Configuring a Username and Password	53
Configuring the Enable Password	54
Manage Configuration Files	54
File Storage	54
Copy Files to and from the System	55
Save the Running-Configuration	56
Configure the Overload Bit for a Startup Scenario	56
Viewing Files	56
Changes in Configuration Files	57
Viewing Command History	58
Upgrading the Dell Networking OS	58
Switch Management	59
Configuring Privilege Levels	59
Creating a Custom Privilege Level	59
Removing a Command from EXEC Mode	59
Moving a Command from EXEC Privilege Mode to EXEC Mode	59
Allowing Access to CONFIGURATION Mode Commands	60
Allowing Access to the Following Modes	60
Applying a Privilege Level to a Username	61
Applying a Privilege Level to a Terminal Line	62
Configuring Logging	62
Audit and Security Logs	62
Configuring Logging Format	64
Setting Up a Secure Connection to a Syslog Server	64
Track Login Activity	66
Restrictions for Tracking Login Activity	66
Configuring Login Activity Tracking	66
Display Login Statistics	66
Limit Concurrent Login Sessions	68
Restrictions for Limiting the Number of Concurrent Sessions	68
Configuring Concurrent Session Limit	68
Enabling the System to Clear Existing Sessions	69
Enabling Secured CLI Mode	69
Log Messages in the Internal Buffer	70
Configuration Task List for System Log Management	70
Disabling System Logging	70
Sending System Messages to a Syslog Server	70
Configuring a UNIX System as a Syslog Server	71
Display the Logging Buffer and the Logging Configuration	71
Changing System Logging Settings	72
Configuring a UNIX Logging Facility Level	72
Synchronizing Log Messages	73
Enabling Timestamp on Syslog Messages	74
File Transfer Services	74
Configuration Task List for File Transfer Services	74
Enabling the FTP Server	75
Configuring FTP Server Parameters	75
Configuring FTP Client Parameters	75
Terminal Lines	76
Denying and Permitting Access to a Terminal Line	76
Configuring Login Authentication for Terminal Lines	77
Setting Time Out of EXEC Privilege Mode	77
Using Telnet to Access Another Network Device	78
Lock CONFIGURATION Mode	79
Viewing the Configuration Lock Status	79
LPC Bus Quality Degradation	79
LBQA (LPC Bus Quality Analyzer) Failure Detection mode	80
Recovering from a Forgotten Password	81
Ignoring the Startup Configuration and Booting from the Factory-Default Configuration	81
Recovering from a Failed Start	82
Restoring Factory-Default Settings	82
Important Point to Remember	82
Restoring Factory-Default Boot Environment Variables	83
Using Hashes to Verify Software Images Before Installation	84
Verifying System Images on C9010 Components	85
When System Images on C9010 Components Do Not Match	86
Manually Resetting the System Image on a C9010 Component	86
Logging in to the Virtual Console of a C9010 Component	87
Booting the C9010 from an Image on a Network Server	87
Configuring C9010 Components to Boot from the RPM CP Image	87
Viewing the Reason for Last System Reboot	88
802.1X	89
The Port-Authentication Process	91
EAP over RADIUS	92
Configuring 802.1X	93
Related Configuration Tasks	93
Important Points to Remember	93
Enabling 802.1X	94
Configuring dot1x Profile	96
Configuring MAC addresses for a do1x Profile	96
Configuring the Static MAB and MAB Profile	97
Configuring Critical VLAN	98
Configuring Request Identity Re-Transmissions	98
Configuring a Quiet Period after a Failed Authentication	99
Forcibly Authorizing or Unauthorizing a Port	100
Re-Authenticating a Port	101
Configuring Dynamic VLAN Assignment with Port Authentication	101
Guest and Authentication-Fail VLANs	102
Configuring a Guest VLAN	103
Configuring an Authentication-Fail VLAN	104
Configuring Timeouts	105
Multi-Host Authentication	106
Configuring Multi-Host AuthenticationConfiguring Single-Host Authentication	107
Multi-Supplicant Authentication	108
Configuring Multi-Supplicant AuthenticationRestricting Multi-Supplicant Authentication	109
MAC Authentication Bypass	110
MAB in Single-host and Multi-Host Mode	110
MAB in Multi-Supplicant Authentication Mode	111
Configuring MAC Authentication Bypass	111
Dynamic CoS with 802.1X	112
Access Control Lists (ACLs)	114
IP Access Control Lists (ACLs)	114
CAM Usage	115
User-Configurable CAM Allocation	116
Allocating CAM for Ingress ACLs on the Port Extender	116
Allocating CAM for Egress ACLs on the Port Extender	118
Implementing ACLs on Dell EMC Networking OS	119
ACL Optimization to Increase Number of Supported IPv4 ACLs	120
Restrictions for ACL Optimization	120
Optimizing ACL for More Number of IPv4 ACL Rules	121
IP Fragment Handling	121
IP Fragments ACL Examples	121
Layer 4 ACL Rules Examples	122
Configure a Standard IP ACL	123
Configuring a Standard IP ACL Filter	124
Configure an Extended IP ACL	125
Configuring Filters with a Sequence Number	125
Configuring Filters Without a Sequence Number	126
Configure Layer 2 and Layer 3 ACLs	127
Using ACL VLAN Groups	127
Guidelines for Configuring ACL VLAN Groups	127
Configuring an ACL VLAN Group	128
Allocating ACL VLAN CAM	129
Applying an IP ACL	129
Applying Ingress ACLs on the Port Extender	130
Applying Egress ACLs	131
Applying Layer 3 Egress ACLs on Control-Plane Traffic	131
Counting ACL Hits	132
IP Prefix Lists	132
Implementation Information	132
Configuration Task List for Prefix Lists	133
ACL Remarks	136
Configuring a Remark	136
Deleting a Remark	137
ACL Resequencing	137
Resequencing an ACL or Prefix List	138
Route Maps	139
Implementation Information	139
Important Points to Remember	139
Configuration Task List for Route Maps	140
Configuring Match Routes	142
Configuring Set Conditions	143
Configure a Route Map for Route Redistribution	144
Configure a Route Map for Route Tagging	145
Continue Clause	145
Configuring a UDF ACL	145
Hot-Lock Behavior	147
Bidirectional Forwarding Detection (BFD)	148
How BFD Works	148
BFD Packet Format	149
BFD Sessions	150
BFD Three-Way Handshake	151
Session State Changes	153
Important Points to Remember	153
Configure BFD	153
Configure BFD for Physical Ports	154
Configure BFD for Static Routes	155
Configure BFD for IPv6 Static Routes	158
Configure BFD for OSPF	160
Configure BFD for OSPFv3	164
Configure BFD for IS-IS	167
Configure BFD for BGP	169
Configure BFD for VRRP	175
Configuring Protocol Liveness	178
Border Gateway Protocol IPv4 (BGPv4)	179
Autonomous Systems (AS)	179
Sessions and Peers	181
Establish a Session	181
Route Reflectors	182
Communities	183
BGP Attributes	183
Best Path Selection Criteria	183
Weight	185
Local Preference	185
Multi-Exit Discriminators (MEDs)	186
Origin	187
AS Path	187
Next Hop	188
Multiprotocol BGP	188
Implement BGP	188
Additional Path (Add-Path) Support	188
Advertise IGP Cost as MED for Redistributed Routes	189
Ignore Router-ID for Some Best-Path Calculations	189
Four-Byte AS Numbers	189
AS4 Number Representation	190
AS Number Migration	191
BGP4 Management Information Base (MIB)	193
Important Points to Remember	193
Configuration Information	194
BGP Configuration	194
Enabling BGP	195
Configuring AS4 Number Representations	198
Configuring Peer Groups	199
Configuring BGP Fast Fail-Over	202
Configuring Passive Peering	203
Maintaining Existing AS Numbers During an AS Migration	204
Allowing an AS Number to Appear in its Own AS Path	205
Filtering on an AS-Path Attribute	206
Regular Expressions as Filters	207
Redistributing Routes	208
Enabling Additional Paths	209
Configuring IP Community Lists	209
Configuring an IP Extended Community List	210
Filtering Routes with Community Lists	211
Manipulating the COMMUNITY Attribute	212
Changing MED Attributes	213
Changing the LOCAL_PREFERENCE Attribute	214
Configuring the local System or a Different System to be the Next Hop for BGP-Learned Routes	214
Changing the WEIGHT Attribute	215
Enabling Multipath	215
Filtering BGP Routes	216
Filtering BGP Routes Using Route Maps	217
Filtering BGP Routes Using AS-PATH Information	218
Configuring BGP Route Reflectors	218
Aggregating Routes	219
Configuring BGP Confederations	219
Enabling Route Flap Dampening	220
Changing BGP Timers	222
Setting the extended timer	223
Enabling BGP Neighbor Soft-Reconfiguration	223
Enabling or disabling BGP neighbors	224
Route Map Continue	225
Enabling MBGP Configurations	226
Configure IPv6 NH Automatically for IPv6 Prefix Advertised over IPv4 Neighbor	227
BGP Regular Expression Optimization	227
Debugging BGP	227
Storing Last and Bad PDUs	228
Capturing PDUs	229
PDU Counters	230
Sample Configurations	230
Content Addressable Memory (CAM)	239
CAM Allocation	239
Test CAM Usage	241
View CAM-ACL Settings	241
View CAM Usage	242
Configuring CAM Threshold and Silence Period	242
Setting CAM Threshold and Silence Period	243
Return to the Default CAM Configuration	244
CAM Optimization	244
Applications for CAM Profiling	244
LAG HashingLAG Hashing Based on Bidirectional Flow	244
Unified Forwarding Table (UFT) Modes	245
Configuring UFT Modes	245
Control Plane Policing (CoPP)	247
CoPP Implementation	247
Protocol-based Control Plane Policing	247
Queue-based Control Plane Policing	247
CoPP Example	249
Configure Control Plane Policing	250
Configuring CoPP for Protocols	250
Examples of Configuring CoPP for Protocols	251
Configuring CoPP for CPU Queues	252
Examples of Configuring CoPP for CPU Queues	253
Displaying CoPP Configuration	254
Troubleshooting CoPP Operation	257
Enabling CPU Traffic Statistics	257
Viewing CPU Traffic Statistics	257
Troubleshooting CPU Packet Loss	258
Viewing Per-Protocol CoPP Counters	259
Viewing Per-Queue CoPP Counters	262
Data Center Bridging (DCB)	263
Enabling Data Center Bridging	263
Ethernet Enhancements in Data Center Bridging	264
Priority-Based Flow Control	265
Enhanced Transmission Selection	266
Data Center Bridging Exchange Protocol (DCBx)	267
Data Center Bridging in a Traffic Flow	267
QoS dot1p Traffic Classification and Queue Assignment	268
SNMP Support for PFC and Buffer Statistics Tracking	268
DCB Maps and its Attributes	269
DCB Map: Configuration Procedure	269
Important Points to Remember	270
Applying a DCB Map on a Port	270
Configuring PFC without a DCB Map	271
Configuring Lossless Queues	271
Applying a DCB Map on a Line Card	273
Data Center Bridging: Default Configuration	273
Configuration Notes: PFC and ETS in a DCB Map	274
PFC Configuration Notes	274
ETS Configuration Notes	275
ETS Prerequisites and Restrictions	275
Priority-Group Configuration Notes	276
Configuring Priority-Based Flow Control	276
Configuring Lossless Queues	277
Configuring Enhanced Transmission Selection	277
Creating an ETS Priority Group	278
ETS Operation with DCBx	279
Configure a DCBx Operation	279
DCBx Operation	279
DCBx Port Roles	280
DCB Configuration Exchange	281
Configuration Source Election	281
Propagation of DCB Information	282
Auto-Detection and Manual Configuration of the DCBx Version	282
Behavior of Tagged Packets	283
Configuration Example for DSCP and PFC Priorities	283
DCBx Example	284
DCBx Prerequisites and Restrictions	285
Configuring DCBx	285
Verifying the DCB Configuration	288
Performing PFC Using DSCP Bits Instead of 802.1p Bits	298
PFC and ETS Configuration Examples	298
Using PFC and ETS to Manage Data Center Traffic	299
PFC and ETS Configuration Command Examples	300
Using PFC and ETS to Manage Converged Ethernet Traffic	300
Hierarchical Scheduling in ETS Output Policies	301
Priority-Based Flow Control Using Dynamic Buffer Method	301
Pause and Resume of Traffic	301
Buffer Sizes for Lossless or PFC Packets	302
Configuring the Dynamic Buffer Method	302
Debugging and Diagnostics	304
Offline Diagnostics	304
Running Port Extender Offline Diagnostics on the Switch	304
Running Offline Diagnostics on a Standalone Switch	311
TRACE Logs	331
Auto Save on Reload, Crash, or Rollover	332
Uploading Trace Logs	332
Last Restart Reason	332
show hardware Commands	333
Environmental Monitoring	335
Displaying Port Extender Environment Information	335
Display Power Supply Status	335
Display Fan Status	336
Display Transceiver Type	336
Recognize an Over-Temperature Condition	338
Troubleshoot an Over-Temperature Condition	339
Troubleshooting Packet Loss	341
Displaying Drop Counters	341
Displaying Dataplane Statistics	342
Displaying Line-Card Counters	344
Accessing Application Core Dumps	344
Mini Core Dumps	345
Full Kernel Core Dumps	346
Enabling TCP Dumps	346
Accessing Port Extender Core and Mini Core Dumps	347
Dynamic Host Configuration Protocol (DHCP)	348
DHCP Packet Format and Options	348
Assign an IP Address using DHCP	350
Implementation Information	351
Configure the System to be a DHCP Server	351
Configuring the Server for Automatic Address Allocation	352
Specifying a Default Gateway	353
Configure a Method of Hostname Resolution	354
Using DNS for Address Resolution	354
Using NetBIOS WINS for Address Resolution	354
Creating Manual Binding Entries	354
Debugging the DHCP Server	355
Using DHCP Clear Commands	355
Configure the System to be a Relay Agent	355
Configure the System to be a DHCP Client	357
DHCP Client on a Management Interface	357
DHCP Client Operation with Other Features	357
DHCP Relay When DHCP Server and Client are in Different VRFs	358
Configuring Route Leaking between VRFs on DHCP Relay Agent	359
Configure Secure DHCP	360
Option 82	360
DHCP Snooping	360
Drop DHCP Packets on Snooped VLANs Only	363
Dynamic ARP Inspection	363
Configuring Dynamic ARP Inspection	364
Source Address Validation	365
Enabling IP Source Address Validation	365
DHCP MAC Source Address Validation	366
Enabling IP+MAC Source Address Validation	366
Viewing the Number of SAV Dropped Packets	367
Clearing the Number of SAV Dropped Packets	367
Equal Cost Multi-Path (ECMP)	368
ECMP for Flow-Based Affinity	368
Enabling Deterministic ECMP Next Hop	368
Configuring the Hash Algorithm Seed	368
Link Bundle Monitoring	369
Managing ECMP Group Paths	369
Creating an ECMP Group Bundle	370
Modifying the ECMP Group Threshold	370
BGP Multipath Operation with Link Bankwidth	371
Dynamic Re-calculation of Link Bankwidth	372
Weighted ECMP for Static Routes	373
ECMP Support in L3 Host and LPM Tables	373
FCoE Transit	374
Fibre Channel over Ethernet	374
Ensure Robustness in a Converged Ethernet Network	374
FIP Snooping on Ethernet Bridges	376
FIP Snooping in a Switch Stack	378
Using FIP Snooping	378
FIP Snooping Prerequisites	378
Important Points to Remember	378
Enabling the FCoE Transit Feature	379
Enable FIP Snooping on VLANs	379
Configure the FC-MAP Value	379
Configure a Port for a Bridge-to-Bridge Link	380
Configure a Port for a Bridge-to-FCF Link	380
Impact on Other Software Features	380
FIP Snooping Restrictions	380
Configuring FIP Snooping	381
Displaying FIP Snooping Information	382
FCoE Transit Configuration Example	387
FIPS Cryptography	389
Configuration Tasks	389
Preparing the System	389
Enabling FIPS Mode	390
Generating Host-Keys	390
Monitoring FIPS Mode Status	390
Disabling FIPS Mode	391
Flex Hash and Optimized Boot-Up	392
Flex Hash Capability Overview	392
Configuring the Flex Hash Mechanism	392
LACP Fast Switchover	393
Configuring LACP Fast Switchover	393
LACP	393
LACP Fast Switchover	393
RDMA Over Converged Ethernet (RoCE) Overview	393
Sample Configurations	395
	395
Preserving 802.1Q VLAN Tag Value for Lite Subinterfaces	398
Force10 Resilient Ring Protocol (FRRP)	399
Protocol Overview	399
Ring Status	400
Multiple FRRP Rings	400
Important FRRP Points	401
Implementing FRRP	401
Important FRRP Concepts	402
FRRP Configuration	403
Creating the FRRP Group	403
Configuring the Control VLAN	403
Configuring and Adding the Member VLANs	404
Setting the FRRP Timers	405
Clearing the FRRP Counters	406
Viewing the FRRP Configuration	406
Viewing the FRRP Information	406
Troubleshooting FRRP	406
Configuration Checks	406
Sample Configuration and Topology	407
FRRP Support on VLT	408
Example Scenario	409
Important Points to Remember	410
GARP VLAN Registration Protocol (GVRP)	411
Important Points to Remember	411
Configure GVRP	412
Related Configuration Tasks	412
Enabling GVRP Globally	413
Enabling GVRP on a Layer 2 Interface	413
Configure GVRP Registration	413
Configure a GARP Timer	414
High Availability (HA)	415
High Availability on Chassis	415
High Availability in a PE Stack	415
Online Insertion and Removal	416
RPM Online Insertion	416
Line Card Online Insertion	416
Pre-configuring a Slot for a Line-Card Type	416
Replacing a Line Card	417
Hitless Behavior	417
Graceful Restart	418
Software Resiliency	418
System Health Monitoring	418
Failure and Event Logging	418
Trace Log	418
Core Dumps	419
System Log	419
Control Plane Redundancy	419
Control-Plane Failover	419
RPM Synchronization	420
Forcing an RPM Failover	420
Specifying an Auto-Failover Limit	421
Disabling Auto-Reboot	421
Internet Group Management Protocol (IGMP)	422
IGMP Implementation Information	422
IGMP Protocol Overview	422
IGMP Version 2	422
IGMP Version 3	424
Configure IGMP	427
Related Configuration Tasks	427
Viewing IGMP Enabled Interfaces	428

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1,000
1,001
1,002
1,003
1,004
1,005
1,006
1,007
1,008
1,009
1,010
1,011
1,012
1,013
1,014
1,015
1,016
1,017
1,018
1,019
1,020
1,021
1,022
1,023
1,024
1,025
1,026
1,027
1,028
1,029
1,030
1,031
1,032
1,033
1,034
1,035
1,036
1,037
1,038
1,039
1,040
1,041
1,042
1,043
1,044
1,045
1,046
1,047
1,048
1,049
1,050
1,051
1,052
1,053
1,054
1,055
1,056
1,057
1,058
1,059
1,060
1,061
1,062
1,063
1,064
1,065
1,066
1,067
1,068
1,069
1,070
1,071
1,072
1,073
1,074
1,075
1,076
1,077
1,078
1,079
1,080
1,081
1,082
1,083
1,084
1,085
1,086
1,087
1,088
1,089
1,090
1,091
1,092
1,093
1,094
1,095
1,096
1,097
1,098
1,099
1,100
1,101
1,102
1,103
1,104
1,105
1,106
1,107
1,108
1,109
1,110
1,111
1,112
1,113
1,114
1,115
1,116
1,117
1,118
1,119
1,120
1,121
1,122
1,123
1,124
1,125
1,126
1,127
1,128
1,129
1,130
1,131
1,132
1,133
1,134
1,135
1,136
1,137
1,138
1,139
1,140
1,141
1,142
1,143
1,144
1,145
1,146
1,147
1,148
1,149
1,150
1,151
1,152
1,153
1,154
1,155
1,156
1,157
1,158
1,159
1,160
1,161
1,162
1,163
1,164
1,165
1,166

Match case Limit results 1 per page

this check are forwarded to the server for validation. This checkpoint prevents an attacker from

spooﬁng

a client and declining or releasing

the real client’s address. Server-originated packets (DHCPOFFER, DHCPACK, and DHCPNACK) that arrive on a not trusted port are also

dropped. This checkpoint prevents an attacker from acting as an imposter as a DHCP server to facilitate a man-in-the-middle attack.

Binding table entries are deleted when a lease expires, or the relay agent encounters a DHCPRELEASE, DHCPNACK, or DHCPDECLINE.

DHCP snooping is supported on Layer 2 and Layer 3

traﬃc.

DHCP snooping on Layer 2 interfaces does not require a relay agent.

Binding table entries are deleted when a lease expires or when the relay agent encounters a DHCPRELEASE. Line cards maintain a list of

snooped VLANs. When the binding table is exhausted, DHCP packets are dropped on snooped VLANs, while these packets are forwarded

across non-snooped VLANs. Because DHCP packets are dropped, no new IP address assignments are made. However, DHCPRELEASE

and DHCPDECLINE packets are allowed so that the DHCP snooping table can decrease in size. After the table usage falls below the

maximum limit of 4000 entries, new IP address assignments are allowed.

NOTE:

DHCP server packets are dropped on all non-trusted interfaces of a system

conﬁgured

for DHCP snooping. To prevent

these packets from being dropped,

conﬁgure

ip dhcp snooping trust

on the server-connected port.

DHCP Snooping for a Multi-Tenant Host

You can

conﬁgure

the DHCP snooping feature such that multiple IP addresses are expected for the same MAC address. You can use the

ip dhcp snooping

command multiple times to map the same MAC address with

diﬀerent

IP addresses. This

conﬁguration

is also used

for dynamic ARP inspection (DAI) and source address validation (SAV). The DAI and SAV tables

reﬂect

the same entries in the DHCP

snooping binding table.

NOTE:

If you enable DHCP Option 82 using the

ip dhcp relay

command, by default, the remote-ID

ﬁeld

contains the MAC

address of the relay agent. If you

conﬁgure

the remote ID as the host name in a VLT setup,

conﬁgure

diﬀerent

host names on

both VLT peers. If you

conﬁgure

the remote ID with your own string, ensure that your strings are

diﬀerent

on both VLT peers.

DHCP Snooping in a VLT Setup

In a VLT setup, the DHCP snooping binding table synchronizes between the VLT nodes. Similarly, the DAI and SAV tables also synchronize

between VLT nodes. For this feature to work in a VLT setup, make sure that DHCP relay, DHCP snooping, SAV, and DAI

conﬁgurations

are

identical between the VLT peer nodes.

Enabling DHCP Snooping

To enable DHCP snooping, use the following commands.

Enable DHCP snooping globally.

CONFIGURATION mode

ip dhcp snooping

Specify ports connected to DHCP servers as trusted.

INTERFACE mode

ip dhcp snooping trust

Enable DHCP snooping on a VLAN.

CONFIGURATION mode

ip dhcp snooping vlan

name

Dynamic Host

Conﬁguration

Protocol (DHCP)

361