Filter
Top Products
21-13
Catalyst 3560 Switch Software Configuration Guide
OL-8553-06
Chapter 21 Configuring DHCP Features and IP Source Guard
Configuring DHCP Snooping
To disable DHCP snooping, use the no ip dhcp snooping global configuration command. To disable
DHCP snooping on a VLAN or range of VLANs, use the no ip dhcp snooping vlan vlan-range global
configuration command. To disable the insertion and removal of the option-82 field, use the no ip dhcp
snooping information option global configuration command. To configure an aggregation switch to
drop incoming DHCP snooping packets with option-82 information from an edge switch, use the no ip
dhcp snooping information option allow-untrusted global configuration command.
This example shows how to enable DHCP snooping globally and on VLAN 10 and to configure a rate
limit of 100 packets per second on a port:
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# ip dhcp snooping information option
Switch(config)# interface gigabitethernet0/1
Switch(config-if)# ip dhcp snooping limit rate 100
Enabling DHCP Snooping on Private VLANs
You can enable DHCP snooping on private VLANs. If DHCP snooping is enabled, the configuration is
propagated to both a primary VLAN and its associated secondary VLANs. If DHCP snooping is enabled
on the primary VLAN, it is also configured on the secondary VLANs.
If DHCP snooping is already configured on the primary VLAN and you configure DHCP snooping with
different settings on a secondary VLAN, the configuration for the secondary VLAN does not take effect.
You must configure DHCP snooping on the primary VLAN. If DHCP snooping is not configured on the
primary VLAN, this message appears when you are configuring DHCP snooping on the secondary
VLAN, such as VLAN 200:
2w5d:%DHCP_SNOOPING-4-DHCP_SNOOPING_PVLAN_WARNING:DHCP Snooping configuration may not take
effect on secondary vlan 200. DHCP Snooping configuration on secondary vlan is derived
from its primary vlan.
The show ip dhcp snooping privileged EXEC command output shows all VLANs, including primary
and secondary private VLANs, on which DHCP snooping is enabled.
Step 10
ip dhcp snooping limit rate rate (Optional) Configure the number of DHCP packets per second that an
interface can receive. The range is 1 to 2048. By default, no rate limit is
configured.
Note We recommend an untrusted rate limit of not more than 100
packets per second. If you configure rate limiting for trusted
interfaces, you might need to increase the rate limit if the port is
a trunk port assigned to more than one VLAN on which DHCP
snooping is enabled.
Step 11
exit Return to global configuration mode.
Step 12
ip dhcp snooping verify mac-address (Optional) Configure the switch to verify that the source MAC address in
a DHCP packet that is received on untrusted ports matches the client
hardware address in the packet. The default is to verify that the source
MAC address matches the client hardware address in the packet.
Step 13
end Return to privileged EXEC mode.
Step 14
show running-config Verify your entries.
Step 15
copy running-config startup-config (Optional) Save your entries in the configuration file.
Command Purpose