Brocade FastIron Ethernet Switch Security Configuration Guide - Manual (Page 339)

Configuring DHCP snooping
Configuring DHCP snooping consists of the following steps.
1. Enable DHCP snooping on a VLAN.Refer to Enabling DHCP snooping on a VLAN on page 339.
2. For ports that are connected to a DHCP server, change their trust setting to trusted.Refer to Enabling
DHCP snooping on a VLAN on page 339.
The following shows the default settings of DHCP snooping.
Feature Default
DHCP snooping Disabled
Trust setting for ports Untrusted
Enabling DHCP snooping on a VLAN
When DHCP snooping is enabled on a VLAN, DHCP packets are inspected.
DHCP snooping is disabled by default. This feature must be enabled on the client and the DHCP server
VLANs. To enable DHCP snooping, enter the following global command for these VLANs.
device(config)#ip dhcp snooping vlan 2
The command enables DHCP snooping on VLAN 2.
Syntax: [no] ip dhcp snooping vlan vlan-id
The vlan-id variable specifies the ID of a configured client or DHCP server VLAN.
Enabling trust on a port connected to a DHCP server
The default trust setting for a port is untrusted. To enable trust on a port connected to a DHCP server,
enter commands such as the following.
device(config)#interface ethernet 1/1
device(config-if-e10000-1/1)#dhcp snooping trust
Port 1/1 is connected to a DHCP server. The commands change the CLI to the interface configuration
level of port 1/1 and set the trust setting of port 1/1 to trusted.
Syntax: [no] ip dhcp snooping trust
Disabling the learning of DHCP clients on a port
You can disable DHCP client learning on an individual port. To do so, enter commands such as the
following.
device(config)#interface ethernet 1/1
device(config-if-e10000-1/1)#dhcp snooping client-learning disable
Syntax: [no] dhcp snooping client-learning disable
Use the no form of the command to re-enable DHCP client learning on a port once it has been disabled.
Configuring DHCP snooping
FastIron Ethernet Switch Security Configuration Guide 339
53-1003088-03