H3C Technologies H3C WX3000E Series Wireless Switches - Manual (Page 69)

58
• IP source guard: IP source guard uses dynamic binding entries generated by DHCP snooping to
filter packets on a per-port basis, and thus prevents unauthorized packets from traveling through. For
more information, see the Security Configuration Guide.
Application environment of trusted ports
Configuring a trusted port connected to a DHCP server
Figure 24 Configure trusted and untrusted ports
As shown in Figure 24 , the DHCP snooping device port that is connected to an authorized DHCP server
should be configured as a trusted port. The trusted port forwards reply messages from the authorized
DHCP server to the client, but the untrusted port does not forward reply messages from the unauthorized
DHCP server. This ensures that the DHCP client obtains an IP address from the authorized DHCP server.
Configuring trusted ports in a cascaded network
In a cascaded network involving multiple DHCP snooping devices, the ports connected to other DHCP
snooping devices should be configured as trusted ports.
To save system resources, you can disable the trusted ports, which are indirectly connected to DHCP
clients, from recording client IP-to-MAC bindings upon receiving DHCP requests.
Trusted
DHCP server
DHCP snooping
Untrusted Untrusted
Unauthorized
DHCP server
DHCP client
DHCP reply messages