Recording ip-to-mac mappings of dhcp clients – H3C Technologies H3C WX3000E Series Wireless Switches User Manual
Page 189
173
NOTE:
The DHCP snooping-enabled device must be either between the DHCP client and relay agent, or between
the DHCP client and server. It does not work if it is between the DHCP relay agent and DHCP server.
As a DHCP security feature, DHCP snooping can implement the following:
1.
Recording IP-to-MAC mappings of DHCP clients
2.
Ensuring DHCP clients to obtain IP addresses from authorized DHCP servers
Recording IP-to-MAC mappings of DHCP clients
DHCP snooping reads DHCP-REQUEST messages and DHCP-ACK messages from trusted ports to record
DHCP snooping entries, including MAC addresses of clients, IP addresses obtained by the clients, ports
that connect to DHCP clients, and VLANs to which the ports belong.
Ensuring DHCP clients to obtain IP addresses from authorized DHCP servers
If there is an unauthorized DHCP server on a network, DHCP clients may obtain invalid IP addresses and
network configuration parameters, and cannot normally communicate with other network devices. With
DHCP snooping, the ports of a device can be configured as trusted or untrusted, ensuring the clients to
obtain IP addresses from authorized DHCP servers.
•
Trusted—A trusted port forwards DHCP messages normally.
•
Untrusted—An untrusted port discards the DHCP-ACK or DHCP-OFFER messages received from
any DHCP server.
Recommended configuration procedure (for DHCP
server)
Step Remarks
Required.
Enable DHCP globally.
By default, global DHCP is disabled.
2.
Creating an address pool for the DHCP server
Creating a static address pool for the DHCP
Creating a dynamic address pool for the DHCP
Required.
Use at least one approach.
IMPORTANT:
•
If the DHCP server and DHCP clients are on the
same subnet, make sure the address pool is on the
same network segment as the interface with the
DHCP server enabled; otherwise, the clients will
fail to obtain IP addresses.
•
If a DHCP client obtains an IP address via a DHCP
relay agent, an IP address pool on the same
network segment as the DHCP relay agent
interface must be configured; otherwise, the client
will fail to obtain an IP address.