3-1
3 DHCP Snooping Configuration
After DHCP snooping is enabled on a device, clients connected with the device cannot obtain IP
addresses dynamically through BOOTP.
DHCP Snooping Overview
Function of DHCP Snooping
For security, the IP addresses used by online DHCP clients need to be tracked for the administrator to
verify the corresponding relationship between the IP addresses the DHCP clients obtained from DHCP
servers and the MAC addresses of the DHCP clients.
z Switches can track DHCP clients’ IP addresses through the security function of the DHCP relay
agent operating at the network layer.
z Switches can track DHCP clients’ IP addresses through the DHCP snooping function at the data
link layer.
When an unauthorized DHCP server exists in the network, a DHCP client may obtains an illegal IP
address. To ensure that the DHCP clients obtain IP addresses from valid DHCP servers, you can
specify a port to be a trusted port or an untrusted port by the DHCP snooping function.
z Trusted: A trusted port is connected to an authorized DHCP server directly or indirectly. It forwards
DHCP messages to guarantee that DHCP clients can obtain valid IP addresses.
z Untrusted: An untrusted port is connected to an unauthorized DHCP server. The DHCP-ACK or
DHCP-OFFER packets received from the port are discarded, preventing DHCP clients from
receiving invalid IP addresses.
Figure 3-1 illustrates a typical network diagram for DHCP snooping application, where Switch A is a
WX3000 series device.