Brocade Communications Systems 6650 manual Enabling Dhcp snooping on a Vlan

DHCP snooping

1.Enable DHCP snooping on a VLAN.Refer to “Enabling DHCP snooping on a VLAN” on page 286.

2.For ports that are connected to a DHCP server, change their trust setting to trusted.Refer to “Enabling trust on a port” on page 286.

The following shows the default settings of DHCP snooping.

TABLE 71 Default DHCP snooping settings

Feature	Default
DHCP snooping	Disabled
Trust setting for ports	Untrusted

Enabling DHCP snooping on a VLAN

When DHCP snooping is enabled on a VLAN, DHCP packets are inspected.

DHCP snooping is disabled by default. This feature must be enabled on the client and the DHCP server VLANs. To enable DHCP snooping, enter the following global command for these VLANs.

Brocade(config)# ip dhcp snooping vlan 2

The command enables DHCP snooping on VLAN 2.

Syntax: [no] ip dhcp snooping vlan vlan-number

The vlan-numbervariable specifies the ID of a configured client or DHCP server VLAN.

Enabling trust on a port

The default trust setting for a port is untrusted. To enable trust on a port connected to a DHCP server, enter commands such as the following.

Brocade(config)# interface ethernet 1/1/1

Brocade(config-if-e10000-1/1/1)# dhcp snooping trust

Port 1/1/1 is connected to a DHCP server. The commands change the CLI to the interface configuration level of port1/ 1/1 and set the trust setting of port 1/1/1 to trusted.

Syntax: [no] dhcp snooping trust

Disabling the learning of DHCP clients on a port

You can disable DHCP client learning on an individual port. To do so, enter commands such as the following.

Brocade(config)# interface ethernet 1/1/1 Brocade(config-if-e10000-1/1/1)# dhcp snooping client-learning disable

Syntax: [no] dhcp snooping client-learning disable

Use the no form of the command to re-enable DHCP client learning on a port once it has been disabled.

286	Brocade ICX 6650 Security Configuration Guide
	53-1002601-01