31-4
Software Configuration Guide—Release 12.2(25)SG
OL-7659-03
Chapter31 Configuring DHCP Snooping and IP Source Guard
Configuring DHCP Snooping on the Switch
If you want to change the default configuration values, see the “Enabling DHCP Snooping” section.
Enabling DHCP Snooping
Note When DHCP snooping is enabled globally, DHCP requests are dropp ed until the ports are configured.
Consequently, you should probably configure this feature during a maintenance window an d not during
production.
To enable DHCP snooping, perform this task:
You can configure DHCP snooping for a single VLAN or a range of VLANs. To configure a single
VLAN, enter a single VLAN number. To configure a range of VLANs, enter a beginning and an ending
VLAN number or a dash and range of VLANs.
Table31-1 Default Configuration Values for DHCP Snooping
Option Default Value/State
DHCP snooping Disabled
DHCP snooping information option Enabled
DHCP snooping information option
allow-untrusted
Disabled
DHCP snooping limit rate Infinite (functions as if rate limiting were disabled)
DHCP snooping trust Untrusted
DHCP snooping vlan Disabled
Command Purpose
Step1 Switch(config)# ip dhcp snooping Enables DHCP snooping globally.
You can use the no keyword to disable DHCP snooping.
Step2 Switch(config)# ip dhcp snooping vlan
number
[
number
] | vlan {
vlan range
}]
Enables DHCP snooping on your VLAN or VLAN range
Step3 Switch(config-if)# ip dhcp snooping trust Configures the interface as trusted or untrusted.
You can use the no keyword to configure an interface to
receive messages from an untrusted client.
Step4 Switch(config-if)# ip dhcp snooping limit rate
rate
Configures the number of DHCP packets per second
(pps) that an interface can receive.1
1. Cisco recommends not configuring the untrusted interface rate limit to more than 100 packets per second. The recommended rate limit for
each untrusted client is 15 packets per second. Normally, the rate limit applies to untrusted interfaces. If you want to set up rate limiting for
trusted interfaces, keep in mind that trusted interfaces aggregate all DHCP traffic in the switch, and you will need to adjust the rate limit to a
higher value. You should fine tune this threshold depending on the network configuration. The CPU should not receive DHCP packets at a
sustained rate of more than 1,000 packets per second
Step5 Switch(config)# end Exits configuration mode.
Step6 Switch# show ip dhcp snooping Verifies the configuration.