Cisco 4500M User Manual

33-10
Software Configuration Guide—Release 12.2(25)EW
OL-6696-01
Chapter 33 Configuring DHCP Snooping and IP Source Guard
Overview of IP Source Guard
Displaying a Binding Table
The DHCP snooping binding table for each switch contains binding entries that correspond to untrusted
ports. The table does not contain information about hosts interconnected with a trusted port because each
interconnected switch will have its own DHCP snooping binding table.
This example shows how to display the DHCP snooping binding information for a switch:
Switch# sh ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type VLAN Interface
------------------ --------------- ---------- ------------- ---- --------------------
00:02:B3:3F:3B:99 55.5.5.2 6943 dhcp-snooping 10 FastEthernet6/10
Switch#
Table 33-2 describes the fields in the show ip dhcp snooping binding command output.
Displaying the DHCP Snooping Configuration
This example shows how to display the DHCP snooping configuration for a switch.
Switch# show ip dhcp snooping
Switch DHCP snooping is enabled.
DHCP Snooping is configured on the following VLANs:
10 30-40 100 200-220
Insertion of option 82 information is enabled.
Interface Trusted Rate limit (pps)
--------- ------- ----------------
FastEthernet2/1 yes 10
FastEthernet3/1 yes none
GigabitEthernet1/1 no 20
Switch#
Overview of IP Source Guard
Similar to DHCP snooping, this feature is enabled on a DHCP snooping untrusted Layer 2 port. Initially,
all IP traffic on the port is blocked except for DHCP packets that are captured by the DHCP snooping
process. When a client receives a valid IP address from the DHCP server, or when a static IP source
binding is configured by the user, a per-port and VLAN Access Control List (PVACL) is installed on the
port. This process restricts the client IP traffic to those source IP addresses configured in the binding;
any IP traffic with a source IP address other than that in the IP source binding will be filtered out. This
filtering limits a host’s ability to attack the network by claiming a neighbor host's IP address.
Table 33-2 show ip dhcp snooping binding Command Output
Field Description
MAC Address Client hardware MAC address
IP Address Client IP address assigned from the DHCP server
Lease (seconds) IP address lease time
Type Binding type; dynamic binding learned by dhcp-snooping or
statically-configured binding.
VLAN VLAN number of the client interface
Interface Interface that connects to the DHCP client host

Cisco 4500M Specifications

General

Brand	Cisco
Model	4500M
Category	Network Router
Language	English