Layer 2 Switching Commands 345
ip dhcp snooping trust
Use the ip dhcp snooping trust command to configure a port as trusted. Use
the no form of this command to configure a port as untrusted.
Syntax
ip dhcp snooping trust
no ip dhcp snooping trust
Default Configuration
Ports are untrusted by default.
Command Mode
Interface Configuration (gigabitethernet, port-channel, tengigabitethernet,
fortygigabitethernet) mode
User Guidelines
Configuring an interface as trusted disables DHCP snooping validation of
DHCP packets and exposes the port to IPv4 DHCP DoS attacks. Configuring
an interface as untrusted indicates that the switch should firewall DHCP
messages and act as if the port is connected to a device outside the DMZ.
DHCP snooping must be enabled globally and on the VLAN for which the
port is a member for this command to have an effect.
Interfaces connected to the DHCP server must be configured as trusted in
order for DHCP snooping to operate.
Use the ip verify source command to disallow traffic from untrusted sources
on an interface.
Example
console(config-if-Gi1/0/1)#ip dhcp snooping trust
console(config-if-Gi1/0/1)#no ip dhcp snooping trust
To Next Page
Loading...
Need help?
General
