set dhcpsnooping trust
17-6 DHCP Snooping and Dynamic ARP Inspection
Mode
Switchcommand,read‐write.
Usage
Whenaswitchlearnsofnewbindingsorwhenitlosesbindings,theswitchupdatestheentriesin
thebindingsdatabaseaccordingtothewritedelaytimer.Theswitchalsoupdatestheentries in
thebindingfile.The frequencyatwhichthefileisupdatedisbasedonthedelayconfigured
with
thiscommand,andtheupdatesarebatched.
Example
Thefollowingexamplespecifies thatthestoreddatabaseshouldbeupdatedonceanhour.
C2(rw)->set dhcpsnooping database write-delay 3600
set dhcpsnooping trust
UsethiscommandtoenableordisableaportasaDHCPsnoopingtrustedport.
Syntax
set dhcpsnooping trust port port-string {enable | disable}
Parameters
Defaults
Bydefault,portsareuntrusted.
Mode
Switchcommand,read‐write.
Usage
InorderforDHCPsnoopingtooperate,snoopinghastobeenabledgloballyandonspecific
VLANs,andtheportswithintheVLANshavetobeconfiguredastrustedoruntrusted.On
trustedports,DHCPclientmessagesareforwardeddirectlybythehardware.Onuntrustedports,
clientmessagesaregivento
theDHCPsnoopingapplication.
TheDHCPsnoopingapplicationbuildsthebindingsdatabasefromclientmessagesreceivedon
untrustedports.DHCPsnoopingcreatesa“tentativebinding”fromDHCPDISCOVERand
REQUESTmessages.Tent ativebindingstieaclienttotheportonwhichthemessagepacketwas
received.Tentativebindingsarecompletedwhen
DHCPsnoopinglearnstheclient’sIPaddress
fromaDHCPACKmessageonatrustedport.
TheportsontheswitchthroughwhichDHCPserversarereachedmustbeconfiguredastrusted
portssothatpacketsreceivedfromthoseportswillbeforwardedtoclients.DCHPpacketsfroma
DHCP
server(DHCPOFFER,DHCPACK,DHCPNAK)aredroppedifreceivedonanuntrusted
port.
portport‐string Specifiestheportorportstobeenabledordisabledastrustedports.The
portscanbephysicalportsorLAGsthat aremembersofaVLAN.
enable|disable Enablesordisablesthe
specifiedportsastrustedports.
To Next Page
Need help?
General