3750 specific commands for configuring DHCP snooping

DHCP servers are widely used in routers or switches. So here we will explain this knowledge. First, let's take a look at the content of 3750 configuring DHCP snooping. Useless parts have been deleted.) the specific operation is as follows:

 
 

  
  
Clock timezone WST 8
  
  
Switch 1 provision ws-c3750g-48ts
  
  
System mtu routing 1500
  
  
Ip subnet-zero
  
  
Ip dhcp excluded-address 192.168.1.1 reserved address)
  
  
!
  
  
Ip dhcp pool test starts DHCP)
  
  
Network 192.168.1.0 255.255.255.0
  
  
Default-router 192.168.1.1
  
  
Dns-server 192.168.1.1
  
  
!
  
  
Ip dhcp snooping vlan 1 (specify the vlan protected by DHCP snooping)
  
  
Ip dhcp snooping information option allow-untrusted
  
  
Ip dhcp snooping database flash: snooping specifies the database path)
  
  
Ip dhcp snooping (3750 enable DHCP snooping first in DHCP snooping configuration)
  
  
!
  
  
!
  
  
Interface GigabitEthernet1/0/1
  
  
!
  
  
Interface GigabitEthernet1/0/31 normal port)
  
  
Switchport mode access
  
  
Spanning-tree portfast
  
  
!
  
  
Interface GigabitEthernet1/0/32
  
  
!
  
  
Interface GigabitEthernet1/0/42
  
  
!
  
  
Interface GigabitEthernet1/0/43 enable ip dhcp snooping port)
  
  
Switchport mode access
  
  
Switchport port-security
  
  
Spanning-tree portfast
  
  
Ip verify source
 
 

(Enable IP address verification. Users on this port cannot set their own IP addresses, which can only be obtained through DHCP, but there is no mac layer security control.

3750 test the DHCP snooping configuration. If the user of the g1/0/43 port has the IP address 192.168.1.2, and the user of g1/0/42 intentionally modifies the IP address to 192.168.1.2, the user of g1/0/43 will also be affected, although g1/0/42 cannot access the network by changing the IP address, g1/0/43 will prompt an IP conflict. Therefore, you must use DAI to protect the mac layer)

 
 

  
  
!  
  
  
interface GigabitEthernet1/0/44  
  
  
!  
  
  
interface GigabitEthernet1/0/45  
  
  
switchport mode access  
  
  
switchport port-security  
  
  
switchport port-security violation restrict  
  
  
spanning-tree portfast  
  
  
ip verify source port-security     
 
 

After the port is enabled, the IP address cannot be registered through DHCP. The reason is that MAC cannot be registered due to port-security restrictions)

 
 

  
  
(Ip verify source port-security is used together with the startup IP soure binding
  
  
Ip source binding 001b. a111.5e11 vlan 1 192.168.1.200 interface Gi1/0/45, note that ip source binding and dynamic DHCP cannot be used at the same time)
  
  
!
  
  
Interface GigabitEthernet1/0/46
 
 

The above is the details about configuring DHCP snooping in 3750.