Brief Introduction to dhcp snooping Configuration

The previous article describes and explains the network topology of dhcp snooping. I do not know whether you are clear. Here we will describe the dhcp snooping configuration. Hope to help you.

Configuration

1. 2918

Switch # configure terminal // global configuration mode

Switch (config) # interface range fa0/1-12

Switch (config-if-range) # switchport access vlan 100

Switch (config-if-range) # interface range fa0/13-24

Switch (config-if-range) # switchport access vlan 200

Switch (config-if-range) # interface gig0/1 // Connect Port 4506

Switch (config-if) # // You can manually configure the TRUNK.

2. 4506

Switch # configure terminal

Switch (config) # vtp version 2

Switch (config) # vtp mode client

Switch (config) # vtp domain gzy

Switch (config) # vtp password gzy123

Switch (config) # vlan 100

Switch (config) # vlan 200

Switch (config) # ip dhcp snooping // enable the dhcp snooping function of the Switch

Switch (config) # ip dhcp snooping vlan 100,200 // enable dhcp snooping in VLAN100 and 200

Switch (config) # no ip dhcp snooping information option // disable embedding or deleting option 82 information in DHCP packets

Switch (config) # ip dhcp snooping database tftp: // 192.168.200.1/snooping. dat

// Save the dhcp snooping database in the snooping. dat file of the tftp Server IP address 192.168.200.1)

Switch (config) # ip arp inspection vlan 100,200 // enable DAI in VLAN100 and 200

Switch (config) # ip arp inspection validate src-mac ip // use the source MAC and IP address to check if the ARP packet is valid

Switch (config) # interface gig1/1 // connect to port 6506

Switch (config-if) # switchport trunk encapsulation dot1q

Switch (config-if) # switchport mode trunk

Switch (config-if) # ip dhcp snooping trust

Switch (config-if) # ip arp inspection trust

Switch (config-if) # interface gig2/2 // ports connected to port 2918

Switch (config-if) # switchport trunk encapsulation dot1q

Switch (config-if) # switchport mode trunk

Switch (config-if) # ip arp inspection limit none

Switch (config-if) # ip verify source vlan dhcp-snooping

Switch (config-if) # end

Switch (config) # copy run start

Remarks

Writing to the end is getting increasingly lazy, basically it is like this. The configuration on 6506 is simple. Because 2918 does not support the above functions, it can only be enabled on port 4506. However, in this way, these functions can only be enabled on port 4506 connected to port 2918 under, the spoofing on 2918 cannot be prevented. No way, Cisco's approach is strange. Currently, many access layer Switches of domestic manufacturers can implement these functions, such as Quidway, H3C, shenzhoudigital, and ruijie. Due to the limited level, you can correct the incorrect content.