Code example: IP dhcp snooping configuration (1)

In the previous article, we have also explained the knowledge about dhcp snooping, its understanding, configuration, and related modulation. Here, we will introduce the specific configuration and case analysis of IP dhcp snooping, hoping to help you.

1. 3750 configure the DHCP service and DHCP snooping

 
 

  
  
The useless parts have been deleted)
  
  
Clock timezone WST 8
  
  
Switch 1 provision ws-c3750g-48ts
  
  
System mtu routing 1500
  
  
Ip subnet-zero
  
  
Ip dhcp excluded-address 192.168.1.1 reserved address)
  
  
!
  
  
Ip dhcp pool test starts DHCP)
  
  
Network 192.168.1.0 255.255.255.0
  
  
Default-router 192.168.1.1
  
  
Dns-server 192.168.1.1
  
  
!
  
  
Ip dhcp snooping vlan 1 (specify the vlan protected by DHCP snooping)
  
  
Ip dhcp snooping information option allow-untrusted
  
  
Ip dhcp snooping database flash: snooping specifies the database path)
  
  
Ip dhcp snooping (start DHCP snooping)
  
  
!
  
  
!
  
  
Interface GigabitEthernet1/0/1
  
  
!
  
  
Interface GigabitEthernet1/0/31 normal port)
  
  
Switchport mode access
  
  
Spanning-tree portfast
  
  
!
  
  
Interface GigabitEthernet1/0/32
  
  
!
  
  
Interface GigabitEthernet1/0/42
  
  
!
  
  
Interface GigabitEthernet1/0/43 enable ip dhcp snooping port)
  
  
Switchport mode access
  
  
Switchport port-security
  
  
Spanning-tree portfast
  
  
Ip verify source
 
 

(Enable IP address verification. Users on this port cannot set their own IP addresses, which can only be obtained through DHCP, but there is no mac layer security control.
The test shows that if the user with the g1/0/43 port has an IP address of 192.168.1.2 and the user with the g1/0/42 port has intentionally changed the IP address to 192.168.1.2, the user with the g1/0/43 port will also be affected, although g1/0/42 cannot access the network by changing the IP address, g1/0/43 will prompt an IP conflict. Therefore, you must use DAI to protect the mac layer)

 
 

  
  
!
  
  
Interface GigabitEthernet1/0/44
  
  
!
  
  
Interface GigabitEthernet1/0/45
  
  
Switchport mode access
  
  
Switchport port-security
  
  
Switchport port-security violation restrict
  
  
Spanning-tree portfast
  
  
Ip verify source port-security
  
  
After the port is enabled, the IP address cannot be registered through DHCP. The reason is that MAC cannot be registered due to port-security restrictions)
  
  
(Ip verify source port-security is used together with the startup IP soure binding
  
  
Ip source binding 001b. a111.5e11 vlan 1 192.168.1.200 interface Gi1/0/45, note that ip source binding and dynamic DHCP cannot be used at the same time)
  
  
!
  
  
Interface GigabitEthernet1/0/46
  
  
!