When ARP encounters DHCP Snooping

We have been learning DHCP Snooping for some time. DHCP Snooping is a barrier for DHCP to handle security issues. Let's take a look at ARP and DHCP Snooping.

Relationship between DHCP Snooping and ARP Detection

ARP detection is to check all ARP packets passing through the device. DHCP Snooping needs to provide database information for ARP detection. When receiving ARP packets, the DAI module queries the bound database of DHCP snooping Based on the packet. It considers the received ARP packet to be valid only when the mac, ip, and port information of the received ARP packet are matched, or discard the message.

Other considerations for DHCP Snooping Configuration
 
The DHCP Snooping function and the DHCP Option 82 function of 1x are mutually exclusive.

DHCP Snooping and DHCP Option82

DHCP Snooping only detects the user's DHCP process. If you want to control the user's access through an IP address allocated by DHCP, you must use the ARP detection function. The ARP detection module must detect all ARP packets, therefore, it will affect the overall performance of the device.

Enable or disable DHCP Snooping

By default, the DHCP Snooping function of the device is disabled. When the ip dhcp snooping command is configured, the device enables the dhcp snooping function to monitor dhcp packets.

 
 

  
  
Switch # configure terminal // enter the Configuration Mode
  
  
Switch (config) # [no] ip dhcp snooping DHCP snooping // enable and disable
 
 

Below is the configuration to enable the DHCP snooping function of the device:

 
 

  
  
switch# configure terminal   
  
  
switch(config)# ip dhcp snooping   
  
  
switch(config)# end   
  
  
switch# 
 
 

Configure the DHCP source MAC check function

After this command is configured, the device checks the MAC address of the source MAC and Client fields for the DHCP Request packets sent from the UNTRUST port, and discards invalid packets with different MAC values. Check is not performed by default.

 
 

  
  
Switch # configure terminal // enter the Configuration Mode
  
  
Switch (config) # [no] ip dhcp snooping
  
  
Verify mac-address