D-Link DWS-4026 [251/741] Configuring dhcp snooping

ConfiguringDHCPSnooping

D-Link UnifiedWiredandWirelessAccessSystem

November2011 Page251

D‐LinkUWSUserManual

ConfiguringDHCPSnooping

DHCPsnoopingisasecurityfeaturethatmonitorsDHCPmessagesbetweenaDHCPclientandDHCPserversto

filterharmfulDHCPmessagesandtobuildabindingsdatabaseof{MACaddress,IPaddress,VLANID,port}

tuplesthatareconsideredauthorized.YoucanenableDHCPsnoopinggloballyandonspecificVLANs,and

onfigureportswithintheVLANtobetrustedoruntrusted.DHCPserversmustbereachedthroughtrusted

ports.DHCPsnoopingenforcesthefollowingsecurityrules:

•DHCPpacketsfromaDHCPserver(DHCPOFFER,DHCPACK,DHCPNAK,DHCPRELEASEQUERY)aredropped

ifreceivedonanuntrustedport.

•DHCPRELEASEandDHCPDECLINEmessagesaredroppedifdestinedfo

raMACaddressinthesnooping

database,butthecorrespondingIPaddressinthesnoopingdatabaseisdifferentthantheinterfacewhere

themessagewasreceived.

•Onuntrustedinterfaces,theswitchdropsDHCPpack etswhosesourceMACaddressdoesnotmatchthe

clienthardwareaddress.Thisfeatureisaconfigurableoptio

ThehardwareidentifiesallincomingDHCPpacketsonportswhereDHCPsnoopingisenabled.DHCPsnooping

isenabledonaportif(a)DHCPsnoopingisenabledglobally,and(b)theportisamemberofaVLANwhere

DHCPsnoopingisenabled.Onuntrustedports,thehardwaretrapsallinc

omingDHCPpacketstotheCPU.On

trustedports,thehardwareforwardsclientmessagesandcopiesservermessagestotheCPUsothatDHCP

snoopingcanlearnthebinding.

GlobalDHCPSnoopingConfiguration

ToaccesstheDHCPSnoopingConfigurationpage,clickLAN>L2Features>DHCPSnooping>Configurationin

thenavigationtree.

Figure156:DHCPSnoopingConfiguration

•ClickSubmittoapplythenewconfigurationandcausethechangetotakeeffect.Thesechangeswillnot

beretainedacrossapowercycleunlessaSa

veconfigurationisperformed.

Table137:DHCPSnoopingConfiguration

Field Description

DHCPSnoopingMode EnablesordisablestheDHCPSnoopingfeature.ThedefaultisDisable.

MACAddressValidation EnablesordisablesthevalidationofsenderMACAddressforDHCPSnooping.

ThedefaultisEnable.