IP DHCP SNOOPING

[dacruzer1]

Ladies and Gents,

I am thinking about enabling "ip dhcp snooping" on my 3750G switches and was reading through all the options:  .   I want the option that will protect my network from dhcp snooping but I'm not sure which option to enable.  I am running VLANs on all my switches.  If theres anyone out there that has done this before, I would appreciate it.

Thanks

Alfred

[acampbell · Accepted solution]

Alfred,

Here is a config that turns on DHCP snooping.
The DHCP server is on interface G1/0/10 and this is the only trused port.
All other ports are untrusted therefore DHCP responses like DHCPOFFER from untrusted ports are dropped.

You can read all about DHCP snooping in the config guide.
Here the link to IOS ver 12.2.55SE:-
http://www.cisco.com/en/US/docs/switches/lan/catalyst3750/software/release/12.2_55_se/configuration/guide/swdhcp82.html#wp1058138

config t
!
ip dhcp snooping
!
ip dhcp snooping vlan 3-6,10-20
!
interface g1/0/10
description MY DHCP SERVER
ip dhcp snooping trust
!

Regards,
Alex.
Please rate useful posts.

[dacruzer1]

Hi Alex,

Thanks mcuh for the info.  I have enabled per your config.

What about clients on the same switch, do I need to enable "ip DHCP snooping trust" also?

Thanks

Alfred

[acampbell]

Alfred,

In short NO

You only trust the interfaces that connected the DHCP servers.

Regards,
Alex.
Please rate useful posts.

[dacruzer1]

Alex,

Thansk again!

Alfred