ip dhcp snooping on vlan

[vishalpatil86]

hi

i have following configuration in my switch

ALS1(config)# ip dhcp snooping
ALS1(config)# interface range fastethernet 0/7 - 12
ALS1(config-if-range)# ip dhcp snooping trust
ALS1(config-if-range)# exit
ALS1(config)# interface range fastethernet 0/15 - 24
ALS1(config-if-range)# ip dhcp snooping limit rate 20
ALS1(config-if-range)# exit
ALS1(config)# ip dhcp snooping vlan 100,200

my question is why do we have to configure dhcp snooping on vlan if we already configured on port??

Thanks

vish

[Jon Marshall]

Vish

You haven't configured it on the port as such.

First you enable it globally which have done.

You then specific which vlans you want it to run on.

Then at the port level you can specify certain parameters such as is the port a trusted port.

Nowhere in your config above have you specified untrusted ports but the switch knows which they are because you have specified -

1) the vlan to run DHCP snooping on

and

2) the ports that are trusted

so it can work out which ports are untrusted.

Jon

[vishalpatil86]

hi jon,

let me rephrase the question.

why do we need to enable snooping on vlans? is it really necessary? if yes, why?

[Jon Marshall]

I think it just gives you more flexibility ie. you may want to enable DHCP snooping but only for some vlans.

If you are asking why you need to enable it globally and then per vlan when you could just enable it per vlan I agree with what you are saying.

There are a number of other commands etc. that follow this line ie. enable it globally and then per vlan or per interface etc.

I suspect it may be to do with enabling it globally sets up certain things needed on a system wide and not a per vlan or per interface basis but I have wondered that myself sometimes :-)

Jon

[vishalpatil86]

ok, i understood what you are trying to say.

but, if i dont enable it on vlan, does it matter?

i mean if i am enabling it globally, then i am enabling it per port basis, then do i need to enable it on vlan as well?

rephrasing the question ---

if fa0/1-10 are in vlan 100

then, is enabling snooping per port basis(fa0/1010) similar to enabling it on vlan 100?

[Jon Marshall]

No it's isn't.

DHCP snooping is not active until you enable it on the vlan so you can't just configure it on the ports.

Jon

[vishalpatil86]

thanks jon,

this is what i was looking for. so we need to activate it on vlan to make it work..

thanks,

vish