dhcp snooping trusted
Function
The dhcp snooping trusted command configures an interface as a trusted interface.
The undo dhcp snooping trusted command configures an interface as an untrusted interface.
By default, an interface is an untrusted interface.
Format
In the VLAN view:
dhcp snooping trusted interface interface-type interface-number
undo dhcp snooping trusted interface interface-type interface-number
In the interface view:
dhcp snooping trusted
undo dhcp snooping trusted
Parameters
| Parameter | Description | Value |
|---|---|---|
| interface interface-type interface-number | Specifies the type and number of an interface in a VLAN.
|
- |
Usage Guidelines
Usage Scenario
To enable DHCP clients to obtain IP addresses from authorized DHCP servers, DHCP snooping supports the trusted interface and untrusted interfaces. The trusted interface forwards DHCP messages while untrusted interfaces discard received DHCP ACK messages and DHCP Offer messages.
An interface directly or indirectly connected to the DHCP server trusted by the administrator needs to be configured as the trusted interface, and other interfaces are configured as untrusted interfaces. This ensures that DHCP clients obtain IP addresses from authorized DHCP servers.
Prerequisites
In the system view, run the dhcp snooping enable command to enable DHCP snooping.
Precautions
If you run the dhcp snooping trusted command in the VLAN view, the command takes effect for all the DHCP messages received from the specified VLAN. If you run the dhcp snooping trusted command in the interface view, the command takes effect for all the DHCP messages received on the specified interface.
Example
# Configure GE0/0/1 in VLAN 100 as the trusted interface.
<AC6605> system-view [AC6605] dhcp enable [AC6605] dhcp snooping enable [AC6605] vlan 100 [AC6605-vlan100] dhcp snooping trusted interface gigabitethernet 0/0/1
# Configure GE0/0/1 as the trusted interface.
<AC6605> system-view [AC6605] dhcp enable [AC6605] dhcp snooping enable [AC6605] interface gigabitethernet 0/0/1 [AC6605-GigabitEthernet0/0/1] dhcp snooping trusted
