DHCP-relay Snooping Configuration Commands I Table of Contents Table of Contents 1.1.1 ip dhcp-relay snooping..........................................................................................................1 1.1.2 ip dhcp-relay snooping vlan..................................................................................................2 1.1.3 ip dhcp-relay snooping vlan vlan_id max-client................................................................ 3 1.1.4 ip dhcp-relay snooping database-agent.............................................................................3 1.1.5 ip dhcp-relay snooping db-file..............................................................................................4 1.1.6 ip dhcp-relay snooping write-time........................................................................................5 1.1.7 ip dhcp-relay snooping write-immediately..........................................................................5 1.1.8 ip dhcp-relay snooping log....................................................................................................6 1.1.9 ip dhcp-relay snooping rapid-refresh-bind......................................................................... 7 1.1.10 dhcp-relay snooping information option...........................................................................7 1.1.11 ip verify source vlan.............................................................................................................8 1.1.12 ip arp inspection vlan.......................................................................................................... 9 1.1.13 ip source binding................................................................................................................10 1.1.14 arp inspection trust............................................................................................................ 11 1.1.15 dhcp snooping trust........................................................................................................... 11 1.1.16 dhcp snooping deny..........................................................................................................12 1.1.17 dhcp snooping information circuit-id...............................................................................13 1.1.18 dhcp snooping information remote-id string..................................................................13 1.1.19 dhcp snooping information vendor-specific...................................................................14 1.1.20 dhcp snooping information append................................................................................ 15 1.1.21 dhcp snooping information drop......................................................................................16 1.1.22 ip-source trust.................................................................................................................... 17 1.1.23 show ip dhcp-relay snooping...........................................................................................18 1.1.24 show ip dhcp-relay snooping binding.............................................................................18 1.1.25 debug ip dhcp-relay snooping......................................................................................... 19 1.1.26 debug ip dhcp-relay event................................................................................................19 1.1.27 debug ip dhcp-relay binding.............................................................................................20 II DHCP-relay Snooping Configuration Commands Chapter 1 DHCP-relay Snooping Configuration Commands The DHCP-relay snooping configuration commands include:  ip dhcp-relay snooping  ip dhcp-relay snooping vlan  ip dhcp-relay snooping database-agent  ip dhcp-relay snooping db-file  ip verify source vlan  ip arp inspection vlan  ip source binding  arp inspection trust  dhcp snooping trust  ip-source trust  show ip dhcp-relay snooping  show ip dhcp-relay snooping binding  debug ip dhcp-relay snooping  debug ip dhcp-relay event  debug ip dhcp-relay binding 1.1.1 ip dhcp-relay snooping Syntax To enable or disable the DHCP-relay snooping function in a VLAN, run ip dhcp-relay snooping. To resume the corresponding default settings, run no dhcp-relay snooping. ip dhcp-relay snooping no ip dhcp-relay snooping Parameters None 1 DHCP-relay Snooping Configuration Commands Default Value The dhcp-relay snooping function is disabled by default. Usage Guidelines None Example The following example shows how to enable the DHCP snooping function: Switch_config#ip dhcp-relay snooping Switch_config# 1.1.2 ip dhcp-relay snooping vlan Syntax ip dhcp-relay snooping vlan vlan_id no ip dhcp-relay snooping vlan vlan_id Parameters Parameters Description vlan_id Stands for the ID of a VLAN. Value range: 1-4094 Default Value None Usage Guidelines This command is used to configure the VLAN of DHCP snooping. Example The following example shows how to enable snooping detection for DHCP packets on VLAN 2. Switch_config#ip dhcp-relay snooping vlan 2 Switch_config# 2 DHCP-relay Snooping Configuration Commands 1.1.3 ip dhcp-relay snooping vlan vlan_id max-client Syntax ip dhcp-relay snooping vlan vlan_id max-client number no ip dhcp-relay snooping vlan vlan_id max-client Parameters Parameters Description vlan_id Stands for the ID of a VLAN. Value range: 1-4094 number Allowable maximum number of users: 0-65535 Default Value The default maximum number of users is 65535. Usage Guidelines You can use this command to set the maximum users in a VLNA of DHCP snooping. During this settings, the principle “first come and first be distributed” will be followed. When the number of users in the VLAN reaches the maximum value, new clients are then forbidden to distribute. Example The following example shows that snooping check will be conducted towards the DHCP packets in VLAN2 and the allowable maximum number of users is 3. Switch_config#ip dhcp-relay snooping vlan 2 max-client 3 Switch_config# 1.1.4 ip dhcp-relay snooping database-agent Syntax To bind DHCP snooping to standby TFTP server, run ip dhcp-relay snooping database-agent A.B.C.D. ip dhcp-relay snooping database-agent A.B.C.D no ip dhcp-relay snooping database-agent A.B.C.D 3 DHCP-relay Snooping Configuration Commands Parameters Parameters Description A.B.C.D Means the IP address of the TFTP server. Default Value There is no standby servers by default. Usage Guidelines If the address of the TFTP server is not configured, the binding backup is not conducted. Example The following example shows how to set the address of a server of backing up DHCP snooping binding to 192.168.1.1. Switch_config#ip dhcp-relay snooping database-agent 192.168.1.1 Switch_config# 1.1.5 ip dhcp-relay snooping db-file Syntax ip dhcp-relay snooping db-file name [timestamp] no ip dhcp-relay snooping db-file [timestamp] Parameters Parameters Description Name File name which is saved during DHCP snooping binding backup. timestamp Timestamp which is the file name of the binding backup. Default Value There is no file. Usage Guidelines If the file name is not configured, the binding backup is not conducted. 4 DHCP-relay Snooping Configuration Commands Example The following example shows how to set the file name of binding backup to dhcp_binding.txt. Switch_config#ip dhcp-relay snooping db-file dhcp_binding.txt Switch_config# 1.1.6 ip dhcp-relay snooping write-time Syntax ip dhcp-relay snooping write-time num no ip dhcp-relay snooping write-time Parameters Parameters Description Num Stands for the interval of backing up the DHCP snooping binding (2-1440). Default Value The default value of the interval is 30 minutes. Usage Guidelines The binding update will be checked during interval configuration. If the binding is updated, the binding information need be backed up. Example The following example shows how to set the interval of backing up the binding to 60 minutes. Switch_config#ip dhcp-relay snooping write-time 60 Switch_config# 1.1.7 ip dhcp-relay snooping write-immediately Syntax ip dhcp-relay snooping write-immediately no ip dhcp-relay snooping write-immediately 5 DHCP-relay Snooping Configuration Commands Parameters None Default Value None Usage Guidelines If there is entry update, it will write into the entry database immediately. It is recommended that the function is not enabled when there is plenty of entries. Otherwise, the performance may be affected. Example The following example shows how to backup the binding entry after the configuration is updated. Switch_config#ip dhcp-relay snooping write-immediately Switch_config# 1.1.8 ip dhcp-relay snooping log Syntax ip dhcp-relay snooping log no ip dhcp-relay snooping log Parameters None Default Value None Usage Guidelines After the log function is enabled, the syslog will report if there is packets of dhcp server on non-trust port, which indicates that there is illegal dhcp server on the port reporting syslog. Example The following example shows how to enable the DHCP-relay snooping function: 6 DHCP-relay Snooping Configuration Commands Switch_config#ip dhcp-relay snooping log Switch_config# 1.1.9 ip dhcp-relay snooping rapid-refresh-bind Syntax To enable rapid update of DHCP snooping, run ip dhcp-relay snooping rapid-refresh-bind. ip dhcp-relay snooping rapid-refresh-bind no ip dhcp-relay snooping rapid-refresh-bind Parameters None Default Value None Usage Guidelines After this function is enabled, the DHCP attack of fake MAC will be closed; when the client is allowed to change the access port, the IP address can be directly acquired without waiting for the expiration of the IP lease. If the client change the access port after the function is disabled, the device enabling snooping will take it as dhcp packet attack of fake mac and the dhcp packet will be dropped. Example None 1.1.10 dhcp-relay snooping information option Syntax ip dhcp-relay snooping information option [ format snmp-ifindex | manual | cm-type | hn-type [host] ] 7 DHCP-relay Snooping Configuration Commands no ip dhcp-relay snooping information option [ format snmp-ifindex | manual | cm-type | hn-type [host] ] Parameters Parameters Description format snmp-ifindex Fills in option 82 in SNMP ifindex mode (optional). format manual Uses the manual configuration to fill in option82 (optional). format cm-type Uses cm-type to fill in option82 (optional) format hn-type [host] Uses the Cisco format to enter option82 (optional). Host means the configuration device is the master switch. Default Value Option 82 will not be added to or removed from the report by default. Usage Guidelines This command is used to set whether DHCP option82 can be handled when a switch is conducting DHCP snooping. If format snmp-ifindex is specified, you should use SNMP ifindex to fill in option82; if format manual is specified, you should use the character string, which is set by the command “dhcp snooping information circuit-id string” on all ports, to full in the circuit-id option of option82; in other cases, fill in option82 according to the rules of RFC3046. Example The following example shows how to fill in option 82 in SNMP ifindex mode. Switch_config#ip dhcp-relay snooping Switch_config#ip dhcp-relay snooping information option format snmp-ifindex The following example shows how to fill in option 82 in manual mode. Switch_config#ip dhcp-relay snooping Switch_config#ip dhcp-relay snooping vlan [WORD] //[WORD] stands for the vlan name for start up the snooping function. Switch_config# ip dhcp-relay snooping information option format manual 1.1.11 ip verify source vlan Syntax ip verify source vlan vlanid 8 DHCP-relay Snooping Configuration Commands no ip verify source vlan vlanid Parameters Parameters Description vlan id Stands for the ID of a VLAN. Value range: 1-4094 Default Value None Usage Guidelines This command is used to configure a VLAN for monitoring the source IP address. The “no” form of this command is used to cancel this VLAN. If the source IP address and source MAC address of the IP packet is not the client’s legal address, which is distributed by the DHCP server and listened by DHCP snooping, the vlan in which IP source address will take the kind of packets as illegal ones and drop them. Example The following example shows how to conduct source IP address monitoring to the packets from all physical interfaces (except trusted interfaces) in VLAN2. Switch_config#ip verify source vlan 2 Switch_config# 1.1.12 ip arp inspection vlan Syntax ip arp inspection vlan vlanid no ip arp inspection vlan vlanid Parameters Parameters Description vlanid Stands for the ID of a VLAN. Value range: 1-4094 Default Value None 9 DHCP-relay Snooping Configuration Commands Usage Guidelines This command is used to configure a VLAN for monitoring the source address of the ARP packet. The “no” form of this command is used to cancel this VLAN. In the VLAN where monitoring the source address of the ARP packets is enabled, if SIP and SMAC of a ARP packet, which correspond to the IP address and MAC address of the client that the DHCP server distributes to the client, are unsuitable, the ARP packet will be dropped. Example The following example shows how to conduct source address monitoring to the ARP packets from all physical interfaces (except trusted interfaces) in VLAN2. Switch_config#ip arp inspection vlan 2 Switch_config# 1.1.13 ip source binding Syntax To add MAC-to-IP binding to an interface, run ip source binding xx-xx-xx-xx-xx-xx A.B.C.D interface name. ip source binding xx:xx:xx:xx:xx:xx A.B.C.D interface name vlan vlan-id no ip source binding xx:xx:xx:xx:xx:xx A.B.C.D vlan vlan-id Parameters Parameters Description xx:xx:xx:xx:xx:xx MAC地址 A.B.C.D IP address Name Means a name of an interface. vlan-id Stands for VLAN ID. Default Value None Usage Guidelines None 10 DHCP-relay Snooping Configuration Commands Example The following example shows how to bind MAC address 08:00:3e:00:00:01 to IP address 192.168.1.2 on interface GigaEthernet0/1. Switch_config#ip source binding 08:00:3e:00:00:01 192.168.1.2 interface GigaEthernet0/1 Switch_config# 1.1.14 arp inspection trust Syntax arp inspection trust no arp inspection trust Parameters None Default Value The default interface is a distrusted one. Usage Guidelines The ARP monitoring is not conducted to the ARP-trusted interface. The “no” form of this command is used to configure the default value of this interface. Example The following example shows how to set interface GigaEthernet 0/1 to an ARP-trusted interface. Switch_config_g0/1#arp inspection trust 1.1.15 dhcp snooping trust Syntax dhcp snooping trust no dhcp snooping trust Parameters None 11 DHCP-relay Snooping Configuration Commands Default Value The default interface is a distrusted one. Usage Guidelines DHCP snooping is not conducted to the DHCP-trusted interface. The “no” form of this command is used to resume the default value of this interface. Example The following example shows how to set interface GigaEthernet 0/1 to an DHCP-trusted interface. Switch_config_g0/1#dhcp snooping trust 1.1.16 dhcp snooping deny Syntax dhcp snooping deny no dhcp snooping deny Parameters None Default Value Snooping monitoring is allowed on the default interface. Usage Guidelines After this command is configured, DHCP snooping trust, IP-sourcetrust and ARP inspection trust are automatically enabled. The “no” form of this command is used to configure the default value of this interface. Example The following example shows how to disable DHCP snooping on interface GigaEthernet0/1. Switch_config_g0/1#dhcp snooping deny 12 DHCP-relay Snooping Configuration Commands 1.1.17 dhcp snooping information circuit-id Syntax dhcp snooping information circuit-id {string STRING | hex xx-xx-xx-xx-xx-xx} Parameters Parameters Description string STRING Stands for the character string carried by the sub-option of option82 circuit-id. hex xx-xx-xx-xx-xx-xx Stands for the hexadecimal character string carried by the sub-option of option82 circuit-id. Default Value None Usage Guidelines This command can be set on each port that connects the client. This command is used to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP server and monitored by DHCP snooping. (the switch of manually set optio82 need be opened. See the command, ip dhcp-relay snooping information option format manual) Example The following example shows how to set option82 to group1 manually on interface g0/3, which belongs to interface g0/3. Switch_config#ip dhcp-relay snooping Switch_config#ip dhcp-relay snooping vlan 1 Switch_config#ip dhcp-relay snooping information option format manual Switch_config#interface g0/3 Switch_config_g0/3#dhcp snooping information circuit-id string group1 1.1.18 dhcp snooping information remote-id string Syntax dhcp snooping information remote-id {string STRING | hex xx-xx-xx-xx-xx-xx} 13 DHCP-relay Snooping Configuration Commands Parameters Parameters Description string STRING Stands for the character string carried by option82 remote-id. hex xx-xx-xx-xx-xx-xx Stands for the hexadecimal character string carried by the sub-option of option82 remote-id. Default Value None Usage Guidelines This command can be set on each port that connects the client. This command is used to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP server and monitored by DHCP snooping. (the switch of manually set optio82 need be opened. See the command, ip dhcp-relay snooping information option format manual) Example The following example shows how to set option82 to group1 manually on interface g0/3, which belongs to interface g0/3. Switch_config# ip dhcp-relay snooping Switch_config# ip dhcp-relay snooping vlan 1 Switch_config#ip dhcp-relay snooping information option format manual Switch_config#interface g0/3 Switch_config_g0/3# dhcp snooping information remote-id string group1 1.1.19 dhcp snooping information vendor-specific Syntax dhcp snooping information vendor-specific { string STRING | hex xx-xx-xx-xx-xx-xx } Parameters Parameters Description string STRING Stands for the character string carried by option82 verdor-specific. hex xx-xx-xx-xx-xx-xx Stands for the hexadecimal character string carried by the 14 DHCP-relay Snooping Configuration Commands sub-option of option82 verdor-specific. Default Value None Usage Guidelines This command can be set on each port that connects the client. This command is used to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP server and monitored by DHCP snooping. (the switch of manually set optio82 need be opened. See the command, ip dhcp-relay snooping information option format manual) Example The following example shows how to use the hexadecimal 00-00-00-09-0d-01-0b-78-69-61-6f-6d-69-6e-37-31-31-34 to set option82 option vendor-specific (suboption 9) Switch_config# ip dhcp-relay snooping Switch_config# ip dhcp-relay snooping vlan 1 Switch_config#ip dhcp-relay snooping information option format manual Switch_config#interface g0/3 Switch_config_g0/3# dhcp snooping information vendor-specific hex 00-00-00-09-0d-01-0b-78-69-61-6f-6d-69-6e-37-31-31-34 1.1.20 dhcp snooping information append Syntax dhcp snooping information append dhcp snooping information append first-subop9-param { hex xx-xx-xx-xx-xx-xx | hostname | vlanip } dhcp snooping information append second-subop9-param { hex xx-xx-xx-xx-xx-xx | hostname | vlanip } no dhcp snooping information append no dhcp snooping information append first-subop9-param no dhcp snooping information append second-subop9-param 15 DHCP-relay Snooping Configuration Commands Parameters Parameters Description first-subop9-param Stands for the Hex system of the first parameter carried by hex [xx-xx-xx-xx-xx-xx] option82 vendor-specific (suboption9). second-subop9-param Stands for the Hex system of the second parameter carried by hex [xx-xx-xx-xx-xx-xx] option82 vendor-specific (suboption9). hostname Option82 vendor-specific（suboption9）Stands for the parameter of the suboption is the host name vlanip Option82 vendor-specific（suboption9）Stands for the parameter of the suboption is IP of interface vlan Default Value None Usage Guidelines This command can be set on each port that connects the client. This command is used to configure option82 of the DHCP packet, which is sent by DHCP client to DHCP server and monitored by DHCP snooping. This command without parameters acts as a switch command. When append is enabled, the information of this command will be added to suboption9 of option82. The added information is first-subop9-param and second-subop9-param. Example The following example shows how to enrich dhcp packets with option82 on interface g0/3 and set suboption 9 added parameter 1 with the hexadecimal 61-62-63-61-62-63. Switch_config_g0/3# dhcp snooping information append Switch_config_g0/3#dhcp snooping information append first-subop9-param hex 61-62-63-61-62-63 Here 61-62-63-61-62-63 is the Hex system of the to-be-added parameter. 1.1.21 dhcp snooping information drop Syntax dhcp snooping information drop no dhcp snooping information drop Parameters None 16 DHCP-relay Snooping Configuration Commands Default Value None Usage Guidelines This command can be set on each port that connects the client. After this command is set, the request packets that contain option82 will be dropped on the stipulated port. Example The following example shows how to drop dhcp packets with option82 on g0/3. Switch_config_g0/3# dhcp snooping information drop 1.1.22 ip-source trust Syntax ip-source trust no ip-source trust Parameters None Default Value The default interface is a distrusted one. Usage Guidelines Source IP address snooping is not conducted to the source-IP-trusted interface. The “no” form of this command is used to resume the default value of this interface. Example The following example shows how to set interface GigaEthernet0/1 to a source-ip-trusted interface. Switch_config_g0/1#ip-source trust 17 DHCP-relay Snooping Configuration Commands 1.1.23 show ip dhcp-relay snooping Syntax show ip dhcp-relay snooping Parameters None Default Value None Usage Guidelines This command is used to display the information about DHCP-snooping configuration. Example The following example shows how to display the information about DHCP-relay snooping. Switch_config#show ip dhcp-relay snooping 1.1.24 show ip dhcp-relay snooping binding Syntax show ip dhcp-relay snooping binding [all] Parameters None Default Value None Usage Guidelines This command is used to display the binding information about DHCP-relay snooping. 18 DHCP-relay Snooping Configuration Commands If the all parameter is in the command sentence, all binding information about DHCP-relay snooping will be displayed. Example The following example shows how to display the information about DHCP-relay snooping binding. Switch_config#show ip dhcp-relay snooping binding 1.1.25 debug ip dhcp-relay snooping Syntax debug ip dhcp-relay snooping no debug ip dhcp-relay snooping Parameters None Default Value None Usage Guidelines This command is used to enable or disable the debugging switch of DHCP-relay snooping. Example The following example shows how to enable the debugging switch of DHCP-relay snooping. Switch#debug ip dhcp-relay snooping Switch# 1.1.26 debug ip dhcp-relay event Syntax debug ip dhcp-relay event no debug ip dhcp-relay event 19 DHCP-relay Snooping Configuration Commands Parameters None Default Value None Usage Guidelines This command is used to enable or disable the event debugging switch of DHCP-relay. Example The following example shows how to enable the debugging switch of DHCP-relay event. Switch#debug ip dhcp-relay event Switch# 1.1.27 debug ip dhcp-relay binding Syntax debug ip dhcp-relay binding no debug ip dhcp-relay binding Parameters None Default Value None Usage Guidelines This command is used to enable or disable the debugging switch of DHCP-relay snooping binding. Example The following example shows how to enable the debugging switch of DHCP-relay snooping binding. Switch#debug ip dhcp-relay binding 20 DHCP-relay Snooping Configuration Commands Switch# 21