IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

PDF

IP Addresses and Services Configuration Guide for Cisco 8000 Series Routers, IOS XR Releases

DHCP snooping

Updated: August 12, 2026

Want to summarize with AI?

This topic describes DHCP snooping on the Cisco 8000 Series Router, which enhances network security by preventing unauthorized DHCP servers from distributing IP addresses.

DHCP snooping is a Layer 2 security feature that

maintains a list of approved servers so that only trusted DHCP messages are processed,
safeguards against IP address spoofing and man-in-the-middle attacks by inspecting and filtering DHCP packets, and
integrates with existing network configurations to provide protection while maintaining efficient IP address management.

Table 1. Feature History Table
Feature Name	Release Information	Feature Description
DHCP Snooping	Release 25.4.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100])(select variants only) This feature is supported on: 8011-32Y8L2H2FH 8011-12G12X4Y-A/D
DHCP Snooping	Release 25.1.1	Introduced in this release on: Fixed Systems (8010 [ASIC: A100]) This feature is supported on Cisco 8011-4G24Y4H-I routers.
DHCP Snooping	Release 24.4.1	Introduced in this release on: Fixed Systems (8200 [ASIC: P100], 8700 [ASIC: P100, K100])(select variants only); Modular Systems (8800 [LC ASIC: P100])(select variants only) DHCP snooping enhances network security and prevents unauthorized or malicious DHCP servers from distributing IP addresses. By maintaining a list of approved servers, DHCP snooping ensures that only trusted DHCP messages are processed. This feature safeguards against IP address spoofing and man-in-the-middle attacks by inspecting and filtering DHCP packets. This reliable security measure integrates seamlessly with existing network configurations, offering robust protection for your network infrastructure while maintaining efficient IP address management. *This feature is supported on: 8212-48FH-M 8711-32FH-M Cisco 8712-MOD-M routers 88-LC1-36EH 88-LC1-12TH24FH-E 88-LC1-52Y8H-EM

DHCP snooping features are focused on the edge of the aggregation network. Security features are applied at the first point of entry for subscribers. The relay agent information option is used to identify the subscriber's line, which is either the DSL line to the subscriber's home or the first port in the aggregation network.

The central concept for DHCP snooping is that of trusted and untrusted links. A trusted link provides secure access for traffic on that link. On an untrusted link, subscriber identity and subscriber traffic cannot be determined. DHCP snooping runs on untrusted links to provide subscriber identity. The following figure shows an aggregation network. The link from the DSLAM to the aggregation network is untrusted and is the point of presence for DHCP snooping. The links that connect the switches in the aggregation network and the link from the aggregation network to the intelligent edge are considered trusted.

Note

Enabling both DHCP relay on a BVI and DHCP snooping in a bridge domain that has a BVI can result in duplicate DHCP messages from the DHCP client to the DHCP server.

Figure 1. DHCP snooping in an aggregation network

Prerequisites for DHCP snooping

These prerequisites apply before you configure DHCP snooping:

You must be in a user group that is associated with a task group that includes the proper task IDs. The command reference guides include the task IDs required for each command. If you suspect that user group assignment is preventing you from using a command, contact your AAA administrator for assistance.
A Cisco 8000 Series Router running Cisco IOS XR software.
A configured and running DHCP client and DHCP server.

Configuration guidelines and restrictions for DHCP snooping

These configuration guidelines and restrictions apply to DHCP snooping:

Supported on AC bridge-ports, Access Pseudowire (PW), and core PW.
Not supported on bridge-port types, such as Ethernet VPN Instance, which is used in Ethernet VPN (EVPN) configurations.

Trusted and untrusted ports

On trusted ports, DHCP BOOTREQUEST packets are forwarded by DHCP snooping. The client's address lease is not tracked and the client is not bound to the port. DHCP BOOTREPLY packets are forwarded.

When the first DHCP BOOTREQUEST packet from a client is received on an untrusted port, DHCP snooping binds the client to the bridge port and tracks the client's address lease. When that address lease expires, the client is deleted from the database and is unbound from the bridge port. Packets from this client received on this bridge port are processed and forwarded as long as the binding exists. Packets that are received on another bridge port from this client are dropped while the binding exists. DHCP snooping only forwards DHCP BOOTREPLY packets for this client on the bridge port that the client is bound to. DHCP BOOTREPLY packets that are received on untrusted ports are not forwarded.

DHCP snooping in a bridge domain

To enable DHCP snooping in a bridge domain, there must be at least two profiles, a trusted profile and an untrusted profile. The untrusted profile is assigned to the client-facing ports, and the trusted profile is assigned to the server-facing ports. In most cases, there are many client-facing ports and few server-facing ports. The simplest example is two ports, a client-facing port and a server-facing port, with an untrusted profile explicitly assigned to the client-facing port and a trusted profile assigned to the server-facing port.

Assign profiles to a bridge domain

Because there are normally many client-facing ports and a small number of server-facing ports, the operator assigns the untrusted profile to the bridge domain. This configuration effectively assigns an untrusted profile to every port in the bridge domain. This action saves the operator from explicitly assigning the untrusted profile to all of the client-facing ports. Because there also must be server-facing ports that have trusted DHCP snooping profiles, in order for DHCP snooping to function properly, this untrusted DHCP snooping profile assignment is overridden on server-facing ports by specifically configuring trusted DHCP snooping profiles on the server-facing ports. For ports in the bridge domain that do not require DHCP snooping, all should have the none profile assigned to them to disable DHCP snooping on those ports.

Create DHCP snooping profiles

These steps create an untrusted DHCP snooping profile for the client port and a trusted DHCP snooping profile for the server port, and then enter the l2vpn configuration mode in preparation for attaching the profiles to bridge ports.

Procedure

Enter the DHCP IPv4 profile configuration submode.
Example:
```
Router(config)# dhcp ipv4
```
Configure an untrusted DHCP snooping profile for the client port using the profile untrusted-profile-name snoop command.
Example:
```
Router(config-dhcpv4)# profile untrustedClientProfile snoop
```
Exit the DHCP IPv4 profile configuration mode.
Example:
```
Router(config-dhcpv4)# exit
```
Enable DHCP for IPv4 and enter the DHCP IPv4 profile configuration mode.
Example:
```
Router(config)# dhcp ipv4
```
Configure a trusted DHCP snooping profile for the server port using the profile profile-name snoop command.
Example:
```
Router(config-dhcpv4)# profile trustedServerProfile snoop
```
Configure the DHCP snoop profile as trusted using the trusted command.
Example:
```
Router(config-dhcpv4)# trusted
```
Exit the DHCP IPv4 profile configuration mode.
Example:
```
Router(config-dhcpv4)# exit
```
Enter the l2vpn configuration mode.
Example:
```
Router(config)# l2vpn
```

What to do next

Attach snooping profiles to bridge ports.

Attach snooping profiles to bridge ports

These steps create the bridge group and bridge domain, add the client-facing and server-facing interfaces as bridge ports, and attach the untrusted DHCP snooping profile to the client bridge port and the trusted DHCP snooping profile to the server bridge port.

Procedure

Create a bridge group to contain bridge domains and enter the l2vpn bridge group configuration submode.
Example:
```
Router(config-l2vpn)# bridge group ccc
```

Establish a bridge domain.

Example:

Router(config-l2vpn-bg)# bridge-domain ddd

Identify the client-facing interface.

Example:

Router(config-l2vpn-bg-bd)# interface gigabitethernet 0/1/0/0

Attach an untrusted DHCP snoop profile to the bridge port.

Example:

Router(config-l2vpn-bg-bd-ac)# dhcp ipv4 snoop profile untrustedClientProfile

Identify the server-facing interface.

Example:

Router(config-l2vpn-bg-bd-ac)# interface gigabitethernet 0/1/0/1

Attach a trusted DHCP snoop profile to the bridge port.

Example:

Router(config-l2vpn-bg-bd-ac)# dhcp ipv4 snoop profile trustedServerProfile

Exit the l2vpn bridge group bridge-domain interface configuration submode.
Example:
```
Router(config-l2vpn-bg-bd-ac)# exit
```
Exit the l2vpn bridge group bridge-domain configuration submode.
Example:
```
Router(config-l2vpn-bg-bd)# exit
```
Commit the configuration changes on the router.
Example:
```
Router(config)# commit
```

Disable DHCP snooping on a specific bridge port

The following configuration enables DHCP to snoop packets on all bridge ports in the bridge domain ISP1 except for bridge ports GigabitEthernet 0/1/0/1 and GigabitEthernet 0/1/0/2. DHCP snooping is disabled on bridge port GigabitEthernet 0/1/0/1. Bridge port GigabitEthernet 0/1/0/2 is the trusted port that connects to the server. In this example, no additional features are enabled, so only DHCP snooping is running.

Procedure

Enter the l2vpn configuration submode.
Example:
```
Router(config)# l2vpn
```
Create a bridge group to contain bridge domains and enter the l2vpn bridge group configuration submode.
Example:
```
Router(config-l2vpn)# bridge group GRP1
```
Establish a bridge domain and enter the l2vpn bridge group bridge-domain configuration submode.
Example:
```
Router(config-l2vpn-bg)# bridge-domain ISP1
```

Attach the untrusted DHCP snooping profile to the bridge domain.

Example:

Router(config-l2vpn-bg-bd)# dhcp ipv4 snoop profile untrustedClientProfile

Identify the bridge port where DHCP snooping is to be disabled.
Example:
```
Router(config-l2vpn-bg-bd)# interface gigabitethernet 0/1/0/1
```

Disable DHCP snooping on the port.

Example:

Router(config-l2vpn-bg-bd-if)# dhcp ipv4 none

Identify the trusted server bridge port.

Example:

Router(config-l2vpn-bg-bd)# interface gigabitethernet 0/1/0/2

Attach the trusted DHCP snooping profile to that port.

Example:

Router(config-l2vpn-bg-bd)# dhcp ipv4 snoop profile trustedServerProfile

Exit the l2vpn bridge-domain bridge group interface configuration submode.
Example:
```
Router(config-l2vpn-bd-bg)# exit
```
Exit the l2vpn bridge-domain submode.
Example:
```
Router(config-l2vpn-bg)# exit
```
Commit the configuration changes on the router.
Example:
```
Router(config)# commit
```

Relay information options

You can configure a DHCP snooping profile to insert the relay information option (option 82) into DHCP client packets only when it is assigned to a client port. The relay information option allow-untrusted command addresses what to do with DHCP client packets when there is a null giaddr and a relay-information option is already in the client packet when it is received. This is a different condition than a DHCP snooping trusted or untrusted port. The relay information option allow-untrusted command determines how the DHCP snooping application handles untrusted relay information options.

Use the relay information option

Procedure

Enter the DHCP IPv4 profile configuration submode.
Example:
```
Router# configure
Router(config)# dhcp ipv4
```
Configure an untrusted DHCP snooping profile for the client port.
Example:
```
Router(config-dhcpv4)# profile untrustedClientProfile snoop
```
Enable the system to insert the DHCP relay information option field in forwarded BOOTREQUEST messages to a DHCP server.
Example:
```
Router(config-dhcpv4-snoop-profile)# relay information option
```
Commit the configuration changes on the router.
Example:
```
Router(config-dhcpv4-snoop-profile)# commit
```

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.