When you are configuring DHCP snooping, it is important that you understand the difference between enabling the DHCP snooping feature and globally enabling DHCP snooping.

You can configure whether DHCP snooping trusts traffic sources. An untrusted source may initiate traffic attacks or other hostile actions. To prevent such attacks, DHCP snooping filters messages from untrusted sources.

In an enterprise network, a trusted source is a device that is under your administrative control. These devices include the switches, routers, and servers in the network. Any device beyond the firewall or outside the network is an untrusted source. Generally, host ports are treated as untrusted sources.

In a service provider environment, any device that is not in the service provider network is an untrusted source (such as a customer switch). Host ports are untrusted sources.

In the Cisco NX-OS device, you indicate that a source is trusted by configuring the trust state of its connecting interface.

The default trust state of all interfaces is untrusted. You must configure DHCP server interfaces as trusted. You can also configure other interfaces as trusted if they connect to devices (such as switches or routers) inside your network. You usually do not configure host port interfaces as trusted.

Note	For DHCP snooping to function properly, all DHCP servers must be connected to the device through trusted interfaces.

Using information extracted from intercepted DHCP messages, DHCP snooping dynamically builds and maintains a database. The database contains an entry for each untrusted host with a leased IP address if the host is associated with a VLAN that has DHCP snooping enabled. The database does not contain entries for hosts connected through trusted interfaces.

Note	The DHCP snooping binding database is also referred to as the DHCP snooping binding table.

DHCP snooping updates the database when the device receives specific DHCP messages. For example, the feature adds an entry to the database when the device receives a DHCPACK message from the server. The feature removes the entry in the database when the IP address lease expires or the device receives a DHCPRELEASE message from the host.

Each entry in the DHCP snooping binding database includes the MAC address of the host, the leased IP address, the lease time, the binding type, and the VLAN number and interface information associated with the host.

Dynamic ARP inspection (DAI) and IP Source Guard also use information stored in the DHCP snooping binding database.

You can remove entries from the binding database by using the clear ip dhcp snooping binding command.

The device validates DHCP packets received on the untrusted interfaces of VLANs that have DHCP snooping enabled. The device forwards the DHCP packet unless any of the following conditions occur (in which case, the packet is dropped):

• The device receives a DHCP response packet (such as a DHCPACK, DHCPNAK, or DHCPOFFER packet) on an untrusted interface.

• The device receives a packet on an untrusted interface, and the source MAC address and the DHCP client hardware address do not match. This check is performed only if the DHCP snooping MAC address verification option is turned on.

• The device receives a DHCPRELEASE or DHCPDECLINE message from an untrusted host with an entry in the DHCP snooping binding table, and the interface information in the binding table does not match the interface on which the message was received.

• The device receives a DHCP packet that includes a relay agent IP address that is not 0.0.0.0.

In addition, you can enable strict validation of DHCP packets, which checks the options field of DHCP packets, including the “magic cookie” value in the first four bytes of the options field. By default, strict validation is disabled. When you enable it, by using the ip dhcp packet strict-validation command, if DHCP snooping processes a packet that has an invalid options field, it drops the packet.

In residential, metropolitan Ethernet-access environments, DHCP can centrally manage the IP address assignments for a large number of subscribers. When you enable Option 82, the device identifies a subscriber device that connects to the network (in addition to its MAC address). Multiple hosts on the subscriber LAN can connect to the same port on the access device and are uniquely identified.

This figure shows an example of a metropolitan Ethernet network in which a centralized DHCP server assigns IP addresses to subscribers connected to the device at the access layer. Because the DHCP clients and their associated DHCP server do not reside on the same IP network or subnet, a DHCP relay agent is configured with a helper address to enable broadcast forwarding and to transfer DHCP messages between the clients and the server.

Figure 1. DHCP Relay Agent in a Metropolitan Ethernet Network

When you enable Option 82 on the Cisco NX-OS device, the following sequence of events occurs:

1. The host (DHCP client) generates a DHCP request and broadcasts it on the network.

2. When the Cisco NX-OS device receives the DHCP request, it adds the Option 82 information in the packet. The Option 82 information contains the device MAC address (the remote ID suboption) and the port identifier, vlan-mod-port, from which the packet is received (the circuit ID suboption).

3. The device adds the IP address of the relay agent to the DHCP packet.

4. The device forwards the DHCP request that includes the Option 82 field to the DHCP server.

5. The DHCP server receives the packet. If the server is Option 82 capable, it can use the remote ID, the circuit ID, or both to assign IP addresses and implement policies, such as restricting the number of IP addresses that can be assigned to a single remote ID or circuit ID. The DHCP server echoes the Option 82 field in the DHCP reply.

6. The DHCP server unicasts the reply to the Cisco NX-OS device if the request was relayed to the server by the device. The Cisco NX-OS device verifies that it originally inserted the Option 82 data by inspecting the remote ID and possibly the circuit ID fields. The Cisco NX-OS device removes the Option 82 field and forwards the packet to the interface that connects to the DHCP client that sent the DHCP request.

If the previously described sequence of events occurs, the following values do not change:

• Circuit ID suboption fields

  
  

  • Suboption type

  • Length of the suboption type

  • Circuit ID type

  • Length of the circuit ID type

• Remote ID suboption fields

  
  

  • Suboption type

  • Length of the suboption type

  • Remote ID type

  • Length of the circuit ID type

This figure shows the packet formats for the remote ID suboption and the circuit ID suboption. The Cisco NX-OS device uses the packet formats when you globally enable DHCP snooping and when you enable Option 82 data insertion and removal. For the circuit ID suboption, the module field is the slot number of the module.

Figure 2. Suboption Packet Formats

You can configure the device to run a DHCP relay agent, which forwards DHCP packets between clients and servers. This feature is useful when clients and servers are not on the same physical subnet. Relay agent forwarding is distinct from the normal forwarding of an IP router, where IP datagrams are switched between networks somewhat transparently. By contrast, relay agents receive DHCP messages and then generate a new DHCP message to send out on another interface. The relay agent sets the gateway address (giaddr field of the DHCP packet) and, if configured, adds the relay agent information option (Option 82) in the packet and forwards it to the DHCP server. The reply from the server is forwarded back to the client after removing Option 82.

Note	When the device relays a DHCP request that already includes Option 82 information, the device forwards the request with the original Option 82 information without altering it.

The following information applies to DHCP snooping used in virtual device contexts (VDCs):

• DHCP snooping binding databases are unique per VDC. Bindings in one VDC do not affect DHCP snooping in other VDCs.

• The system does not limit the binding database size on a per-VDC basis.

1.    Enable the DHCP snooping feature.

2.    Enable DHCP snooping globally.

3.    Enable DHCP snooping on at least one VLAN.

4.    Ensure that the DHCP server is connected to the device using a trusted interface.

5.    (Optional) Enable the DHCP relay agent.

6.    (Optional) Configure an interface with the IP address of the DHCP server.

1.    config t

2.    [no] feature dhcp

3.    show running-config dhcp

4.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# feature dhcp

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

1.    config t

2.    [no] ip dhcp snooping

3.    show running-config dhcp

4.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# ip dhcp snooping

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

Before You Begin

By default, DHCP snooping is disabled on all VLANs.

Ensure that DHCP snooping is enabled.

Note	If a VACL is configured on a VLAN that you are configuring with DHCP snooping, ensure that the VACL permits DHCP traffic between DHCP servers and DHCP hosts.

1.    config t

2.    [no] ip dhcp snooping vlan vlan-list

3.    show running-config dhcp

4.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# ip dhcp snooping vlan 100,200,250-252

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

1.    config t

2.    [no] ip dhcp snooping verify mac-address

3.    show running-config dhcp

4.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# ip dhcp snooping verify mac-address

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

You can enable or disable the insertion and removal of Option 82 information for DHCP packets forwarded without the use of the DHCP relay agent.

Note	DHCP relay agent support for Option 82 is configured separately.

1.    config t

2.    [no] ip dhcp snooping information option

3.    show running-config dhcp

4.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# ip dhcp snooping information option

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

1.    config t

2.    Do one of the following options.

3.    [no] ip dhcp snooping trust

4.    show running-config dhcp

5.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# interface ethernet 2/1
switch(config-if)#

switch(config-if)# ip dhcp snooping trust

switch(config-if)# show running-config dhcp

switch(config-if)# copy running-config startup-config

1.    config t

2.    [no] ip dhcp relay

3.    show running-config dhcp

4.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# ip dhcp relay

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

1.    config t

2.    [no] ip dhcp relay information option

3.    [no] ip dhcp relay sub-option type cisco

4.    show running-config dhcp

5.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# ip dhcp relay information option

switch(config)# ip dhcp relay sub-option type cisco

switch(config)# show running-config dhcp

switch(config)# copy running-config startup-config

Before You Begin

By default, there is no DHCP server IP address configured on an interface.

Ensure that the DHCP server is correctly configured.

Determine the IP address for each DHCP server that you want to configure on the interface.

If the DHCP server is in a different VRF than the interface, ensure that you have enabled VRF support.

Note	If an ingress router ACL is configured on an interface that you are configuring with a DHCP server address, ensure that the router ACL permits DHCP traffic between DHCP servers and DHCP hosts.

Ensure that the DHCP snooping feature is enabled. You can use the show feature to verify that the DHCP snooping feature is enabled. The DHCP relay agent does not require that you globally enable DHCP snooping.

1.    config t

2.    Do one of the following options.

3.    ip dhcp relay address IP-address

4.    show running-config dhcp

5.    (Optional) copy running-config startup-config

switch# config t
switch(config)#

switch(config)# interface ethernet 2/3
switch(config-if)#

switch(config-if)# ip dhcp relay address 10.132.7.120

switch(config-if)# show running-config dhcp

switch(config-if)# copy running-config startup-config