ArubaOS-CX DHCP Snooping: Trusted Ports and VLAN Setup

A rogue DHCP server plugged into an access port is one of the fastest ways to break a network - clients receive a wrong gateway or DNS and silently lose connectivity. ArubaOS-CX switches block this attack with DHCP snooping, which filters DHCP messages by trusting only ports that face the real DHCP server. This guide explains how to enable DHCP snooping globally and per VLAN on AOS-CX, mark uplink ports as trusted, enable MAC verification and Option 82, and verify bindings with show commands.

How DHCP Snooping Works on AOS-CX

DHCP snooping distinguishes trusted ports (connected to a DHCP server or another switch) from untrusted ports (facing end users). DHCP server messages such as OFFER and ACK received on untrusted ports are dropped, so a rogue server behind a user port can never answer client requests. Client messages are only forwarded out of trusted ports. By default every port is untrusted - you must explicitly trust the uplink.

Enabling DHCP Snooping Globally and Per VLAN

Enable the feature and then apply it to the client VLANs:

switch(config)# dhcp-snooping
switch(config)# dhcp-snooping vlan 10
switch(config)# dhcp-snooping vlan 20

On AOS-CX releases before 10.14 the command was dhcpv4-snooping; the dhcp-snooping form is the current keyword.

Marking the Uplink Port as Trusted

The port facing the real DHCP server (or the upstream switch that relays to it) must be trusted, otherwise server replies are dropped:

switch(config)# interface 1/1/48
switch(config-if)# dhcp-snooping trust
switch(config-if)# exit

MAC Verification and Option 82

MAC verification (enabled by default) checks that the DHCP client hardware address field matches the source MAC of the packet on untrusted ports; mismatches are dropped:

switch(config)# dhcp-snooping verify mac

Option 82 insertion adds relay information (the switch port and VLAN) to client requests forwarded toward the server, which helps the DHCP server or downstream logging identify exactly where each client is attached. If your DHCP server does not understand Option 82, leave it disabled.

Verifying DHCP Snooping

Check the snooping state and the learned IP-MAC-port bindings:

switch# show dhcp-snooping
switch# show dhcp-snooping binding
switch# show dhcp-snooping statistics

The binding table is also used by other security features: bindings feed IP source guard if you enable it, so a client that was never served by the trusted DHCP server cannot spoof traffic on the VLAN.

Related Guides on This Site

DHCP snooping belongs on access ports, which we cover in ArubaOS-CX access vs trunk ports and native VLAN and untagged traffic on AOS-CX. Also see Cisco DHCP snooping trusted and untrusted ports for the IOS equivalent.

原文链接：https://arubanetworking.hpe.com/techdocs/AOS-CX/AOSCX-CLI-Bank/cli_6200/Content/Chp_DHCP_snoop/Dv4Snoop_cmds/dhc-sno-ver-mac-840-10-cpe.htm