Cisco DHCP Snooping: Trusted and Untrusted Ports

DHCP snooping acts like a firewall between untrusted end hosts and trusted DHCP servers. The switch validates every DHCP message received on untrusted ports, drops offers and acks that do not come from a server, and builds a binding database of IP-to-MAC-to-port entries that other security features such as Dynamic ARP Inspection (DAI) and IP Source Guard rely on. A rogue "DHCP" laptop plugged into an access port becomes harmless once snooping is on. This guide covers the configuration on Catalyst IOS XE switches.

Trusted vs Untrusted

By default every interface is untrusted. Ports connected to DHCP servers, or to other switches/routers that legitimately forward DHCP (option-82), must be configured as trusted; ports connected to clients stay untrusted. DHCP replies received on an untrusted port are dropped, and DHCP requests from untrusted ports are only forwarded toward trusted ports.

Configuration

Switch# configure terminal
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10,20,30
Switch(config)# ip dhcp snooping information option
Switch(config)# interface gigabitethernet1/0/24
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# exit
Switch(config)# interface gigabitethernet1/0/1
Switch(config-if)# no ip dhcp snooping trust
Switch(config-if)# ip dhcp snooping limit rate 15
Switch(config-if)# end

Steps: enable snooping globally, apply it to the client VLANs, enable option-82 insertion where the switch relays toward the server, mark the uplink/server port trusted, and (optionally) rate-limit DHCP packets on untrusted ports to blunt DHCP starvation floods.

Verification

show ip dhcp snooping
show ip dhcp snooping binding
show ip dhcp snooping statistics

The binding table lists every learned client (MAC, IP, VLAN, interface, lease expiry) and is what DAI and IP Source Guard consult. show ip dhcp snooping statistics counts packets dropped on untrusted ports — a rising drop counter next to a port usually means a rogue offer or an option-82 mismatch.

Common Pitfalls

• All clients stop getting addresses: the server-facing port was left untrusted, so replies are dropped. Mark server/uplink ports trusted.
• Aggregation switch with edge switches: an access switch inserts option-82; if the aggregation switch receives option-82 on an untrusted port it drops the packet. Either make the inter-switch port trusted on the aggregation switch, or enable ip dhcp snooping information option allow-untrusted.
• Static servers: hosts with static IPs never appear in the binding table; add manual bindings or rely on DAI's ARP ACLs instead.
• Trusted ports are not learned: snooping bindings are only built from untrusted ports by design.

DHCP snooping is the foundation that makes port security and dynamic ARP inspection effective; for the broader loop and broadcast protection toolkit see broadcast storm troubleshooting.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9500/software/release/17-17/configuration_guide/ip/b_1717_ip_9500_cg/configuring_dhcp.html