DHCP Option 82 and IP Source Guard on Access Ports

An access switch that simply forwards DHCP frames is an open door: any device can run a DHCP server, hand out a lease with itself as the gateway, and silently become a man in the middle for everything on that VLAN. The countermeasure set is well established — DHCP snooping builds a trusted binding table, option 82 records which port a request came from, and IP source guard enforces the result so hosts cannot use addresses they were not given. Implemented in the wrong order or with the wrong port trust, the same features produce a site-wide outage. This article covers the correct sequence.

DHCP snooping: building a trusted table

Snooping classifies ports as trusted or untrusted. Server replies arriving on untrusted ports are dropped; every DHCP exchange on trusted ports is recorded in a binding table that maps MAC, IP, lease time, VLAN and port.

ip dhcp snooping
ip dhcp snooping vlan 10,20,30
no ip dhcp snooping information option

interface GigabitEthernet1/0/1
 description UPLINK-TO-DHCP-SERVER
 ip dhcp snooping trust

interface range GigabitEthernet1/0/2 - 24
 description ACCESS-PORTS
 ! untrusted by default -- change nothing

The rule that produces the most outages: the uplink toward the legitimate DHCP server (or the router acting as relay) must be trusted. If it is not, every client on the floor fails to obtain a lease and the symptom points at the server team rather than the switch.

Option 82: where the request came from

Option 82 (the relay agent information option) carries the circuit ID and remote ID with the request, letting the DHCP server make decisions based on the physical port. That enables per-port address pools, port-based address allocation, and a much better audit trail. On many access platforms the switch inserts option 82 by default once snooping is enabled — and that is where the second classic failure comes from: a server that does not expect the option may ignore or reject the request.

! the switch inserts option 82 by default in many platforms
no ip dhcp snooping information option      ! disable insertion entirely

! or, to keep insertion but avoid rejections on trunk uplinks
interface GigabitEthernet1/0/1
 no ip dhcp snooping information option allow-untrusted

Decide deliberately: keep insertion if your DHCP infrastructure uses option 82 for policy, and verify with the server team that they parse it. If nobody uses it, disabling insertion removes a whole class of interoperability problems.

IP source guard: enforcing the table

Source guard uses the snooping binding table to filter traffic from each access port, allowing only the addresses the port was legitimately assigned. Combined with port security it can also validate the MAC address.

interface range GigabitEthernet1/0/2 - 24
 ip verify source
 ! or, to validate MAC address as well
 ip verify source port-security

show ip dhcp snooping
show ip dhcp snooping binding
show ip verify source

Two caveats matter. First, statically addressed hosts are not in the binding table, so source guard drops their traffic — either pre-provision static bindings (ip source binding <mac> vlan <id> <ip> interface <intf>) or exclude those ports. Second, with DHCP snooping enabled the switch expects option 82 in OFFER and ACK messages on some platforms; if you enable source guard with MAC checking and the server strips the option, leases are silently discarded. Test with a single port before rolling out.

The rollout order that avoids an outage

1. Enable snooping on one test VLAN, with the uplink trusted, and confirm clients still obtain leases.
2. Verify the binding table populates with real entries (show ip dhcp snooping binding).
3. Add the remaining access VLANs, in batches, checking the lease success rate after each.
4. Enable source guard on a small range of access ports with a pilot user group.
5. Extend source guard floor by floor, handling static-address devices explicitly.
6. Document the trusted ports. Every future uplink change must respect that list.

Related controls on the same port

Layer 2 enforcement is one part of a larger access-layer design. Port-based authentication with dynamic VLAN assignment, compared in RADIUS versus TACACS+ for Cisco AAA, makes the network identify who connects; the wireless equivalent is covered in WPA3 Enterprise and 802.1X RADIUS configuration. Where the environment has IPv6 enabled, the same first-hop logic applies to autoconfiguration and must be configured separately — see IPv6 first hop security with RA Guard and DHCPv6 Guard. Run all of them together, and the access port becomes a place where an unknown device cannot simply plug in and take over the subnet.

原文链接：https://www.cisco.com/c/en/us/td/docs/switches/lan/cisco_ie3010/software/release/15-0_2_se/configuration/guide/scgie3010/swdhcp82.html