Alcatel 9000 Guía de usuario descargar pdf (Pagina 355)

100

101

Configuring DHCP Relay Configuring DHCP Security Features

OmniSwitch 6800/6850/9000 Network Configuration Guide June 2006 page 18-19

Configuring the Port Trust Mode

The DHCP Snooping trust mode for a port determines whether or not the port accepts all DHCP traffic,

client-only DHCP traffic, or blocks all DHCP traffic. The following trust modes for a port are config-

urable using the ip helper dhcp-snooping port command:

• client-only—The default mode applied to ports when DHCP Snooping is enabled. This mode restricts

DHCP traffic on the port to only DHCP client-related traffic. When this mode is active for the port, the

port is considered an untrusted interface.

• trust—This mode does not restrict DHCP traffic on the port. When this mode is active on a port, the

port is considered a trusted interface. In this mode the port behaves as if DHCP Snooping is not

enabled.

• block—This mode blocks all DHCP traffic on the port. When this mode is active for the port, the port

is considered an untrusted interface.

To configure the trust mode for one or more ports, use the ip helper dhcp-snooping port command. For

example, the following command changes the trust mode for port 1/12 to blocked:

-> ip helper dhcp-snooping port 1/12 block

It is also possible to specify a range of ports. For example, the following command changes the trust mode

for ports 2/1 through 2/10 to trusted:

-> ip helper dhcp-snooping port 2/1-10 trust

Note that it is necessary to configure ports connected to DHCP servers within the network and/or firewall

as trusted ports so that necessary DHCP traffic to/from the server is not blocked. Configuring the port

mode as trusted also identifies the device connected to that port as a trusted device within the network.

Configuring the Port Traffic Suppression Status

Traffic suppression prevents the flooding of DHCP packets on the default VLAN for a DHCP Snooping

port. By default traffic suppression is enabled for a port. Use the ip helper dhcp-snooping port traffic-

suppression command to enable or disable this function for a specific port or range of ports. For example:

-> ip helper dhcp-snooping port 1/10 traffic-suppression enable

-> ip helper dhcp-snooping port 2/1-5 traffic-suppression disable

Note that enabling traffic suppression on a port will prevent DHCP traffic between a DHCP server and

client that belong to the same VLAN domain.

Configuring Port IP Source Filtering

IP source filtering applies to DHCP Snooping ports and restricts port traffic to only packets that contain

the client source MAC address and IP address. The DHCP Snooping binding table is used to verify the

client information for the port that is enabled for IP source filtering.

By default IP source filtering is disabled for a DHCP Snooping port. Use the ip helper dhcp-snooping

port ip-source-filtering command to enable or disable this function for a specific port or range of ports.

For example:

-> ip helper dhcp-snooping port 1/10 ip-source-filtering enable

-> ip helper dhcp-snooping port 2/1-5 ip-source-filtering enable

1 2 ... 350 351 352 353 354 355 356 357 358 359 360 ... 701 702

Comentarios a estos manuales

Sin comentarios

Alcatel 9000 Guía de usuario Pagina 355

Comentarios a estos manuales

Relacionado con productos y manuales para Software Alcatel 9000