ES4626-SFP Management Guide.pdf

mutually exclusive to“ ip dhcp snooping binding dot1x“ command.
Only after the DHCP SNOOPING binding function is enabled, the binding ARP
function can be set.
Example:Enable the binding USER funciton on port ethernet1/1
switch(Config)#interface ethernet 1/1
switch(Config- Ethernet 1/1)# ip dhcp snooping binding user-control
Relative Command:ip dhcp snooping binding enable
ip dhcp snooping binding dot1x
13.2.2.12 ip dhcp snooping trust
Command:ip dhcp snooping trust
no ip dhcp snooping trust
Function: Set or delete the DHCP Snooping trust attributes of a port.
Parameters:None
Command Mode:Port mode
Default Settings:By default, all ports are non-trusted ports
Usage Guide:
Only when DHCP Snooping is globally enabled, can this command be set.
When a port turns into a trusted port from a non-trusted port, the original defense action
of the port will be automatically deleted; all the security history records will be cleared
(except the information in system log).
Example:Set port ethernet1/1 as a DHCP Snooping trusted port
switch(Config)#interface ethernet 1/1
switch(Config- Ethernet 1/1)#ip dhcp snooping trust
13.2.2.13 ip dhcp snooping action
Command:ip dhcp snooping action {shutdown|blackhole} [recovery ]
no ip dhcp snooping action
Function: Set or delete the automatic defense action of a port.
Parameters:
shutdown: When the port detects a fake DHCP Server, it will be shutdown
blackhole:When the port detects a fake DHCP Server, the vid and source MAC of the
fake packet will be used to block the traffic from this MAC.
Recovery : Users can set to recover after the automatic defense action being
executed.(no shut ports or delete correponding blackhole)
Second:Users can set how long after the execution of defense action to recover. The unit
is second, and valid range is 10-3600.
Command Mode:Port mode
375