Catalyst 3750-E and 3560-E Switch Cisco IOS ... - DNIP . NET

Chapter 2Catalyst 3750-E and 3560-E Switch Cisco IOS Commandsip dhcp snooping information option allow-untrustedip dhcp snooping information option allow-untrustedUse the ip dhcp snooping information option allow-untrusted global configuration command on anaggregation switch to configure it to accept DHCP packets with option-82 information that are receivedon untrusted ports that might be connected to an edge switch. Use the no form of this command to returnto the default setting.ip dhcp snooping information option allow-untrustedno ip dhcp snooping information option allow-untrustedSyntax DescriptionThis command has no arguments or keywords.DefaultsThe switch drops DHCP packets with option-82 information that are received on untrusted ports thatmight be connected to an edge switch.Command ModesGlobal configurationCommand HistoryRelease12.2(35)SE2ModificationThis command was introduced.Usage GuidelinesYou might want an edge switch to which a host is connected to insert DHCP option-82 information atthe edge of your network. You might also want to enable DHCP security features, such as DHCPsnooping, IP source guard, or dynamic Address Resolution Protocol (ARP) inspection, on anaggregation switch. However, if DHCP snooping is enabled on the aggregation switch, the switch dropspackets with option-82 information that are received on an untrusted port and does not learn DHCPsnooping bindings for connected devices on a trusted interface.If the edge switch to which a host is connected inserts option-82 information and you want to use DHCPsnooping on an aggregation switch, enter the ip dhcp snooping information option allow-untrustedcommand on the aggregation switch. The aggregation switch can learn the bindings for a host eventhough the aggregation switch receives DHCP snooping packets on an untrusted port. You can alsoenable DHCP security features on the aggregation switch. The port on the edge switch to which theaggregation switch is connected must be configured as a trusted port.NoteDo not enter the ip dhcp snooping information option allow-untrusted command on an aggregationswitch to which an untrusted device is connected. If you enter this command, an untrusted device mightspoof the option-82 information.OL-9776-08Catalyst 3750-E and 3560-E Switch Command Reference2-239