Users Guide

View DHCP Information
Use the show ip dhcp binding command to view the DHCP binding table entries.
OS10# show ip dhcp binding
IP Address Hardware address Lease expiration Hostname
+--------------------------------------------------------------------------
11.1.1.254 00:00:12:12:12:12 Jan 27 2016 06:23:45
Total Number of Entries in the Table = 1
DHCP relay agent
A DHCP relay agent relays DHCP messages to and from a remote DHCP server, even if the client and server are on different IP
networks. You can configure the IP address of the remote DHCP server.
You can configure a device either as a DHCP server or a DHCP relay agent — but not both.
If routes are not leaked between VRFs, the DHCP relay agent supports multi-virtual routing and forwarding (VRF) instances.
The client-facing and server-facing interfaces must be in the same VRF.
NOTE: DHCP relay implementation supports IPv4 and IPv6 addresses.
Option 82 for security
DHCP, as defined by RFC 2131, provides no authentication or security mechanisms. To ensure security, the DHCP relay agent
supports Option-82 with the Circuit ID sub-option, which is the printable name of the interface where the client request was
received.
This option secures all DHCP traffic that goes through a DHCP relay agent, and ensures that communication between the DHCP
relay agent and the DHCP server is not compromised.
The DHCP relay agent inserts Option 82 before forwarding DHCP packets to the DHCP server. The DHCP server includes
Option 82 back in its response to the relay agent. The relay agent uses this information to forward a reply out the interface on
which the request was received rather than flooding it on the entire VLAN. However, the relay agent removes Option 82 from
its DHCP responses before forwarding the responses to the client.
NOTE: Option 82 is supported, but not configurable.
DHCP snooping
DHCP snooping is a layer 2 security feature that helps networking devices to monitor DHCP messages and block untrusted or
rogue DHCP servers.
When you enable DHCP snooping on a switch, it begins monitoring transactions between trusted DHCP servers and DHCP
clients and uses the information to build the DHCP snooping binding table. You configure interfaces that connect to DHCP
servers as trusted interfaces. All other interfaces are untrusted by default.
The DHCP snooping binding table contains the following information:
● Client IP addresses
● Client MAC addresses
● Interface facing the clients
● Client VLAN
● Lease time
● DHCP binding type – static or dynamic
The switch considers DHCP servers connected to trusted interfaces on the switch as legitimate servers. When a switch
receives DHCP server-initiated packets (UDP destination port 67) on an untrusted interface, it drops the packet.
208
System management