Consider the following topology:
This image was copied from here and in this article it specifies the following:
Remember that port
Fa0/24on SW2 is an untrusted port from DHCP Snooping’s point of view, so it drops the packets by default because Option 82 exists. That traffic never makes it to DWS1.
Okay, this is expected due to Option 82, and we only have ports
Fa0/2 as trusted, but it presents two fixes for this issue:
SW2(config)#ip dhcp snooping information option allow-untrusted
An alternative would be to make port
Fa0/24a trusted port, but this would expose us security-wise.
The article does not describe why setting the interface
Fa0/24 as a trusted port is a security issue. Nor it explains what's the implications of
allow-untrusted option in DHCP snooping information (Option 82).