4
votes
Accepted
Why do Cisco IOS switches send packets to DHCP servers with zero giaddr field when DHCP snooping is on?
It's not technically setting giaddr to anything. The original request had the field empty and the switch isn't changing it, because it isn't an actual dhcp-relay. The problem is the switch adding ...
- 32.4k
3
votes
IP Snooping\ARP Inspection With Static Devices On DHCP VLAN
IF the device has a reservation, you should enable DHCP so it gets the correct address from the server.
If you can't enable DHCP on the device, you can create a static binding in the snooping database:...
- 67.9k
3
votes
Accepted
Security issues with DHCP snooping on cascading switches
Trusted ports lead to DHCP servers. On SW2, that's Fa0/11. On SW1, that's Fa0/2. Those are the only ports on which one expects DHCP replies. Trusting any other ports potentially allows DHCP servers to ...
- 32.4k
2
votes
Accepted
How to avoid end-user connect their wireless router?
One thing I don't know if I am able to shut down the sw port if someone uses wireless routers or rouge routers to connect our network? ... I want to see if there is any Aruba CLI would solve this ...
- 27.4k
2
votes
Accepted
Dynamic ARP Inspection + IP Source Guard (without DHCP Snooping)
Dynamic ARP Inspection and IP Source Guard require DHCP Snooping to function.
What happens, assuming you do not have trust configured between the switches is that PC-A will not work when connected to ...
- 100k
2
votes
DHCP Snooping on HP 2510 or alternate
Since this is still open: the 2510 doesn't support DHCP snooping nor ACLs that could be used in a similar way.
protected-ports can be used to prevent communication between client ports, seemingly ...
- 86.4k
2
votes
Accepted
ip dhcp snooping Kills DHCP Ports
If you just enable DHCP snooping the switch begins to monitor and filter(!) DHCP traffic.
If you don't also set up trust for the server-facing port (or server IP address, depending on the exact switch ...
- 86.4k
2
votes
DHCP Snooping in a DHCP Helper/Relay Environment with a centralized DHCP server
"Trust" must be on the interface(s) facing the DHCP server. (any port that would see a DHCP reply). That's ALS1 G0/1, MLS G0/0, and ALS2 G0/0. So You have the wrong interface trusted on MLS.
...
- 32.4k
1
vote
Accepted
Does this DHCP Server need a trusted ARP Inspection port in IOS?
Dynamic ARP inspection is based on DHCP snooping. The switch snoops DHCP and ensures that all nodes can only use the IP address they are granted by DHCP.
DHCP snooping requires a host or port to be ...
- 86.4k
1
vote
Accepted
Trusted and Untrusted ports in DHCP Snooping / ARP Inspection
Yes, it could. If the interlink isn't trusted downstream, the IP-MAC combinations are checked twice.
Whether your security policy requires that, makes it optional, or even disallows that is up to that ...
- 86.4k
1
vote
ip dhcp snooping Kills DHCP Ports
For Windows PCs and Windows DHCP server, you need to include these global commands:
no ip dhcp snooping information option
no ip dhcp snooping verify mac-address
no ip dhcp snooping verify no-relay-...
- 67.9k
1
vote
Accepted
The equivalent of "ip dhcp snooping information option allow-untrusted" on NX-OS
The platform you're using is basically a bugware, seems like this switch was made by some trainee before doing some real (not the "unlimited-money CVDs") networking for the first time.
...
- 195
1
vote
Security issues with DHCP snooping on cascading switches
DHCP snooping filters server-side traffic (offer, acknowledge) from untrusted ports or IP addresses (depending on configuration). It doesn't filter client-side traffic (discover, request). So, ...
- 86.4k
1
vote
DHCP snooping problem
If you use the following command, your problem will be solved.
no ip dhcp snooping information option
for example,my configuration:
sw1-f1-msh-p#show run | s snooping
ip dhcp snooping vlan 201,706,...
1
vote
Accepted
DHCP snooping problem
This is a limitation with packet tracer it seems. I quickly replicated your set up in PT 7.0 with no luck.
If you put a server on a new switchport, put the port on the correct vlan and mark that port ...
- 391
Only top scored, non community-wiki answers of a minimum length are eligible