4-5IP static binding tableThe DHCP-snooping table only records information about clients that obtains IP address dynamicallythrough DHCP. If a fixed IP address is configured for a client, the IP address and MAC address of theclient cannot be recorded in the DHCP-snooping table. Consequently, this client cannot pass the IPfiltering of the DHCP-snooping table, thus it cannot access external networks.To solve this problem, the switch supports the configuration of static binding table entries, that is, thebinding relationship between IP address, MAC address, and the port connecting to the client, so thatpackets of the client can be correctly forwarded.IP filteringThe switch can filter IP packets in the following two modes:z Filtering the source IP address in a packet. If the source IP address and the number of the port thatreceives the packet are consistent with entries in the DHCP-snooping table or static binding table,the switch regards the packet as a valid packet and forwards it; otherwise, the switch drops itdirectly.z Filtering the source IP address and the source MAC address in a packet. If the source IP addressand source MAC address in the packet, and the number of the port that receives the packet areconsistent with entries in the DHCP-snooping table or static binding table, the switch regards thepacket as a valid packet and forwards it; otherwise, the switch drops it directly.Configuring DHCP SnoopingConfiguring DHCP SnoopingFollow these steps to configure DHCP snooping:To do… Use the command… RemarksEnter system view system-view —Enable DHCP snooping dhcp-snoopingRequiredBy default, the DHCP snoopingfunction is disabled.Enter Ethernet port view interface interface-typeinterface-number —Specify the current port as atrusted port dhcp-snooping trustRequiredBy default, after DHCPsnooping is enabled, all ports ofa switch are untrusted ports.
