4-12Configuration procedure# Enable DHCP snooping on the switch. system-view[Switch] dhcp-snooping# Specify GigabitEthernet 1/0/5 as the trusted port.[Switch] interface GigabitEthernet 1/0/5[Switch-GigabitEthernet1/0/5] dhcp-snooping trust[Switch-GigabitEthernet1/0/5] quit# Enable DHCP-snooping Option 82 support.[Switch] dhcp-snooping information enable# Set the remote ID sub-option in Option 82 to the system name (sysname) of the DHCP snoopingdevice.[Switch] dhcp-snooping information remote-id sysname# Set the circuit ID sub-option in DHCP packets from VLAN 1 to abcd on GigabitEthernet 1/0/3.[Switch] interface GigabitEthernet 1/0/3[Switch-GigabitEthernet1/0/3] dhcp-snooping information vlan 1 circuit-id string abcdIP Filtering Configuration ExampleNetwork requirementsAs shown in Figure 4-7, GigabitEthernet 1/0/1 of the S5600 switch is connected to the DHCP server andGigabitEthernet 1/0/2 is connected to Host A. The IP address and MAC address of Host A are 1.1.1.1and 0001-0001-0001 respectively. GigabitEthernet 1/0/3 and GigabitEthernet 1/0/4 are connected toDHCP Client B and Client C.z Enable DHCP snooping on the switch, and specify GigabitEthernet 1/0/1 as the DHCP snoopingtrusted port.z Enable IP filtering on GigabitEthernet 1/0/2, GigabitEthernet 1/0/3, and GigabitEthernet 1/0/4 toprevent attacks to the server from clients using fake source IP addresses.z Create static binding entries on the switch, so that Host A using a fixed IP address can accessexternal networks.
