DHCP Snooping Best Practices on Access Switches

[MD Irshad Ansari]

Hi Everyone,

In enterprise LANs, I usually enable DHCP snooping for security — but it sometimes causes issues if trust is not configured correctly on uplinks.

Quick questions:

1. Do you enable DHCP Snooping by default on all access VLANs?
2. Do you also use IP Source Guard and Dynamic ARP Inspection along with it?
3. Any common mistakes that can cause client IP assignment issues?

Appreciate your input!

Thanks

[David Ruess]

Hello,

In terms of DHCP snooping being a L2 security technology we configure it on mainly user VLANs such as PCs, VoIP phones, VTCs, printers etc. since those are the main VLANs that get DHCP addresses. Server VLANs or devices that have static IPs usually don’t get the snooping activated on that vlan.

ARP inspection and source guard are also applied as addition security measures.

Our main issue has been identifying trusted interfaces. That will cause client DHCP issues if not configured correctly.

Hope that helps

-David

[balaji.bandi]

It all depends on the deployment and model you'reThe  using :

guide below gives you an indication of what ports you need to trust and untrust :

https://www.cisco.com/c/en/us/support/docs/ip/dynamic-host-configuration-protocol-dhcp-dhcpv6/217055-operate-and-troubleshoot-dhcp-snooping.html#toc-hId-1217083853

https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst9200/software/release/17-9/configuration_guide/ip/b_179_ip_9200_cg/configuring_dhcp.html#pre-requisites_for_configuring_dhcp