Dhcp snooping binding on Layer 3 and layer 2 switch

[mahesh18]

Hi everyone,

Need to confirm DHCP Snooping below.

If DHCP snooping is enabled for vlans say 10 on layer 3 and layer 2 switch.

Layer 3 switch is acting as DHCP server and it has trunk connection to layer 2 switch.

User PC connects to Layer 2 switch and gets IP from the layer 3 switch.

when i do sh ip dhcp snooping binding  should did this command show bindings  on both layer 2 and layer 3 switch?

As both have dhcp snooping enabled.

thanks

mahesh

[paul driver · Accepted solution]

Hello,

The snooping d/b will show all dhcp related assignments and subnet allocation from the l2 switch from all untrusted ports whatever vlan they are in.

The trunked interface would have to be trusted so snooping is not enabled on that.

on the l3 switch if you have access ports directly attached to this switch from dhcp then the snooping D/B  will show up also.

Have a look a perter paluch's post

https://supportforums.cisco.com/message/3381128#3381128

res

Paul

[mahesh18]

Hi Paul,

I have PC connected to layer 2 switch and its getting IP from layer 3 and i see Snooping database on both layer 2 and layer 3 switch.

Is this normal behaviour?

Thanks

Mahesh

[paul driver · Accepted solution]

Hello mahesh,

I would say yes as snooping is enabled on both devices, BUT not sure why you would want to activate snooping on the distribution/core layer - do you have dhcp clients directly attached to these layers?

As long as the trunked link  from the access switch is trusted  and all access ports for the dhcp clients are set to untrusted  then I would say dhcp snooping  its not required on the distribution/core layers

res

Paul

[mahesh18]

Hi Paul,

Last thing to confirm is if users connect to switch say 6 access layers switch and this switch has trunk connection to main switch and main switch connects to dhcp server.

Then we should only enable dhcp snooping on access laywer switches and mark the uplink  ports as trusted ports right ?

Thanks

Mahesh

[paul driver · Accepted solution]

hello Mahesh

yes that is correct?

res

Paul

[mahesh18]

Hi Paul,

May thanks for all the help.

Mahesh