DHCP snooping config

[carl_townshend]

Hi Guys

We are looking at switching on dhcp snooping on our edge switches.

My question is, does dhcp snooping need to be enabled on every switch, or can it work on individual isolated switches?

For example, we have server switches where the dhcp server sits, a core and some edge switches, will it cause us any issues if we just enable it on the edge switches only?

cheers

[Kanan Huseynli]

Hi,

is it normally enabled on edge - access switches where connected devices can result dhcp based problems. End devices are not connected to core, distro or DC switches, so you don't need enable on them.

Just, note that when you enable dhcp snooping on cisco, switch inserts option-82 but this is ignored on upstream switches (even when no snooping is enabled on upstream distro/ core switch). That's why you should either disable option-82 insertion (it does not result problem, if you dhcp environment does not use it) or allow this option on upstream switch.

https://www.cisco.com/en/US/docs/general/Test/dwerblo/broken_guide/snoodhcp.html

[paul driver]

Hello
Dhcp snooping is a L2 security feature as such it should be applied ONLY on the access edge switches, also by default ALL ports are untrusted so you will need to trust the switch plinks and of course the port where the dhcp server resides

[MHM Cisco World]

Only you need to enable it in Access SW which direct connect to host'

Other SW no need' 

BUT' the link from access SW to other SW must config as trust if DHCP server connect to other SW 

Or 

Untrust if dhcp not connect and also direct connect to access SW.

Note:- no need to disable op-82 if other SW not run dhcp snooping.