dhcp snooping on l3 access switch

[bluesea2010]

Hi 

If a rogue DHCP server is active on the same VLAN as clients, the client may obtain its IP configuration from that unauthorized server. ?. How to solve this ? 

interface Vlan10
ip address 10.0.10.1 255.255.255.0
ip helper-address 192.168.100.10

Thanks

[Jens Albrecht · Accepted solution]

Hi @bluesea2010,

you already presented the solution in the headline of your post: DHCP snooping.

Once you enable this feature for Vlan 10 by default all ports are untrusted and the switch will simply drop any DHCP offer packets from rogue DHCP servers.

The fact that by default all ports are untrusted also means that you have to configure the port that is pointing to your legitimate DHCP server as a trusted port. Typically this is a trunk link to the switch where your server is connected. In case you have redundant uplinks and/or redundant DHCP servers, then all those links need to be configured as trusted ports.

If you forget to configure the port(s) for your DCHP server(s) as trusted then no one will be able to get an IP address so double-check this before enabling DHCP snooping.

In case you need help to configure this feature, then please tell us the platform and software you are running on your switch.

HTH!

[bluesea2010]

My switch is layer 3 access switch , svi's are on the same switch . so trusted won't work on l3 interfaces . dhcp server can reach   through routed interface . so the question here again 

If a rogue DHCP server is active on the same VLAN as clients, the client may obtain its IP configuration from that unauthorized server.

Thanks

[Jens Albrecht]

DHCP snooping is a Layer 2 feature that only works on switchports.

Routed ports are simply not inspected, so there is no need to configure them as trusted ports and hence it is not possible to do so.

As a result all your access ports remain untrusted and DHCP snooping protects against rogue DHCP servers in the configured Vlan.

[bluesea2010]

the below commands are enough to configure dhcp snooping on l3 access switches

ip dhcp snooping vlan 10,100

no ip dhcp snooping information option

ip dhcp snooping

and what about arp snooping  on the same l3 switch