Courseiva
SecurityGlobal Config

ip dhcp snooping

Enables DHCP snooping globally on the switch to filter untrusted DHCP messages and prevent rogue DHCP server attacks.

Definition: ip dhcp snooping is a Cisco IOS global config command. Enables DHCP snooping globally on the switch to filter untrusted DHCP messages and prevent rogue DHCP server attacks.

Overview

The `ip dhcp snooping` command enables DHCP snooping globally on a Cisco switch. DHCP snooping is a security feature that acts as a firewall between untrusted hosts and trusted DHCP servers. It filters DHCP messages received on untrusted ports, allowing only DHCP requests (from clients) and dropping DHCP offers, acknowledgments, and other server messages unless they arrive on a trusted port.

This prevents rogue DHCP server attacks, where an attacker could introduce a malicious DHCP server into the network to assign incorrect IP addresses, redirect traffic, or perform man-in-the-middle attacks. The concept behind DHCP snooping is based on the principle of trust: ports connected to legitimate DHCP servers are configured as trusted, while all other ports (typically access ports facing end users) are untrusted. When enabled globally, the switch builds a DHCP snooping binding database that maps client MAC addresses, IP addresses, VLANs, and port information.

This database is used for additional security features like Dynamic ARP Inspection (DAI) and IP Source Guard. You would reach for this command when you need to secure a network against unauthorized DHCP servers, especially in campus or enterprise environments where users connect their own devices. Alternatives include using DHCP snooping on a per-VLAN basis (via `ip dhcp snooping vlan`) or using port security with sticky MAC addresses, but those do not provide the same level of DHCP-specific filtering.

DHCP snooping is typically part of a broader security configuration workflow that includes enabling DAI, IP Source Guard, and port security. Important IOS behavior: The command requires global configuration mode (privilege level 15). It does not produce immediate output; it simply enables the feature.

The running config will show `ip dhcp snooping` under global config. The feature is disabled by default. After enabling globally, you must also enable it on specific VLANs using `ip dhcp snooping vlan {vlan-id}` and configure trusted ports using `ip dhcp snooping trust` on interfaces connected to legitimate DHCP servers.

Without these additional steps, DHCP snooping will not filter traffic. The command has no parameters itself; all parameters are subcommands or interface-level commands. The binding database is stored in RAM and can be displayed with `show ip dhcp snooping binding`.

The database can also be exported to a TFTP server for persistence. Note that DHCP snooping requires the switch to inspect DHCP packets, which may impact CPU usage on switches with high DHCP traffic, but modern switches handle this efficiently. The feature is supported on most Cisco Catalyst switches running IOS, IOS-XE, and even some IOS-XR platforms (though with different syntax).

Syntax·Global Config
ip dhcp snooping

When to Use This Command

  • Preventing a rogue DHCP server from assigning malicious IP addresses to clients on an access layer switch.
  • Building a DHCP snooping binding database to track legitimate DHCP leases for IP Source Guard or Dynamic ARP Inspection.
  • Enforcing DHCP rate limiting on untrusted ports to mitigate DHCP starvation attacks.
  • Logging DHCP snooping violations for security auditing and troubleshooting.

Command Examples

Enable DHCP Snooping Globally and on VLAN 10

ip dhcp snooping ip dhcp snooping vlan 10
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)#

The first command enables DHCP snooping globally. The second command enables it specifically on VLAN 10, meaning the switch will inspect DHCP messages on that VLAN.

Verify DHCP Snooping Configuration

show ip dhcp snooping
Switch DHCP snooping is enabled
Switch DHCP snooping is configured for the following VLANs:
10
Insertion of option 82 is enabled
Circuit-id format: vlan-mod-port
Remote-id format: MAC
Option 82 on untrusted port is not allowed
Verification of hwaddr field is enabled
Verification of giaddr field is enabled
DHCP snooping trust/rate is configured on the following Interfaces:

Interface                  Trusted     Rate limit (pps)
-----------------------    -------     ------------------
GigabitEthernet0/1         yes         unlimited
GigabitEthernet0/2         no          15

The output shows global status: enabled, VLANs monitored (10), option 82 settings, and per-interface trust state and rate limit. Trusted interfaces (uplinks) are set to 'yes' with unlimited rate; untrusted ports (access ports) are 'no' with a rate limit of 15 packets per second.

Understanding the Output

The 'show ip dhcp snooping' command displays the global DHCP snooping status, the VLANs on which it is enabled, and the trust configuration per interface. The 'Trusted' column indicates whether the interface is considered trusted (yes) or untrusted (no). Trusted ports are typically uplinks to other switches or DHCP servers; untrusted ports are access ports facing clients.

The 'Rate limit (pps)' column shows the maximum number of DHCP packets per second allowed on that interface. A rate limit of 'unlimited' means no restriction. In a real network, you should ensure that only uplink ports are trusted and that untrusted ports have a reasonable rate limit (e.g., 15-100 pps) to prevent DHCP starvation attacks.

If you see a trusted port on an access VLAN, that could indicate a misconfiguration allowing rogue DHCP servers.

Configuration Scenarios

Basic DHCP Snooping Configuration on a Single VLAN

A small office network has a single VLAN 10 with a legitimate DHCP server connected to port Gi0/1. The switch has multiple access ports (Gi0/2-24) for end users. The goal is to prevent any rogue DHCP server from being connected to an access port and offering false IP addresses.

Topology

DHCP Server (Gi0/1)---[Switch]---(Gi0/2) Client A |---(Gi0/3) Client B

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enable DHCP snooping globally: ip dhcp snooping
  3. 3.Step 3: Enable DHCP snooping for VLAN 10: ip dhcp snooping vlan 10
  4. 4.Step 4: Enter interface configuration for the trusted port: interface GigabitEthernet0/1
  5. 5.Step 5: Configure the port as trusted: ip dhcp snooping trust
  6. 6.Step 6: Exit to global config and optionally set the DHCP snooping database location: ip dhcp snooping database tftp://192.168.1.100/dhcp-binding
  7. 7.Step 7: Return to privileged EXEC mode: end
Configuration
!
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10
interface GigabitEthernet0/1
 ip dhcp snooping trust
 exit
ip dhcp snooping database tftp://192.168.1.100/dhcp-binding
end

Verify: Use `show ip dhcp snooping` to verify that DHCP snooping is enabled globally and on VLAN 10, and that Gi0/1 is trusted. Expected output: 'Switch DHCP snooping is enabled', 'DHCP snooping is configured on following VLANs: 10', 'Interface Trusted Rate limit (pps)' and 'GigabitEthernet0/1 yes unlimited'.

Watch out: A common mistake is forgetting to enable DHCP snooping on the VLAN. Without `ip dhcp snooping vlan 10`, the feature will not filter any DHCP traffic on that VLAN, leaving the network vulnerable.

DHCP Snooping with Multiple VLANs and a Trunk Port

A distribution switch connects to multiple access switches via trunk ports. The DHCP server is connected to the distribution switch on port Gi0/1, and it serves multiple VLANs (10, 20, 30). The goal is to enable DHCP snooping on all three VLANs and ensure that only the trunk port to the DHCP server is trusted, while all other ports (including trunk ports to other switches) are untrusted unless they carry legitimate DHCP server traffic.

Topology

DHCP Server (Gi0/1)---[DistSwitch]---(Gi0/2, trunk)---[AccSwitch1]---(Gi0/1) Client |---(Gi0/3, trunk)---[AccSwitch2]

Steps

  1. 1.Step 1: Enter global configuration mode: configure terminal
  2. 2.Step 2: Enable DHCP snooping globally: ip dhcp snooping
  3. 3.Step 3: Enable DHCP snooping for VLANs 10, 20, and 30: ip dhcp snooping vlan 10,20,30
  4. 4.Step 4: Enter interface configuration for the port connected to the DHCP server: interface GigabitEthernet0/1
  5. 5.Step 5: Configure the port as trusted: ip dhcp snooping trust
  6. 6.Step 6: Exit to global config and optionally configure the database: ip dhcp snooping database tftp://192.168.1.100/dhcp-binding
  7. 7.Step 7: Return to privileged EXEC mode: end
Configuration
!
configure terminal
ip dhcp snooping
ip dhcp snooping vlan 10,20,30
interface GigabitEthernet0/1
 ip dhcp snooping trust
 exit
ip dhcp snooping database tftp://192.168.1.100/dhcp-binding
end

Verify: Use `show ip dhcp snooping` to verify the trusted interface and VLANs. Use `show ip dhcp snooping binding` to see the binding table after clients obtain IP addresses. Expected output: 'Interface Trusted Rate limit (pps)' with Gi0/1 showing 'yes'. The binding table should list MAC addresses, IP addresses, VLANs, and ports for each client.

Watch out: A common mistake is configuring trunk ports as trusted without verifying that they only carry DHCP server traffic. If a trunk port connects to another switch that has a rogue DHCP server, that trunk should remain untrusted. Only the port directly connected to the legitimate DHCP server should be trusted.

Troubleshooting with This Command

When troubleshooting DHCP snooping, the primary command is `show ip dhcp snooping`. Healthy output shows 'DHCP snooping is enabled' globally and on the desired VLANs. The trusted interfaces should be listed with 'yes' under the Trusted column.

If DHCP clients are not receiving IP addresses, first verify that DHCP snooping is enabled on the correct VLANs. Use `show ip dhcp snooping vlan {vlan-id}` to confirm. If the VLAN is missing, add it with `ip dhcp snooping vlan`.

Next, check the trusted port configuration. If the port connected to the legitimate DHCP server is not trusted, all DHCP server messages (OFFER, ACK) will be dropped. Use `show running-config interface {interface}` to verify the `ip dhcp snooping trust` command.

Another common symptom is that the DHCP binding table (`show ip dhcp snooping binding`) is empty or missing entries. This could indicate that DHCP requests are not reaching the server or that the server's responses are being dropped. Check the binding table for expected entries; if clients are obtaining IP addresses but the table is empty, DHCP snooping may be disabled on that VLAN or the switch may not be seeing the DHCP packets (e.g., due to VLAN ACLs).

Also, verify that the DHCP server is configured correctly and reachable. If the server is on a different subnet, ensure IP routing is working. Use `debug ip dhcp snooping packet` to see real-time DHCP packet processing.

This debug will show whether packets are being forwarded or dropped, and why. For example, 'DHCP_SNOOPING: Dropping DHCP packet on untrusted port' indicates a rogue server attempt. Focus on the 'op' field: 1=BOOTREQUEST, 2=BOOTREPLY.

If a BOOTREPLY is received on an untrusted port, it will be dropped. Another useful debug is `debug ip dhcp snooping events` to see binding table updates. Correlate these with `show ip dhcp snooping statistics` to see counters for dropped and forwarded packets.

If the rate of dropped packets is high, check for misconfigured trusted ports. Also, ensure that the DHCP snooping database is not full; the switch can store up to 8192 bindings by default. If the binding table is full, new clients will not get IP addresses.

Use `show ip dhcp snooping binding count` to see the number of entries. Finally, remember that DHCP snooping works in conjunction with DAI and IP Source Guard. If those features are enabled, they may also cause issues.

For example, DAI drops ARP packets if the MAC-IP binding is not in the DHCP snooping database. So if clients are having connectivity issues after getting an IP, check DAI logs.

CCNA Exam Tips

1.

CCNA exam tip: DHCP snooping must be enabled globally and per VLAN; both steps are required.

2.

CCNA exam tip: By default, all ports are untrusted; you must manually configure uplink ports as trusted using 'ip dhcp snooping trust'.

3.

CCNA exam tip: DHCP snooping is a prerequisite for Dynamic ARP Inspection (DAI) and IP Source Guard.

4.

CCNA exam tip: Option 82 insertion is enabled by default; the exam may ask about its role in DHCP snooping.

Common Mistakes

Mistake 1: Enabling DHCP snooping globally but forgetting to enable it on the specific VLAN, resulting in no filtering.

Mistake 2: Not configuring the uplink port as trusted, causing legitimate DHCP server responses to be dropped.

Mistake 3: Setting the rate limit too low on access ports, causing legitimate DHCP requests to be dropped during boot storms.

ip dhcp snooping vs ip dhcp snooping trust

DHCP snooping requires both a global enable and per-interface trust designation; these commands are often confused because they are both essential to the feature but operate at different levels. The global command activates snooping, while the interface command overrides the default untrusted state to permit DHCP server responses.

Aspectip dhcp snoopingip dhcp snooping trust
ScopeGlobal (entire switch)Per-interface
Configuration ModeGlobal configurationInterface configuration
PersistenceRemains until globally disabledPersists on that interface until removed
PrecedenceMust be enabled before trust can be setOverrides default untrusted state on that interface
Typical UseEnables DHCP snooping to inspect all DHCP trafficDesignates ports connected to legitimate DHCP servers

Use ip dhcp snooping when you want to enable DHCP snooping globally to protect the network from rogue DHCP servers and DHCP starvation attacks.

Use ip dhcp snooping trust on interfaces that connect to authorized DHCP servers or other trusted switches to allow DHCP server responses through.

Platform Notes

In IOS-XE (e.g., Catalyst 9000 series), the command syntax is identical: `ip dhcp snooping`. However, the output of `show ip dhcp snooping` may include additional fields like 'Information option' and 'Circuit-id format'. The DHCP snooping database can also be stored in flash or on a USB drive.

In NX-OS (e.g., Nexus switches), the equivalent command is `ip dhcp snooping` in global config, but the feature is enabled per VLAN using `ip dhcp snooping vlan {vlan-id}`. The trusted port configuration is done with `ip dhcp snooping trust` under interface config. NX-OS also supports DHCP snooping for IPv6 with `ipv6 dhcp snooping`.

In ASA firewalls, DHCP snooping is not directly supported; instead, ASA uses DHCP relay and can filter DHCP packets using access-lists. For IOS-XR (e.g., ASR 9000), DHCP snooping is not available as a feature; instead, use DHCPv4 and DHCPv6 relay with security features like uRPF. Between IOS versions, there are minor differences: In IOS 12.x, DHCP snooping was introduced and the database could only be stored in RAM.

In IOS 15.x and later, the database can be exported to a TFTP server or flash. In IOS 16.x (IOS-XE), the feature is more robust and supports rate limiting on untrusted ports via `ip dhcp snooping limit rate`. Also, in some older IOS versions, the command `ip dhcp snooping` required the switch to be in VTP transparent mode; this is no longer a requirement.

Always check the specific platform documentation for exact syntax and capabilities.

Related Commands

ip dhcp snooping limit rate

Limits the rate of DHCP packets that can be received on a switch port. Ports exceeding the rate limit are err-disabled automatically, protecting against DHCP starvation attacks and rogue DHCP servers.

ip dhcp snooping trust

Configures an interface as a trusted port for DHCP snooping, allowing DHCP server responses to be forwarded through it.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions