ip dhcp snooping trust
Configures an interface as a trusted port for DHCP snooping, allowing DHCP server responses to be forwarded through it.
Definition: ip dhcp snooping trust is a Cisco IOS interface config command. Configures an interface as a trusted port for DHCP snooping, allowing DHCP server responses to be forwarded through it.
Overview
The `ip dhcp snooping trust` command is a critical security feature in Cisco IOS that designates a switch port as trusted for DHCP snooping purposes. DHCP snooping acts as a firewall between untrusted hosts and DHCP servers, preventing rogue DHCP server attacks where an attacker could offer malicious IP configurations. By default, all ports are untrusted, meaning the switch will drop any DHCP server responses (OFFER, ACK, NAK) received on those ports.
Only ports explicitly configured with `ip dhcp snooping trust` are allowed to forward DHCP server messages. This command is typically applied to ports connecting to legitimate DHCP servers or uplinks to other switches that aggregate DHCP traffic. It is part of a broader DHCP snooping configuration that also includes enabling DHCP snooping globally, specifying VLANs to snoop, and optionally configuring rate limiting or DHCP option 82 insertion.
Without this command, legitimate DHCP servers would be unable to assign addresses, breaking network connectivity. The command operates at the interface level and takes effect immediately; no reload is required. It is available in privileged EXEC mode (config-if) and requires the switch to be in IOS 12.2(25)SE or later.
The running configuration will show the command under the interface. When troubleshooting, verifying trusted ports is essential to ensure DHCP works correctly. Alternative approaches include using DHCP relay agents or static IP assignments, but DHCP snooping with trusted ports is the standard for security in access layer switches.
ip dhcp snooping trustWhen to Use This Command
- On a switch port connected to a legitimate DHCP server to ensure its replies are trusted and not dropped.
- On an uplink port connecting to another switch that is the DHCP server or has a trusted path to the server.
- On a port connected to a DHCP relay agent that forwards server responses.
- On a port connected to a router that provides DHCP services for the subnet.
Command Examples
Trusting an interface connected to a DHCP server
interface GigabitEthernet0/1
ip dhcp snooping trustSwitch(config-if)# ip dhcp snooping trust Switch(config-if)#
The command is entered in interface configuration mode. No output is displayed upon success. The interface is now trusted for DHCP snooping.
Verifying trusted interface status
show ip dhcp snoopingSwitch DHCP snooping is enabled DHCP snooping is configured on following VLANs: 10,20,30 DHCP snooping operational on following VLANs: 10,20,30 DHCP snooping is configured on the following L3 Interfaces: Insertion of option 82 is enabled circuit-id default format: vlan-mod-port remote-id: 00:11:22:33:44:55 (MAC) Option 82 on untrusted port is not allowed Verification of hwaddr field is enabled Verification of giaddr field is enabled DHCP snooping trust/rate is configured on the following Interfaces: Interface Trusted Allow option Rate limit (pps) ----------------------- ------- ------------ ---------------- GigabitEthernet0/1 yes yes unlimited GigabitEthernet0/2 no no 15
The 'show ip dhcp snooping' output displays the trust status for each interface. The 'Trusted' column shows 'yes' for trusted ports and 'no' for untrusted. The 'Allow option' column indicates whether option 82 is allowed, and 'Rate limit' shows the configured rate limit in packets per second.
Understanding the Output
The 'show ip dhcp snooping' command provides a summary of DHCP snooping configuration. The 'Trusted' column indicates whether the interface is trusted (yes) or untrusted (no). Trusted ports are allowed to receive DHCP server responses; untrusted ports will drop such packets.
The 'Allow option' column shows if DHCP option 82 insertion is permitted on that interface. The 'Rate limit' column displays the rate limit for DHCP packets on untrusted ports (in packets per second). In a real network, ensure that only ports connected to legitimate DHCP servers or relay agents are trusted.
All other ports should remain untrusted to prevent rogue DHCP server attacks.
Configuration Scenarios
Configure a trusted port for a legitimate DHCP server
A company has a centralized DHCP server connected to a switch port. Without trusting this port, the switch will drop DHCP server responses, preventing clients from obtaining IP addresses.
Topology
DHCP_Server(Gi0/1)---(Gi0/1)Switch(Gi0/2)---ClientSteps
- 1.Step 1: Enter global configuration mode: Switch> enable
- 2.Step 2: Enter global configuration mode: Switch# configure terminal
- 3.Step 3: Enter interface configuration mode for the port connected to the DHCP server: Switch(config)# interface GigabitEthernet0/1
- 4.Step 4: Configure the port as trusted: Switch(config-if)# ip dhcp snooping trust
- 5.Step 5: Exit and verify: Switch(config-if)# end
! Enable DHCP snooping globally ip dhcp snooping ! Specify VLANs to snoop (e.g., VLAN 10) ip dhcp snooping vlan 10 ! Configure trusted port interface GigabitEthernet0/1 ip dhcp snooping trust
Verify: Switch# show ip dhcp snooping Output should show GigabitEthernet0/1 as 'Trusted' under the interface list.
Watch out: Forgetting to enable DHCP snooping globally or on the specific VLAN will cause the trust command to have no effect.
Configure a trusted port on an uplink to another switch
Two switches are connected via a trunk link. The upstream switch has a DHCP server. The downstream switch must trust the uplink port to forward DHCP server responses from the upstream switch.
Topology
SwitchA(Gi0/1)---(Gi0/1)SwitchB(Gi0/2)---ClientSteps
- 1.Step 1: On SwitchB, enable DHCP snooping globally: SwitchB(config)# ip dhcp snooping
- 2.Step 2: Specify the VLANs that need snooping: SwitchB(config)# ip dhcp snooping vlan 10,20
- 3.Step 3: Enter the uplink interface: SwitchB(config)# interface GigabitEthernet0/1
- 4.Step 4: Configure the port as trusted: SwitchB(config-if)# ip dhcp snooping trust
- 5.Step 5: Optionally, configure rate limiting on untrusted ports: SwitchB(config-if)# interface GigabitEthernet0/2 SwitchB(config-if)# ip dhcp snooping limit rate 10
! On SwitchB ip dhcp snooping ip dhcp snooping vlan 10,20 interface GigabitEthernet0/1 ip dhcp snooping trust interface GigabitEthernet0/2 ip dhcp snooping limit rate 10
Verify: SwitchB# show ip dhcp snooping Check that Gi0/1 is 'Trusted' and Gi0/2 is 'Untrusted' with rate limit 10.
Watch out: If the uplink is a trunk, ensure the allowed VLANs match the snooping VLANs; otherwise, DHCP packets may be dropped.
Troubleshooting with This Command
When troubleshooting DHCP issues with DHCP snooping enabled, the first step is to verify the DHCP snooping status using `show ip dhcp snooping`. Healthy output shows the global status as 'Enabled', the snooping VLANs listed, and each interface with its trust state. For a trusted port, the output should display 'Trusted' under the interface line.
If a port is incorrectly untrusted, DHCP server responses will be dropped, and clients will fail to obtain IP addresses. Common symptoms include clients receiving 'APIPA' addresses (169.254.x.x) or DHCP discover packets being sent but no offer received. Focus on the 'Trusted' column; any port that should be trusted but shows 'Untrusted' is a problem.
Also check the 'Rate (pps)' column for untrusted ports; if rate limiting is too low, legitimate DHCP requests may be dropped. Use `debug ip dhcp snooping` to see packet drops in real time; look for messages like 'DHCP_SNOOPING: drop packet because not trusted port'. Correlate with `show ip dhcp snooping binding` to see if MAC-to-IP bindings are being created; if no bindings appear, DHCP offers are likely being dropped.
A step-by-step diagnostic flow: 1) Verify DHCP snooping is enabled globally and on the correct VLANs. 2) Check the trust state of all ports connecting to DHCP servers or uplinks. 3) On untrusted ports, verify rate limiting is not too restrictive. 4) Use `show ip dhcp snooping statistics` to see packet counts and drops. 5) If using DHCP option 82, ensure the switch is configured correctly. Remember that DHCP snooping only inspects DHCP packets; other traffic is unaffected. If DHCP works without snooping but fails with it, the trust configuration is almost always the culprit.
CCNA Exam Tips
Remember that DHCP snooping must be globally enabled before configuring trust on an interface.
On CCNA exam, you may be asked to identify which ports should be trusted: typically uplinks to other switches or router ports acting as DHCP servers.
Trusted ports bypass DHCP snooping validation; only configure trust on ports that are known to receive legitimate DHCP server responses.
The 'ip dhcp snooping trust' command is applied per interface; it does not affect the global DHCP snooping state.
Common Mistakes
Configuring trust on all ports, which defeats the purpose of DHCP snooping and allows rogue DHCP server attacks.
Forgetting to enable DHCP snooping globally with 'ip dhcp snooping' before configuring trust on an interface.
Applying the trust command on a port that is actually connected to a client, causing the switch to accept DHCP server replies from that port.
ip dhcp snooping trust vs ip dhcp snooping
These two commands are commonly considered together because DHCP snooping requires both global enablement and per-interface trust configuration. The global command activates the feature, while the interface command designates ports that are allowed to forward DHCP server responses.
| Aspect | ip dhcp snooping trust | ip dhcp snooping |
|---|---|---|
| Scope | Single interface | Entire switch |
| Configuration mode | Interface configuration | Global configuration |
| Persistence | Persistent per interface in running-config | Persistent as a single global command |
| Precedence | Overrides global untrusted default on that port | Enables the feature; trust per port takes effect |
| Typical use | Ports connecting to legitimate DHCP servers | Enabling DHCP snooping at the switch level |
| Effect | Allows DHCP server messages on that port | Enables filtering of DHCP messages on untrusted ports |
Use ip dhcp snooping trust on a port that connects to an authorized DHCP server to ensure its responses are forwarded.
Use ip dhcp snooping globally to enable DHCP snooping and start protecting against rogue DHCP server attacks.
Platform Notes
In IOS-XE, the command syntax is identical to classic IOS: `ip dhcp snooping trust` under interface configuration. However, IOS-XE may have additional features like DHCP snooping for IPv6 (`ipv6 dhcp snooping trust`). In NX-OS, the equivalent command is `ip dhcp snooping trust` as well, but the global configuration differs: NX-OS uses `feature dhcp` to enable DHCP snooping, and VLAN configuration is done with `ip dhcp snooping vlan <vlan>`.
The trust command is the same at the interface level. For ASA firewalls, DHCP snooping is not directly supported; instead, ASA uses DHCP relay or DHCP server features. In IOS-XR, DHCP snooping is not available; it uses DHCPv4 relay or DHCP local server.
Between IOS versions, the command has remained consistent since 12.2(25)SE. In IOS 15.x and 16.x, the output of `show ip dhcp snooping` may include additional fields like 'Information option' and 'Circuit ID'. Always verify the exact output format on your platform.
For Catalyst switches running IOS-XE, the command is fully supported. For older IOS 12.x, ensure the IP services feature set is loaded. There are no privilege level requirements beyond 15 for configuration.
The command is saved in running-config and startup-config.
Related Commands
Practice for the CCNA 200-301
Test your knowledge with practice questions covering all CCNA 200-301 exam domains.
Practice CCNA 200-301 Questions