Courseiva
SecurityGlobal Config

ip dhcp snooping vlan [id]

Enables DHCP snooping on a specific VLAN to filter untrusted DHCP messages and prevent rogue DHCP server attacks.

Definition: ip dhcp snooping vlan [id] is a Cisco IOS global config command. Enables DHCP snooping on a specific VLAN to filter untrusted DHCP messages and prevent rogue DHCP server attacks.

Overview

The `ip dhcp snooping vlan [id]` command is a critical security feature in Cisco IOS that enables DHCP snooping on a specific VLAN. DHCP snooping acts as a firewall between untrusted hosts and trusted DHCP servers, filtering DHCP messages to prevent rogue DHCP server attacks. When enabled, the switch intercepts all DHCP messages on the specified VLAN and validates them against a binding database.

This database maps client MAC addresses to IP addresses, VLANs, and ports, ensuring that only legitimate DHCP servers (those on trusted ports) can assign IP addresses. The command is typically used in access layer switches to protect against man-in-the-middle attacks, IP address spoofing, and denial-of-service attacks. Without DHCP snooping, any device connected to the network could potentially run a rogue DHCP server, handing out false IP configurations and redirecting traffic.

The command is part of a broader security toolkit that includes Dynamic ARP Inspection (DAI) and IP Source Guard, which rely on the DHCP snooping binding database. Network engineers reach for this command when deploying new VLANs in a campus or data center environment, especially in areas with untrusted user devices. It is also used during security audits or after a rogue DHCP incident.

The command operates in global configuration mode and requires privilege level 15. Once applied, the running config shows the VLANs under DHCP snooping, and the binding database is built dynamically. Important IOS behavior: DHCP snooping must be globally enabled first with `ip dhcp snooping`, and the switch must have a trusted port (usually uplink to the DHCP server) configured with `ip dhcp snooping trust`.

The command does not buffer output; it immediately affects the switch's DHCP processing. The binding database can be stored in non-volatile memory using `ip dhcp snooping database` to survive reloads. This command is foundational for Layer 2 security and is a common topic in CCNA and CCNP exams.

Syntax·Global Config
ip dhcp snooping vlan [id]

When to Use This Command

  • Protect a user access VLAN from unauthorized DHCP servers by enabling snooping on that VLAN.
  • Enable DHCP snooping on a voice VLAN to ensure only authorized DHCP servers assign IP addresses to IP phones.
  • Use in a multi-VLAN environment to selectively apply DHCP snooping only on VLANs with untrusted hosts.
  • Combine with DHCP snooping option 82 to add circuit ID information for DHCP requests in a specific VLAN.

Parameters

ParameterSyntaxDescription
id<1-4094>Specifies the VLAN number on which to enable DHCP snooping. Valid values are from 1 to 4094. Common mistakes include forgetting to enable DHCP snooping globally first, or applying the command to a VLAN that does not exist on the switch. Ensure the VLAN is created and active.

Command Examples

Enable DHCP snooping on VLAN 10

ip dhcp snooping vlan 10
Switch(config)# ip dhcp snooping vlan 10
Switch(config)#

The command is entered in global configuration mode. No output is displayed if successful. The switch now monitors DHCP traffic on VLAN 10 and filters messages based on the DHCP snooping database.

Enable DHCP snooping on multiple VLANs

ip dhcp snooping vlan 10,20,30
Switch(config)# ip dhcp snooping vlan 10,20,30
Switch(config)#

DHCP snooping is enabled on VLANs 10, 20, and 30 simultaneously. The switch will apply DHCP snooping rules to all three VLANs.

Understanding the Output

This command does not produce any output upon successful execution. To verify DHCP snooping is enabled on a VLAN, use 'show ip dhcp snooping'. The output will list each VLAN with its snooping status (Enabled/Disabled).

For example: 'VLAN 10 : DHCP Snooping is Enabled'. If a VLAN is not listed, snooping is not enabled on it. A common issue is forgetting to globally enable DHCP snooping with 'ip dhcp snooping' before enabling it on a VLAN; otherwise, the VLAN command will be accepted but snooping will not function.

Configuration Scenarios

Enable DHCP Snooping on a Single VLAN for a Small Office

A small office has a single VLAN 10 for all user devices. The DHCP server is connected to port Gi0/1 on the switch. The goal is to prevent rogue DHCP servers from assigning IP addresses.

Topology

Switch(Gi0/1)---DHCP Server Switch(Gi0/2)---User PC Switch(Gi0/3)---Rogue DHCP (untrusted)

Steps

  1. 1.Step 1: Enter global configuration mode: Switch# configure terminal
  2. 2.Step 2: Enable DHCP snooping globally: Switch(config)# ip dhcp snooping
  3. 3.Step 3: Enable DHCP snooping for VLAN 10: Switch(config)# ip dhcp snooping vlan 10
  4. 4.Step 4: Configure the port connected to the legitimate DHCP server as trusted: Switch(config)# interface gi0/1; Switch(config-if)# ip dhcp snooping trust
  5. 5.Step 5: Exit and verify: Switch(config-if)# end; Switch# show ip dhcp snooping
Configuration
! Full IOS config block
Switch# configure terminal
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# interface gi0/1
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# end

Verify: Use 'show ip dhcp snooping' to verify that DHCP snooping is enabled on VLAN 10 and that Gi0/1 is trusted. Expected output includes 'DHCP Snooping is enabled' and 'VLAN 10: DHCP Snooping is enabled'.

Watch out: Forgetting to configure the uplink port as trusted will cause the legitimate DHCP server's messages to be dropped, resulting in no IP addresses being assigned.

Enable DHCP Snooping on Multiple VLANs with a Trunk Uplink

A distribution switch connects to multiple access switches via a trunk. The DHCP server is connected to the distribution switch. The goal is to enable DHCP snooping on VLANs 10, 20, and 30 on the access switches to protect against rogue DHCP servers.

Topology

Distribution(Gi0/1)---Trunk---(Gi0/24)Access Access(Gi0/1)---User VLAN 10 Access(Gi0/2)---User VLAN 20 Access(Gi0/3)---User VLAN 30

Steps

  1. 1.Step 1: Enter global configuration mode on the access switch: Access# configure terminal
  2. 2.Step 2: Enable DHCP snooping globally: Access(config)# ip dhcp snooping
  3. 3.Step 3: Enable DHCP snooping for VLANs 10, 20, and 30: Access(config)# ip dhcp snooping vlan 10,20,30
  4. 4.Step 4: Configure the trunk port (Gi0/24) as trusted: Access(config)# interface gi0/24; Access(config-if)# ip dhcp snooping trust
  5. 5.Step 5: (Optional) Configure the DHCP server port on the distribution switch as trusted as well.
  6. 6.Step 6: Exit and verify: Access(config-if)# end; Access# show ip dhcp snooping
Configuration
! Full IOS config block
Access# configure terminal
Access(config)# ip dhcp snooping
Access(config)# ip dhcp snooping vlan 10,20,30
Access(config)# interface gi0/24
Access(config-if)# ip dhcp snooping trust
Access(config-if)# end

Verify: Use 'show ip dhcp snooping' to confirm DHCP snooping is enabled on VLANs 10, 20, and 30. Use 'show ip dhcp snooping binding' to see the dynamic bindings as clients obtain IP addresses.

Watch out: If the trunk port is not trusted, DHCP messages from the legitimate server will be dropped. Also, ensure that the VLANs are allowed on the trunk.

Troubleshooting with This Command

When troubleshooting DHCP snooping, the primary command is `show ip dhcp snooping`. Healthy output shows 'DHCP Snooping is enabled' globally and for the desired VLANs. The trusted ports should be listed under 'Trusted Ports'.

Problem indicators include 'DHCP Snooping is disabled' for a VLAN, or no trusted ports listed. If clients are not receiving IP addresses, check the binding database with `show ip dhcp snooping binding`. An empty database suggests DHCP messages are being dropped.

Use `debug ip dhcp snooping` to see which packets are being filtered. Common symptoms: clients receive APIPA addresses (169.254.x.x) indicating DHCP failure. This often means the DHCP server is on an untrusted port, or the VLAN is not snooped.

Another symptom is a rogue DHCP server handing out addresses; DHCP snooping will drop its offers if the port is untrusted. To correlate, check `show ip dhcp snooping statistics` for packet counts. A high number of 'DHCP server packets dropped' indicates a rogue server.

Also, verify that the DHCP server port is indeed trusted. If using DHCP snooping with DAI, ensure the binding database is populated. Step-by-step: 1) Verify global and VLAN snooping status. 2) Check trusted ports. 3) Examine binding database. 4) Use debug to see real-time filtering. 5) Check statistics for drops.

If the database is not populating, ensure the DHCP server is reachable and the switch can see the DHCPACK messages. Also, ensure the switch has IP routing enabled if the DHCP server is on a different subnet. For issues with DHCP relay, ensure the helper address is configured on the SVI.

CCNA Exam Tips

1.

Remember that 'ip dhcp snooping vlan' must be preceded by the global command 'ip dhcp snooping' to activate snooping.

2.

The exam may test that DHCP snooping is configured per VLAN; you cannot enable it globally without specifying VLANs.

3.

Know that DHCP snooping is typically enabled on access VLANs, not on trunk ports or VLANs containing trusted DHCP servers.

4.

Be aware that DHCP snooping creates a binding database; you must also configure trusted ports for the DHCP server interface.

Common Mistakes

Forgetting to enable DHCP snooping globally with 'ip dhcp snooping' before enabling it on a VLAN.

Enabling DHCP snooping on a VLAN that contains the DHCP server without configuring the server port as trusted.

Using a hyphen instead of a comma when specifying multiple VLANs (e.g., 'vlan 10-20' is invalid; use 'vlan 10,20').

Not verifying that DHCP snooping is enabled on the correct VLANs using 'show ip dhcp snooping'.

ip dhcp snooping vlan [id] vs ip dhcp snooping

Both commands enable DHCP snooping to prevent rogue DHCP servers, but 'ip dhcp snooping' globally activates the feature while 'ip dhcp snooping vlan [id]' applies it to specific VLANs. They are often confused because the global command alone does not start filtering until VLAN-level enablement is added, leading engineers to think they are alternatives rather than complementary.

Aspectip dhcp snooping vlan [id]ip dhcp snooping
ScopeSingle VLANAll VLANs (global feature)
PrerequisiteRequires global snooping enabledNone; enables the feature framework
Effect on trafficFilters DHCP messages on that VLAN onlyEnables snooping globally but no VLAN active until specified
Typical deploymentEnable on untrusted access VLANsEnable first to allow VLAN-level commands

Use ip dhcp snooping vlan [id] when you need to restrict DHCP snooping to specific VLANs, such as only on access ports where untrusted devices connect.

Use ip dhcp snooping when you intend to enable DHCP snooping on any VLAN, as it is a prerequisite for configuring per-VLAN snooping.

Platform Notes

In IOS-XE, the command syntax is identical: `ip dhcp snooping vlan [id]`. However, IOS-XE may have additional options like `ip dhcp snooping information option` for DHCP option 82. The output of `show ip dhcp snooping` is similar but may include additional fields like 'Information option' status.

In NX-OS, the equivalent command is `ip dhcp snooping vlan [id]` under global config, but NX-OS requires the feature to be enabled first with `feature dhcp`. The NX-OS syntax for trusted ports is `ip dhcp snooping trust` on the interface. NX-OS also supports `ip dhcp snooping verify mac-address` to verify client MAC.

For ASA, DHCP snooping is not directly supported; instead, ASA uses DHCP inspection via the `dhcpd` commands. In IOS-XR, DHCP snooping is not available; instead, use `dhcp ipv4 snooping` under the appropriate configuration mode. Between IOS versions, the command has remained consistent from 12.x to 15.x to 16.x, but older versions may lack the `ip dhcp snooping database` feature.

Always ensure the switch supports the feature; it is available on most Catalyst switches. For IOS-XE, the command is supported on Catalyst 2960-X, 3650, 3850, and 9300 series. On NX-OS, it is supported on Nexus 3000, 7000, and 9000 series.

Related Commands

ip dhcp snooping

Enables DHCP snooping globally on the switch to filter untrusted DHCP messages and prevent rogue DHCP server attacks.

ip dhcp snooping trust

Configures an interface as a trusted port for DHCP snooping, allowing DHCP server responses to be forwarded through it.

Practice for the CCNA 200-301

Test your knowledge with practice questions covering all CCNA 200-301 exam domains.

Practice CCNA 200-301 Questions