DHCP snooping is a switch-level security feature that blocks rogue DHCP servers and protects the network from address assignment attacks. This coverage walks through the full configuration process, including enabling the feature globally, designating trusted ports, setting rate limits, and activating snooping per VLAN.
DHCP Snooping Configuration
Turning on DHCP snooping is going to be really important — not just for those attacks that are happening on your network from hackers, but also for things like if somebody accidentally set up a rogue DHCP server. Not only is it important to guard against these types of attacks, but it's also important to understand how to configure DHCP snooping, because we're going to use that in other mitigation techniques as well, like Dynamic ARP Inspection. So let's go ahead and learn how to configure DHCP snooping on our devices.
Let's learn about the ip dhcp snooping commands. The first thing that I'm going to do is turn IP DHCP snooping on. I do that by getting into the global configuration mode, typing in ip dhcp snooping, and hitting enter. Now it's turned on.
At this point in time all the ports on the switch are untrusted, and so the problem with this is that no ports are going to be able to even accept DHCP server messages. That's going to be a problem, because none of my clients can receive those messages then.
So what I can do is I'm going to trust certain ports. The ports that these messages could be coming in on is this port channel right here into the switch, or this port channel right here into the switch. So what I'm going to do is turn on the trust on those two port channels.
I'm going to get into the interface of — let's do port channel one — and we'll do an ip dhcp snooping trust and hit enter, and now that port channel is trusted. I'm going to do the same thing to the second port channel here, so I'll do port channel two and hit enter, and then I'll trust it as well. So now that one is trusted as well.
Then what I would want to do is, on my interfaces — so I might do a range of interfaces for this next one — I'm going to set up some rate limits so that way there's not too many DHCP messages that could come across those.
I'm going to do an interface range, and let's do fa 0/1 through, let's do 10. In actual production I might want to set this up on any of the access ports, but we're just going to do fa 0/1 through 10. So now I'm in the range, and I can do an ip dhcp snooping limit rate, and then we'll enter in the packets per second, how many packets per second that we're going to accept. Cisco's recommendation is a hundred, so we'll do a hundred to start with and see how that works out. And then we will exit out of there.
The last thing that we need to do is we need to turn this on per VLAN. So I'm going to do an ip dhcp snooping, and it's going to be for VLAN, and then list out the VLANs that we have. So we're going to be 10 — and actually, I don't have nine coming across here — so 10, 20, 50 and 150 are the networks.
There might be some networks that I might not want to include in here. This is the management network, so I don't have DHCP running across any of that anyways, so it's probably maybe a good thing that I turned it on on that. So I may decide that there's some of these I want to turn on, some of these I don't need to turn them on, but for now we'll just go ahead and enter that in and turn them on on all of those.
Then let's do some show commands. So, show ip dhcp snooping. There we see some information about each one of those — they're very limited, and whether they're trusted or not. So we can go through here, we can see these ports right here, so there's some information about the different ports on here.
Next what I can do is do a show ip dhcp snooping binding. This is that binding database, and you can see that it creates the MAC addresses, IP address, the lease time, the type, the VLAN and the interface. So this is the information that goes into the binding database and then gets measured up against to make sure that those messages are legitimate. Once again, we'll be using those in some of the configurations that we do in the future.
But there you have it — not too difficult to set this up. Once again, this is going to be something that's going to be important not just for somebody who is attacking your network, but somebody could set up some equipment on your network which would be handing out IP addresses. Rogue DHCP servers could be set up by accident.
TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.
Explore free tools and programs →