Enabling Dhcp Snooping On Private Vlan - Cisco Catalyst 4500 Series Configuration Manual

Configuring DHCP Snooping
This example shows how to configure the Option 82 circuit-ID override suboption:
Switch(config-if)# ip dhcp snooping vlan 250 information option format-type circuit-id
override string testcustomer

Enabling DHCP Snooping on Private VLAN

DHCP snooping can be enabled on private VLANs, which provide isolation between Layer 2 ports
within the same VLAN. If DHCP snooping is enabled (or disabled), the configuration is propagated to
both the primary VLAN and its associated secondary VLANs. You cannot enable (or disable) DHCP
snooping on a primary VLAN without reflecting this configuration change on the secondary VLANs.
Configuring DHCP snooping on a secondary VLAN is still allowed, but it does not take effect if the
associated primary VLAN is already configured. If the associated primary VLAN is configured, the
effective DHCP snooping mode on the secondary VLAN is derived from the corresponding primary
VLAN. Manually configuring DHCP snooping on a secondary VLAN causes the switch to issue this
warning message:
DHCP Snooping configuration may not take effect on secondary vlan XXX
The show ip dhcp snooping command displays all VLANs (both primary and secondary) that have
DHCP snooping enabled.
Configuring DHCP Snooping on Private VLAN
DHCP snooping, IPSG, and DAI are Layer 2-based security features that can be enabled and disabled
on an individual VLAN, including auxiliary or voice VLAN. You need to enable DHCP snooping on a
voice VLAN for a Cisco IP phone to function properly.
Configuring DHCP Snooping with an Ethernet Channel Group
When you configure DHCP snooping, you need to configure trunk interfaces that transmit DHCP packets
as trusted interfaces by adding ip dhcp snooping trust to the physical interface configuration. However,
if DHCP packets will be transmitted over an Ethernet channel group, you must configure
ip dhcp snooping trust on the logical port channel interface, for example:
Switch# show run int port-channel50
Building configuration...
Current configuration : 150 bytes
!
interface Port-channel50
switchport
switchport trunk native vlan 4092
switchport mode trunk
switchport nonegotiate
ip dhcp snooping trust
end
Switch#
Software Configuration Guide—Release IOS XE 3.3.0SG and IOS 15.1(1)SG
50-12
Chapter 50 Configuring DHCP Snooping, IP Source Guard, and IPSG for Static Hosts
OL-25340-01