Enabling Dhcp Snooping On Private Vlan - Cisco 4500M Software Manual

Chapter 33 Configuring DHCP Snooping and IP Source Guard
Switch(config)# end
Switch# show ip dhcp snooping
Switch DHCP snooping is enabled.
DHCP Snooping is configured on the following VLANs:
Insertion of option 82 information is enabled.
Interface
---------
FastEthernet2/1
FastEthernet2/2
FastEthernet3/1
GigabitEthernet5/1
Switch#
The following configuration describes the DHCP snooping configuration steps if routing is defined on
another Catalyst switch (for example, a Catalyst 6500 series switch):
// Trust the uplink gigabit Ethernet trunk port
interface range GigabitEthernet 1/1 – 2
switchport mode trunk
switchport trunk encapsulation dot1q
ip dhcp snooping trust
!
interface VLAN 14
ip address 10.33.234.1 255.255.254.0
ip helper-address 10.5.1.2
If you are enabling trunking on uplink gigabit interfaces, and the above routing configuration is defined
Note
on a Catalyst 6500 series switch, you must configure the "trust" relationship with downstream DHCP
Snooping (on a Catalyst 4500 series switch) which adds Option 82. On a Catalyst 6500 series switch,
this task is accomplished with ip dhcp relay information trusted VLAN configuration command.

Enabling DHCP Snooping on Private VLAN

DHCP snooping can be enabled on private VLANs, which provide isolation between Layer 2 ports
within the same VLAN. If DHCP snooping is enabled (or disabled), the configuration is propagated to
both the primary VLAN and its associated secondary VLANs. You cannot enable (or disable) DHCP
snooping on a primary VLAN without reflecting this configuration change on the secondary VLANs.
Configuring DHCP snooping on a secondary VLAN is still allowed, but it will not take effect if the
associated primary VLAN is already configured. If the associated primary VLAN is configured, the
effective DHCP snooping mode on the secondary VLAN is derived from the corresponding primary
VLAN. Manually configuring DHCP snooping on a secondary VLAN will cause the switch to issue this
warning message:
DHCP Snooping configuration may not take effect on secondary vlan XXX
The show ip dhcp snooping command will display all VLANs (both primary and secondary) that have
DHCP snooping enabled.
OL-6696-01
10-100
Trusted
-------
yes
yes
no
yes
Rate limit (pps)
----------------
100
none
20
none
Software Configuration Guide—Release 12.2(25)EW
Configuring DHCP Snooping on the Switch
33-5