ZyXEL Communications GS3700 Series Uživatelská příručka stáhnout pdf (Strana 223)

Chapter 24 IP Source Guard

GS3700/XGS3700 Series User’s Guide

223

Trusted ports are connected to DHCP servers or other switches. The Switch discards DHCP packets

from trusted ports only if the rate at which DHCP packets arrive is too high. The Switch learns

dynamic bindings from trusted ports.

Note: The Switch will drop all DHCP requests if you enable DHCP snooping and there are

no trusted ports.

Untrusted ports are connected to subscribers. The Switch discards DHCP packets from untrusted

ports in the following situations:

• The packet is a DHCP server packet (for example, OFFER, ACK, or NACK).

• The source MAC address and source IP address in the packet do not match any of the current

bindings.

• The packet is a RELEASE or DECLINE packet, and the source MAC address and source port do not

match any of the current bindings.

• The rate at which DHCP packets arrive is too high.

24.1.1.2 DHCP Snooping Database

The Switch stores the binding table in volatile memory. If the Switch restarts, it loads static

bindings from permanent memory but loses the dynamic bindings, in which case the devices in the

network have to send DHCP requests again. As a result, it is recommended you configure the DHCP

snooping database.

The DHCP snooping database maintains the dynamic bindings for DHCP snooping and ARP

inspection in a file on an external TFTP server. If you set up the DHCP snooping database, the

Switch can reload the dynamic bindings from the DHCP snooping database after the Switch

restarts.

You can configure the name and location of the file on the external TFTP server. The file has the

following format:

Figure 132 DHCP Snooping Database File Format

The <initial-checksum> helps distinguish between the bindings in the latest update and the

bindings from previous updates. Each binding consists of 72 bytes, a space, and another checksum

that is used to validate the binding when it is read. If the calculated checksum is not equal to the

checksum in the file, that binding and all others after it are ignored.

<initial-checksum>

TYPE DHCP-SNOOPING

VERSION 1

BEGIN

<binding-1> <checksum-1>

<binding-2> <checksum-1-2>

...

<binding-n> <checksum-1-2-..-n>

END

1 2 ... 218 219 220 221 222 223 224 225 226 227 228 ... 415 416

Žádné komentáře

ZyXEL Communications GS3700 Series Uživatelská příručka Strana 223