Trusted server paths and client bindings
DHCP snooping checks DHCP messages as they enter a switch port in a protected VLAN. A client-facing untrusted port can carry legitimate client requests, but server replies arriving there are dropped. Server replies are expected through a configured trusted path toward the authorized server or relay.
When a DHCP lease is granted to a client on an untrusted port, the switch can learn an IP address, MAC address, VLAN, port and lease lifetime. Dynamic ARP Inspection and IP Source Guard can use that binding. A host with a manually assigned IP address will need another approved source of binding information for those checks.
Try it in a lab
- Place a DHCP client on an untrusted lab port and the authorized server behind a trusted port. Renew the lease and verify the client’s IP, MAC, VLAN and interface in the binding table.
- In the same isolated lab, connect a second DHCP server to an untrusted port. Verify that its offers do not reach the client and that the authorized server still works.