3com 5500-ei pwr Installation Instruction

 

4-5 

client cannot be recorded in the DHCP-snooping table. Consequently, this client cannot pass the IP 

filtering of the DHCP-snooping table, thus it cannot access external networks. 

To solve this problem, the switch supports the configuration of static binding table entries, that is, the 

binding relationship between IP address, MAC address, and the port connecting to the client, so that 

packets of the client can be correctly forwarded.  

If most clients are assigned with static IP addresses, you need to configure an IP static binding for each 

client. The configuration is a heavy workload and causes errors easily. 

To ensure security, in actual networks, clients are usually connected to networks through 802.1x 

authentication. With the authenticated 802.1x client-based IP filtering function enabled, the switch can 

record and query the IP-to-MAC mappings of authenticated 802.1x clients to defend against IP attacks. 

IP filtering can be implemented based on the DHCP-snooping table, IP static binding table, or 

IP-to-MAC mappings of authenticated 802.1x clients, according to actual network requirements. The 

switch can filter IP packets in the following modes:  

z 

Filtering packets based on their source IP addresses. If the source IP address in a packet and the 

number of the port that receives the packet match an entry or mapping, the switch regards the 

packet as a valid packet and forwards it; otherwise, the switch drops it directly.  

z 

Filtering packets based on their source IP and MAC addresses. If the source IP address and 

source MAC address in the packet, and the number of the port that receives the packet match an 

entry or mapping, the switch regards the packet as a valid packet and forwards it; otherwise, the 

switch drops it directly.  

Follow these steps to configure DHCP snooping: 

Enter system view 

— 

Enable DHCP snooping  

Required 

By default, the DHCP snooping 
function is disabled. 

Enter Ethernet port view 

interface interface-type 
interface-number 

— 

Specify the current port as a 
trusted port  

Required 

By default, after DHCP 
snooping is enabled, all ports of 
a switch are untrusted ports.