A DHCP client broadcasts a DHCP Discover message. When there are multiple DHCP servers including bogus DHCP servers on a network segment, the DHCP client accepts only the first received DHCP Offer message and therefore may obtain an unexpected IP address from a bogus DHCP server. To ensure that a client obtains an IP address from the correct DHCP server, configure DHCP snooping.
Configure DHCP snooping for wired users.
When the downstream wired port of the AP is directly connected to a wired terminal, run the learn-client-address enable command in the AP wired port profile and apply the profile to the downstream wired port of the AP. This command enables the function of learning IPv4/IPv6 addresses of the STAs connected to the downstream wired port. In addition, the DHCP snooping function is associated to be enabled on the downstream wired port. By default, the AP's upstream ports including physical ports and CAPWAP ports are DHCP trusted ports, and you do not need to change the default configurations of the AP's upstream ports.
You can run the display dhcp snooping configuration command on the AP to check the ports where the dhcp snooping enable or dhcp snooping trusted command has been configured. (The dhcp snooping enable command cannot be directly run on the AP and needs to be delivered by the AC.)
DHCP snooping is enabled for wireless users by default.
By default, the function of learning IPv4/IPv6 addresses of wireless STAs and the DHCP snooping function are enabled on the AP's wireless ports, and the AP's upstream ports including physical ports and CAPWAP ports are DHCP trusted ports.
When receiving DHCP packets from a DHCP client or DHCP server, a DHCP snooping-enabled Fit AP records DHCP/6/SNP_RCV_MSG logs. You need to configure the Fit AP to send logs to the log host before viewing the DHCP/6/SNP_RCV_MSG logs on the log host. Ensure that the Fit AP and log host are routable to each other.