Users Guide

• Configure peer routing.
OS10(config)# vlt-domain 1
OS10(conf-vlt-1)# peer-routing
DHCP server
VLAN configuration
OS10(config)# interface vlan 100
OS10(conf-if-vl-100)# exit
OS10(config)# interface vlan 200
OS10(conf-if-vl-200)# ip address 10.2.1.2/24
OS10(conf-if-vl-200)# exit
OS10(config)# interface port-channel 20
OS10(conf-if-po-20)# switchport mode trunk
OS10(conf-if-po-20)# switchport trunk allowed vlan 100,200
DHCP server configuration
OS10(config)# ip dhcp server
OS10(config-dhcp)# no disable
OS10(config-dhcp)# pool dell_server1
OS10(config-dhcp-dell_server1)# network 10.1.1.0/24
OS10(config-dhcp-dell_server1)# range 10.1.1.3 10.1.1.250
OS10(config-dhcp-dell_server1)# lease 0 1 0
OS10(config-dhcp-dell_server1)# default-router 10.1.1.1
OS10(config-dhcp)# pool dell_2
OS10(config-dhcp-dell_2)# network 10.2.1.0/24
OS10(config-dhcp-dell_2)# range 10.2.1.4 10.2.1.100
OS10(config-dhcp-dell_2)# lease 0 1 0
Route to reach VLAN 100
OS10(config)#ip route 10.1.1.0/24 10.2.1.1
Verify DHCP snooping on both VLT peers
The following output shows that the DHCP snooping switches (VLT peers) snooped DHCP messages.
OS10# show ip dhcp snooping binding
Number of entries : 1
Codes : S - Static D - Dynamic
IPv4 Address MAC Address Expires(Sec) Type Interface VLAN
=======================================================================================
10.1.1.3 14:18:77:0d:05:e9 3600 D port-channel10 100
Dynamic ARP inspection
Dynamic Address Resolution Protocol (ARP) Inspection (DAI) is a security feature that protects local area networks from man-in-the-
middle ARP spoofing attacks.
When you enable DAI, the switch intercepts ARP packets on DAI-enabled VLANs. The switch then compares the source IP and source
MAC addresses, VLAN, and the interface (physical or port channel) of the received packet with the DHCP snooping binding table. If the
information in the packet does not match any entry in the DHCP snooping binding table, the switch drops the packet.
NOTE:
Dell EMC Networking recommends enabling DAI before enabling DHCP snooping on the system.
DAI violation logging
You can configure the system to log DAI validation failures corresponding to ARP packets. DAI violations are logged at the console if it is
enabled. DAI violation logging is disabled by default.
If you configure an interface as trusted, the switch interprets ARP packets that ingress the interface from hosts as legitimate packets. By
default, all interfaces are in DAI untrusted state.
For DAI to work, enable the DHCP snooping feature on the switch. DAI is disabled by default.
System management
199