Users Guide

Layer 2 Switching Commands 385
Logging invalid messages can use valuable CPU resources if the switch
receives such messages at a high rate. To avoid allowing the switch to be
vulnerable to a DoS attack, DHCP snooping only logs invalid messages if the
user has enabled logging. Logging is enabled on individual interfaces so that
only messages on interfaces of interest are logged. To further protect the
system, invalid message logging is rate limited to 1 per second.
ipv6 dhcp snooping trust
Use the ipv6 dhcp snooping trust command to configure an interface as
trusted. Use the no form of the command to return the interface to the
default configuration.
Syntax
ipv6 dhcp snooping trust
no ipv6 dhcp snooping trust
Default Configuration
By default, interfaces are untrusted.
Command Modes
Interface Configuration mode (Ethernet and port-channel)
User Guidelines
Configuring an interface as trusted disables DHCP snooping address
validation checking and exposes the port to IPv6 DHCP DoS attacks.
DHCP snooping must be enabled globally and on the VLAN for which the
port is a member for this command to have an effect. Configuring a port as
trusted indicates that the port is connected to an IPv6 DHCP server or to a
trusted device. Configuring a port as untrusted indicates that the switch
should firewall IPv6 DHCP messages and act as if the port is connected to an
untrusted device.
Use the ipv6 verify source command to disable traffic from untrusted sources
on an interface.