dhcp-security
Syntax
dhcp-security {
arp-inspection;
dhcpv6-options {
light-weight-dhcpv6-relay;
option-16 {
use-string string;
}
option-18 {
prefix {
host-name;
logical-system-name;
routing-instance-name;
vlan-id;
vlan-name;
}
use-interface-mac;
use-interface-index (device | logical);
use-interface-description (device | logical);
use-interface-name (device | logical);
use-string string;
}
option-37{
prefix {
host-name;
logical-system-name;
routing-instance-name;
vlan-id;
vlan-name;
}
use-interface-mac;
use-interface-index (device | logical);
use-interface-description (device | logical);
use-interface-name (device | logical);
use-string string;
}
option-79;
}
group group-name {
interface interface-name {
static-ip ip-address {
mac mac-address;
}
static-ipv6 ip-address {
mac mac-address;
}
}
overrides {
no-dhcpv6-options;
no-option16;
no-option18;
no-option37;
no-option82;
trusted;
untrusted;
}
}
ip-source-guard;
ipv6-source-guard;
mine-dhcp-client-options;
mine-dhcpv6-client-options;
neighbor-discovery-inspection;
no-dhcp-snooping;
no-dhcpv6-snooping;
option-82 {
circuit-id {
prefix {
host-name;
logical-system-name;
routing-instance-name;
}
use-interface-description (device | logical);
use-vlan-id;
}
remote-id {
host-name hostname;
use-interface-description (device | logical);
mac;
use-string string;
}
vendor-id {
use-string string;
}
}
}
Hierarchy Level
[edit vlans vlan-name forwarding-options]
Description
Configure DHCP or DHCPv6 snooping on the switch. DHCP snooping is also enabled automatically if you configure any of the following port security features within this hierarchy:
Dynamic ARP inspection (DAI)
IP source guard
DHCP option 82
Static IP
For switches that support DHCPv6, both DHCP snooping and DHCPv6 snooping are enabled automatically if you configure any of the afore-mentioned features or any of the following IPv6 features:
IPv6 neighbor discovery inspection
IPv6 source guard
Static IPv6
The remaining statements are explained separately.
Required Privilege Level
interface—To view this statement in the configuration.
interface-control—To add this statement to the configuration.
Release Information
Statement introduced in Junos OS Release 13.2X50-D10 .
Support for static-ipv6,
neighbor-discovery-inspection,
ipv6-source-guard, no-dhcpv6-snooping, and
no-option37 introduced in Junos OS Release 13.2X51-D20 for EX
Series switches.
Support for dhcpv6-options, option-16,
option-18, option-37,
no-dhcpv6-options, no-option16,
no-option18, and no-option37 introduced in
Junos OS Release 14.2 for EX Series switches.
Support for mine-dhcp-client-options and
mine-dhcpv6-client-options introduced in Junos OS Release
23.1.