Configure DHCP-snooping static entries 7.2.4
After you enable DHCP snooping for a VLAN, you can configure static entries by binding an IPv4 address with a MAC address for a specific switch interface:
-
Specify a VLAN that has DHCP snooping enabled. The VLAN must be a native VLAN or allowed VLAN for the port.
-
Specify a port that is not defined as trusted.
-
Specify the MAC address in the form of xx:xx:xx:xx:xx:xx.
-
Bind a single MAC address to a single IPv4 address. Multiple IP addresses cannot be bound to the same MAC address. The MAC address cannot be used in more than one static entry. Duplicate static entries are not supported on a VLAN.
|
DHCP-snooping static entries must be configured to be able to use dynamic ARP inspection (DAI) for IP/MAC entries not discovered by DHCP snooping. |
Specifying the VLAN, IP address, MAC address, and interface name is required.
You can specify a maximum of 64 DHCP static entries for the entire FortiSwitch unit.
|
|
To create a static entry for DHCP snooping and DAI:
config switch-controller managed-switch
edit <FortiSwitch_serial_number>
config dhcp-snooping-static-client
edit <DHCP_static_client_name>
set vlan <VLAN_ID>
set ip <DHCP_static_client_static_IP_address>
set mac <DHCP_static_client_MAC_address>
set port <interface_name>
next
next
end
For example:
config switch-controller managed-switch
edit S524DN4K16000116
config dhcp-snooping-static-client
edit DHCPclient
set vlan 100
set ip 192.168.101.1
set mac 00:21:cc:d2:76:72
set port port19
next
next
end