Configure DHCP-snooping static entries 7.2.4

After you enable DHCP snooping for a VLAN, you can configure static entries by binding an IPv4 address with a MAC address for a specific switch interface:

• Specify a VLAN that has DHCP snooping enabled. The VLAN must be a native VLAN or allowed VLAN for the port.

• Specify a port that is not defined as trusted.

• Specify the MAC address in the form of xx:xx:xx:xx:xx:xx.

• Bind a single MAC address to a single IPv4 address. Multiple IP addresses cannot be bound to the same MAC address. The MAC address cannot be used in more than one static entry. Duplicate static entries are not supported on a VLAN.

DHCP-snooping static entries must be configured to be able to use dynamic ARP inspection (DAI) for IP/MAC entries not discovered by DHCP snooping.

Specifying the VLAN, IP address, MAC address, and interface name is required.

You can specify a maximum of 64 DHCP static entries for the entire FortiSwitch unit.

You cannot use a DHCP trusted switch interface or an 802.1X interface for the static entryʼs switch interface. After you configure a DHCP-snooping static entry for a VLAN, you cannot remove that VLAN from the switch interface. After you configure a DHCP-snooping static entry for a switch interface, the switch interface cannot be included as a member of a trunk until the DHCP-snooping static entry is deleted. If you configure a DHCP-snooping static entry for a trunk, the trunk cannot be deleted until the DHCP-snooping static entry is deleted.

To create a static entry for DHCP snooping and DAI:

config switch-controller managed-switch

edit <FortiSwitch_serial_number>

config dhcp-snooping-static-client

edit <DHCP_static_client_name>

set vlan <VLAN_ID>

set ip <DHCP_static_client_static_IP_address>

set mac <DHCP_static_client_MAC_address>

set port <interface_name>

next

next

end

For example:

config switch-controller managed-switch

edit S524DN4K16000116

config dhcp-snooping-static-client

edit DHCPclient

set vlan 100

set ip 192.168.101.1

set mac 00:21:cc:d2:76:72

set port port19

next

next

end