Using DHCPv4 snooping with option 82

DHCPv4 adds Option 82 (relay information option) to DHCPv4 request packets received on untrusted ports by default. (See “Configuring DHCP Relay” in the management and configuration guide for more information on Option 82.)

When DHCPv4 is enabled globally and also enabled on a VLAN, and the switch is acting as a DHCPv4 relay, the settings for the DHCPv4 relay Option 82 command are ignored when snooping is controlling Option 82 insertion. Option 82 inserted in this manner allows the association of the client’s lease with the correct port, even when another device is acting as a DHCPv4 relay or when the server is on the same subnet as the client.

DHCPv4 snooping only overrides the Option 82 settings on a VLAN that has snooping enabled, not on VLANs without snooping enabled.

If DHCPv4 snooping is enabled on a switch where an edge switch is also using DHCPv4 snooping, it is desirable to have the packets forwarded so the DHCPv4 bindings are learned. To configure the policy for DHCPv4 packets from untrusted ports that already have Option 82 present, enter this command in the global configuration context.


dhcp-snooping option 82 [remote-id <mac|subnet-ip|mgmt-ip>][untrusted-policy<drop|keep|replace>]
no dhcp-snooping option 82 [remote-id <mac|subnet-ip|mgmt-ip>][untrusted-policy<drop|keep|replace>]

Enables DHCP Option 82 insertion in the packet

Sets the value used for the remote-id field of the relay information option.

Uses the switch mac address for the remote-id. This is the default.


Uses the IP address of the VLAN on which the packet was received for the remote-id. If subnet-ip is specified but the value is not set, the MAC address is used.


Uses the management VLAN IP address as the remote-id. If mgmt-ip is specified but the value is not set, the MAC address is used.

Configures DHCPv4 snooping behavior when forwarding a DHCPv4 packet from an untrusted port that already contains DHCPv4 relay information (Option 82). The default is drop.

Drops the packet.


Forwards the packet without replacing the option information.


Replaces the existing option with a new Option 82 generated by the switch.


The default drop policy should remain in effect if there are any untrusted nodes, such as clients, directly connected to this switch.