Understanding Trusted and Untrusted Ports for DHCP Servers
Trusted ports allow DHCP servers to provide IP addresses and other configuration information to the network’s DHCP clients. By default, all trunk ports are trusted for DHCP.
Untrusted ports drop traffic from DHCP servers to prevent unauthorized servers from providing any configuration information to clients. By default, all access ports are untrusted for DHCP.
You can configure an override of the default behavior to set a trunk port as untrusted, which blocks all ingress DHCP server messages from that interface. This is useful for preventing a rogue DHCP server attack, in which an attacker has introduced an unauthorized server into the network. The information provided to DHCP clients by this server has the potential to disrupt their network access. The unauthorized server might also assign itself as the default gateway device for the network. An attacker can then sniff the network traffic and perpetrate a man-in-the-middle attack—that is, it misdirects traffic intended for a legitimate network device to a device of its choice.
You can also configure an access port as trusted. If you attach a DHCP server to an access port, you must configure the port as trusted. Before you do so, ensure that the server is physically secure—that is, that access to the server is monitored and controlled.