When Dynamic Host Configuration Protocol (DHCP) snooping is enabled on a FortiSwitch VLAN, which two statements are true? (Choose two answers)

When DHCP snooping is enabled on a FortiSwitch, it acts as a security mechanism to filter DHCP messages. It distinguishes between trusted ports (connected to legitimate DHCP servers) and untrusted ports (connected to end devices). DHCP server replies, such as DHCPOFFER and DHCPACK, are considered valid and are forwarded only if they are received on a trusted port, which prevents rogue DHCP servers on the network. Additionally, FortiSwitch can be configured to insert DHCP Option 82 into client request packets. This option adds circuit-ID and remote-ID information, allowing the DHCP server to identify the client's location (switch and port) for implementing location-aware IP address assignment policies.

B. DHCP snooping is a targeted security feature that inspects and filters only DHCP protocol traffic (UDP ports 67 and 68); it does not block all unicast traffic.

D. DHCP requests originate from clients, which are typically connected to untrusted ports. Dropping requests from trusted ports would disrupt legitimate DHCP relay scenarios. The primary filtering action is on server messages from untrusted ports.

1. FortiSwitchOS 7.4.0 Administration Guide, Page 161, "DHCP snooping" section.

"You can configure a port as trusted or untrusted. A trusted port can forward DHCP replies. An untrusted port will drop DHCP replies." This statement directly supports answer A.

2. FortiSwitchOS 7.4.0 Administration Guide, Page 162, "DHCP option 82" section.

"You can enable the insertion of DHCP option 82 to DHCP packets that are forwarded from an untrusted port." This statement directly supports answer C.

3. Fortinet Knowledge Base, Technical Tip ID: FD40959, "Configuration of DHCP Snooping on FortiSwitch".

This document outlines the configuration and purpose of DHCP snooping, stating, "A trusted interface is an interface that is connected to a DHCP server. An untrusted interface is an interface that is connected to a client." It also provides the CLI command set dhcp-snooping-option82-insertion enable, confirming the functionality of Option 82 insertion.