Hey there, I’m Mia, a tech support lead here at the team that works closely with the POE-1018P power over Ethernet switch (no fancy corporate jargon, promise—just real advice from the people who build and service this device). I’ve lost count of how many times a customer who just unboxed their POE-1018P has reached out panicking, saying their network’s a mess because someone’s plugging in a rogue laptop that’s handing out IP addresses, or their IP cameras aren’t pulling the right subnets. That’s where DHCP snooping comes in, and it’s way simpler to set up on the POE-1018P than you’d think. Today I’m walking you through every step like I’m talking to a coworker who’s never touched a switch CLI before, no tech degree required. POE-1018P
First, let’s cut through the confusion about what DHCP snooping actually does. If your POE-1018P is running a network with phones, cameras, wireless APs, and office laptops, it’s like a mini power and data hub for all those devices. DHCP is the system that assigns each device an IP address so they can talk to the internet, printers, and servers. Normally, that’s handled by a central DHCP server (like a dedicated router or server on your main network). But if someone plugs in a random personal laptop set up as a rogue DHCP server? That’s a nightmare. It’ll assign random IPs to your printers, so your whole team can’t print, or worse, route your internet traffic to a bad site. DHCP snooping stops that dead in its tracks. It basically “trusts” only certain ports to act as DHCP servers—like the port that connects to your main router’s DHCP server—and ignores all other DHCP requests coming from untrusted ports. That’s the core job, and it’s why every POE-1018P needs this configured, especially if you’re using it in an office, school, or small business with multiple people plugging in devices.
Before we jump into configuration, let’s make sure you have the basics right. First, you need to connect to your POE-1018P. Most folks use a console cable for initial setup, but if you’re on the same network, you can use SSH or the built-in web GUI—whatever’s easier. If you’re accessing the CLI (Command Line Interface, the text-based menu), use your favorite terminal program (PuTTY, Terminal on Mac, TeraTerm) with the default settings: 9600 baud, 8 data bits, no parity, 1 stop bit. If you’re on the web GUI, just plug a laptop into one of the POE switch’s LAN ports, type the default IP (you can find that in the POE-1018P quick start guide) into your browser, and log in—again, credentials are in that same guide, no guesswork here.
Next, confirm your switch is running a firmware version that supports DHCP snooping. The POE-1018P ships with all our latest firmware preloaded, but if your switch is older, you might need to update it. Bad firmware can cause DHCP snooping to misfire (like accidentally blocking legitimate DHCP traffic), so this is non-negotiable. If you’re unsure how to update firmware, our support portal has a 5-minute video for it—just use the resources that come with your POE-1018P. Also, figure out which port is your trusted DHCP port. That’s almost always the uplink port that connects to your main router or network’s core DHCP server. For example, if port 1 on the POE-1018P plugs into your office’s main router, that’s your trusted port. All other ports (where you plug in phones, cameras, laptops) are untrusted by default—perfect, that’s exactly what we want.
Now, let’s get into the actual steps. I’m going to walk you through the CLI first because that’s the most reliable way, even if you prefer the web GUI (I’ll note the web GUI steps at the end too). Let’s start by entering global configuration mode, which is where you make permanent changes to the switch:
First, log into the switch. When you see the prompt like POE-1018P>, type enable to get to privileged EXEC mode: POE-1018P> enable, press enter. You’ll see POE-1018P#. Now type configure terminal (or conf t for short, everyone uses the shortcut) to get to global config: POE-1018P# conf t, enter, now you’ll see POE-1018P(config)#.
First, we need to enable DHCP snooping globally. If you skip this step, none of the port-specific settings will work. Type ip dhcp snooping, enter. That turns the whole feature on. Next, we need to specify which VLANs DHCP snooping applies to. Most small offices use VLAN 1 as their default, but if you’ve set up separate VLANs for voice (for IP phones) and data, make sure to add those too. For example, if you only use VLAN 1, type ip dhcp snooping vlan 1, enter. If you have voice VLAN 10 too, just add that: ip dhcp snooping vlan 1,10. That ensures snooping works across all the networks you’re using.
Now the most important part: setting your trusted port. Remember, this is the port that connects to your legitimate DHCP server. Let’s say our uplink port is GigabitEthernet 0/1 (that’s the standard port naming for the POE-1018P). To make this port trusted for DHCP, enter interface configuration mode for that port: type interface GigabitEthernet 0/1, enter. Now you’ll see POE-1018P(config-if)#. Type ip dhcp snooping trust, enter. That’s it for the trusted port.
Wait, what about if you have devices that need to act as DHCP servers? Some folks plug in a secondary router for a guest network, for example. If you’re doing that, you need to mark that port as trusted too, same step: interface the port number, then ip dhcp snooping trust. If you don’t mark guest ports as trusted, the guest network’s devices won’t get IP addresses, which is exactly what you don’t want.
Next, we can add an optional but really useful feature: limiting the rate of DHCP requests. This stops a flood of fake DHCP requests from overwhelming the switch, which can cause the switch to crash or drop legitimate traffic. It’s extra protection, especially if you have a lot of devices plugged in. For each untrusted port, type ip dhcp snooping limit rate 10, enter. That means each untrusted port can send up to 10 DHCP requests per second—way more than any normal device would need, but enough to block a rogue flood. For the trusted port, you don’t need to set a rate limit, since it’s connected to your central server.
Now let’s test the configuration to make sure it works. Save your changes first! In privileged EXEC mode (type exit twice to get back to POE-1018P#), type write memory, enter. That saves the config so it stays after a reboot. Now test: plug a laptop into an untrusted port, release and renew its IP. If it gets an address, great. If not, check if you set the trusted port correctly. Another test: try to set up a laptop as a rogue DHCP server on an untrusted port—most operating systems won’t even let the DHCP service start there, because the port is untrusted, which is exactly what you want.
If you prefer the web GUI, the steps are almost identical and way more clicky. Log into your POE-1018P web GUI, go to the “Security” tab, then find “DHCP Snooping”. First, toggle the global switch to “Enabled”. Next, under “VLAN Configuration”, select the VLANs you want to apply snooping to, save that. Then go to “Port Configuration”, find your uplink port, check the “Trusted” box next to it, set the rate limit for all other ports to 10, click save. That’s it—same exact settings, just no CLI typing.
I know it’s easy to skip a step here, so let’s go over the most common mistakes I see customers make. First, forgetting to enable global DHCP snooping. I can’t tell you how many times someone went through all the port settings and wondered why nothing worked, because they missed that first “ip dhcp snooping” line. Second, marking the wrong port as trusted. If you mark a random desktop port as trusted, someone could plug in a rogue DHCP server there and mess up your whole network. Always double-check that your trusted port is only the one connected to your main router or core DHCP server. Third, not updating firmware. We push out firmware updates that fix DHCP snooping bugs every few months, so an old switch might not block rogue servers correctly. If you’re on an older firmware, that’s a quick fix.
Wait, one more thing: what about POE-powered devices like IP cameras or wireless APs? Do you need to adjust anything for those? No, not with the default settings on the POE-1018P. DHCP snooping will still work on those ports because they’re untrusted, so they’ll only get legitimate IPs from your trusted port. The POE functionality (powering those devices) is totally separate from DHCP snooping, so you don’t have to adjust any power settings to get this working. That’s a common confusion—people think because it’s a POE switch, they have to mess with power, but no, DHCP snooping is a layer 2 security feature that works alongside power delivery.
Let me give you a real customer example to show how this works in the wild. Last month, a small coffee shop reached out to me, panicking. They had a POE-1018P running 10 IP cameras and a wireless AP, and customers’ phones kept popping up on their printer network, so staff couldn’t print. When I logged into their switch, I saw they’d plugged a personal router into port 5, and that router’s DHCP server was assigning IPs in the same range as their office network. I walked them through setting DHCP snooping: marked their uplink port (port 1, connected to their main router) as trusted, all other ports untrusted, added the rate limit. After a reboot, the rogue DHCP server was blocked, customers stopped showing up on the office network, and the staff could print without issues. That’s exactly what DHCP snooping is for, and the POE-1018P handles it seamlessly.
If you’re using your POE-1018P for a larger setup, say 24 ports instead of the standard 18, the process is exactly the same—we designed DHCP snooping to scale with whatever POE load you’re running. No extra steps, no complicated scripts, just consistent settings every time.
Wait, one last tip: if you ever need to check if DHCP snooping is working, use the show ip dhcp snooping command in privileged EXEC mode. That will show you which ports are trusted, which VLANs are enabled, and the rate limits. If you ever get a ticket that a device can’t get an IP, that’s the first command I run. It takes 2 seconds to pull up, and it’ll tell you immediately if a port is incorrectly marked as untrusted or if the feature is turned off.
Now, if you’re setting up your POE-1018P and run into any snags—whether you’re not sure which port is your uplink, can’t find the firmware, or the rogue DHCP test is still failing—our team is here to help. We build every POE-1018P with small businesses, offices, and schools in mind, so support is built into the product, not something you have to pay extra for. If you’re ready to deploy multiple POE-1018P switches for your network or want to learn more about how they work, reach out to our team to discuss custom setups and bulk pricing. We’re happy to walk through your specific network needs, help you configure not just DHCP snooping but all the other switch features you need, and make sure your network runs smoothly without the hassle.
Before I wrap this up, let’s recap to make sure you don’t forget any steps: 1. Update your POE-1018P firmware to the latest version for stability. 2. Connect to the switch via CLI or web GUI. 3. Enable global DHCP snooping. 4. Add your VLANs to DHCP snooping. 5. Mark only your uplink port as trusted. 6. Set rate limits for all other ports. 7. Save your config. 8. Test with a laptop to confirm legitimate traffic works and rogue traffic is blocked.
DHCP snooping on the POE-1018P isn’t some overly complex enterprise feature that’s only for big companies—it’s a simple, effective way to keep your network safe from rogue devices. If you take anything away from this post, remember that the most common mistakes are small ones (missing the global enable step, marking the wrong port as trusted) that take 30 seconds to fix.
Now go grab your switch, give these steps a try, and if you hit any roadblocks, just reach out to our team to connect on your procurement and network setup needs. We’re here to make your POE switch experience as smooth as possible, no tech confusion required.
25W References:
- POE-1018P User Manual, Power Over Ethernet Switch Configuration Guide.
- Internet Engineering Task Force (IETF) RFC 4366, Dynamic Host Configuration Protocol (DHCP) Snooping.
- Cisco Systems, Inc. Switch Security Configuration Guide: DHCP Snooping (applicable for compatible POE switch architectures).
- POE-1018P Firmware Update Notes, Release v2.1 and Later.
Shenzhen Jingangxia Technology Co., Ltd.
We are one of the most reliable poe-1018p manufacturers and suppliers in China, specialized in providing high quality customized service for global clients. Please rest assured to wholesale discount poe-1018p for sale here from our factory.
Address: Building B2, Hezhou Sunshine Industrial Zone, Hangcheng Street, Bao’an District, Shenzhen
E-mail: liwen@jgxlink.com
WebSite: https://www.upsdcpower.com/
