The switch-controller-dhcp-snooping-verify-mac command is a security feature designed to mitigate DHCP starvation/exhaustion attacks. It accomplishes this by verifying that the source MAC address of the Ethernet frame matches the client hardware address (CHADDR) field within the DHCP request payload, dropping mismatched packets.

Configuration settings for DHCP Option 82, which allows a relay agent to insert circuit-specific information into DHCP requests, are not available in the FortiGate GUI for managed FortiSwitches. These settings, such as enabling Option 82 insertion or trusting incoming Option 82 data, must be configured through the command-line interface (CLI).

A. DHCP snooping restricts DHCP traffic. It forwards client requests received on untrusted ports only to trusted ports where legitimate DHCP servers are connected, not to all servers.

C. By default, all ports are untrusted. DHCP requests from clients on these untrusted ports are forwarded only to trusted ports, not to other untrusted ports.

1. FortiGate CLI Reference 7.6.0, Page 2018, config switch-controller dhcp-snooping.

The documentation for verify-mac states: "Enable/disable verification of source MAC address in DHCP request packets to filter out invalid packets." This confirms the command's purpose is to validate MAC addresses to prevent attacks like DHCP exhaustion, supporting the intent of option B.

The same section lists multiple CLI-only settings for Option 82, such as set dhcp-option82-insertion enable, set dhcp-option82-circuit-id, and set dhcp-option82-remote-id, confirming that these settings are configured via CLI, which supports option D.

2. FortiSwitchOS 7.4.0 Administration Guide, Page 113, "DHCP snooping".

The guide states: "When you enable DHCP snooping on a VLAN, all ports are untrusted by default. You must configure which ports are trusted." and "DHCP client requests are only forwarded on trusted ports." This directly refutes options A and C.