Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ACL to Allow only the DHCP Server

Dear All,

I have 3 VLANs (it's an example configration):

1- Vlan 10

     ip address 10.10.10.1 255.255.255.0

     ip helper 10.10.10.15

   Vlan 20

     ip address 20.20.20.1 255.255.255.0

     ip helper 10.10.10.15

   Vlan 30

     ip address 30.30.30.1 255.255.255.0

      ip helper 10.10.10.15

router ospf 1

     network 10.10.10.0 0.0.0.255 area 0

     network 20.20.20.0 0.0.0.255 area 0

     network 30.30.30.0 0.0.0.255 area 0

-------------------------------------------------------------------------

Now I need all clients & network components on VLAN 20 to access everything on VLAN 10.

But for the VLAN 30 clients, I need to access only the DHCP Server on VLAN 10 , and can’t access anything on VLAN 20.

Can I use the ACL to do that? If yes how?

And do I have any other features can help me also?

Thanks,

Mohamed Lotfy

4 REPLIES

Re: ACL to Allow only the DHCP Server

Mohamed,

You can try this:

On vlan 10, you can take the helper address off since the dhcp server resides on  that subnet.

On vlan 30, apply an acl like the following:

access-list 101 permit udp any eq bootpc any eq bootps

access-list 101 deny ip any any

int vlan 30

ip access-group 101 in

The acl only allows dhcp traffic to come in from hosts on the vlan 30, but it doesn't allow them to do anything outside of vlan 30 once they get an address. If you need to allow them to get to hosts in the vlan 10, you'll also need to allow them that and then deny them to vlan 20.

access-list 101 permit udp any eq bootpc any eq bootps

access-list 101 permit ip any 10.10.10.0 0.0.0.255

access-list 101 deny ip any any

Or if you want to allow them everywhere and deny them ONLY to the vlan 20:

access-list deny ip any 20.20.20.0 0.0.0.255

access-list permit ip any any

HTH,

John

Please rate...

HTH, John *** Please rate all useful posts ***
New Member

ACL to Allow only the DHCP Server

Dear Brother John,

relly thank you, it's a very helpful answer from you

thanks again

Lotfy

ACL to Allow only the DHCP Server

Not a problem Thank you for the rating!

HTH, John *** Please rate all useful posts ***
New Member

This post is 3 years old, but

This post is 3 years old, but I'm tossing this up for future reference

To permit | deny just DHCPv4 traffic...

  1. Create an extended ACL with 2 lines.
  2. Use the following parameters to create each statement:
    ► UDP port 67 (That's a DHCP server)
    UDP port 68 (That's a DHCP client)

 

BillTheCat(config)# access-list 173 permit udp 30.30.30.0 0.0.0.255 any eq 67
BillTheCat(config)# access-list 173 permit udp any 30.30.30.0 0.0.0.255 eq 68
BillTheCat(config)# end

(Yes, I know there are 9,003 ways to make this ACL better, but I'll leave that to you...)

► You have the implicit deny at the end, which will block anything that has not been explicitly permitted.

► However, I like to add an explicit deny at the end, so that I can see the stats for it.
(John Blakley also had this in his answer, so hat tip to John)

BillTheCat(config)# access-list 173 permit udp 30.30.30.0 0.0.0.255 any eq 67
BillTheCat(config)# access-list 173 permit udp any 30.30.30.0 0.0.0.255 eq 68

BillTheCat(config)# access-list 173 deny ip any any

BillTheCat(config)# end

(Yes, I know there are 9,002 ways to make this ACL better, but I'll leave that to you...)

► You can use it to debug:

BillTheCat# debug ip packet 173
IP packet debugging is on for access list 173
*IP: s=0.0.0.0 (GigabitEthernet0/1), d=255.255.255.255, len 333, rcvd 2
*IP: s=0.0.0.0 (GigabitEthernet0/1), d=255.255.255.255, len 333, stop process pak for forus packet
*IP: s=30.30.30.1 (local), d=255.255.255.255
(GigabitEthernet0/1), len 328, sending broad/multicast

 

 

► And if you want to see the DHCP activity from 30.30.30.0/24 LAN, you can use:

debug ip dhcp server events

BillTheCat# debug ip dhcp server events
DHCPD: returned 30.30.30.26 to address pool LAN-POO-30
DHCPD: assigned IP address 30.30.30.71 to client
0100.0103.85e9
DHCPD: checking for expired leases.
DHCPD: the lease for address 30.30.30.16 has expired.
DHCPD: returned 30.30.30.16 to address pool LAN-POO-30

 

Well, hope that helps someone in their quest to sort out DHCP traffic...

Cheers!

▬ spammy

 

 

 

44534
Views
25
Helpful
4
Replies
CreatePlease login to create content