Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

DHCP ACCESS

hi ,

           i have a dhcp server 2008r2 with ip 172.20.1.5 in vlan 3. wanted it give out IPs to vlan 2 and 6. when i apply the access as shown in the config , it does not work. i then tried adding the access list ip access-group 102 out later on to check, but still not working. it works fine without any access list in vlan 2.   will be very helpful to have your guidance in setting it up..

also vlan 2 and 6 need full access to vlan 3...   plzzz help out..

!

version 12.2

no service pad

service timestamps debug datetime msec

service timestamps log datetime msec

no service password-encryption

!

hostname L3-CORE

!

boot-start-marker

boot-end-marker

!

!

!

!

no aaa new-model

system mtu routing 1500

authentication mac-move permit

ip subnet-zero

ip routing

ip dhcp relay information trust-all

!

!

!

!

!

spanning-tree mode pvst

spanning-tree etherchannel guard misconfig

spanning-tree extend system-id

!

!

!

!

vlan internal allocation policy ascending

!

!

!

interface FastEthernet0

no ip address

no ip route-cache cef

no ip route-cache

shutdown

!

interface GigabitEthernet0/1

!

interface GigabitEthernet0/2

!

interface GigabitEthernet0/3

!

interface GigabitEthernet0/4

!

interface GigabitEthernet0/5

switchport access vlan 3

switchport mode access

!

interface GigabitEthernet0/6

switchport access vlan 2

switchport mode access

!

interface GigabitEthernet0/7

!

interface GigabitEthernet0/8

!

interface GigabitEthernet0/9

!

interface GigabitEthernet0/10

!

interface GigabitEthernet0/11

!

interface GigabitEthernet0/12

!

interface GigabitEthernet0/13

!

interface GigabitEthernet0/14

!

interface GigabitEthernet0/15

!

interface GigabitEthernet0/16

!

interface GigabitEthernet0/17

!

interface GigabitEthernet0/18

!

interface GigabitEthernet0/19

!

interface GigabitEthernet0/20

!

interface GigabitEthernet0/21

!

interface GigabitEthernet0/22

!

interface GigabitEthernet0/23

!

interface GigabitEthernet0/24

switchport trunk encapsulation dot1q

switchport trunk allowed vlan 2-12

!

interface GigabitEthernet1/1

!

interface GigabitEthernet1/2

!

interface GigabitEthernet1/3

!

interface GigabitEthernet1/4

!

interface TenGigabitEthernet1/1

!

interface TenGigabitEthernet1/2

!

interface Vlan1

no ip address

shutdown

!

interface Vlan2

ip address 172.20.0.1 255.255.255.0

ip access-group 100 in

ip access-group 102 out

ip helper-address 172.20.1.5

!

interface Vlan3

ip address 172.20.1.1 255.255.255.128

ip helper-address 172.20.1.5

!

interface Vlan4

ip address 172.20.1.129 255.255.255.128

!

interface Vlan5

ip address 172.20.2.1 255.255.255.128

!

interface Vlan6

ip address 172.20.2.129 255.255.255.128

ip access-group 101 in

ip helper-address 172.20.2.129

!

interface Vlan7

ip address 172.20.3.1 255.255.255.128

!

interface Vlan8

ip address 172.20.3.129 255.255.255.128

!

interface Vlan9

ip address 172.20.4.1 255.255.255.128

!

interface Vlan10

ip address 172.20.4.129 255.255.255.128

!

interface Vlan11

ip address 172.20.5.1 255.255.255.0

!

interface Vlan12

ip address 172.20.6.1 255.255.255.128

!

ip classless

ip http server

ip http secure-server

!

ip sla enable reaction-alerts

access-list 100 permit ip any 172.20.1.0 0.0.0.127

access-list 100 permit udp any host 172.20.1.5

access-list 100 permit udp any 172.20.1.0 0.0.0.127

access-list 100 permit ip any host 172.20.0.1

access-list 100 deny   ip any any

access-list 101 permit ip any 172.20.1.0 0.0.0.127

access-list 101 permit ip any host 172.20.2.129

access-list 101 deny   ip any any

access-list 102 permit ip 172.20.1.0 0.0.0.127 any

access-list 102 permit udp 172.20.1.0 0.0.0.127 any

!

!

line con 0

line vty 5 15

!

end

1 ACCEPTED SOLUTION

Accepted Solutions

Re: DHCP ACCESS


Hi.
In you access-list 101 and 102 you need to add
permit udp any any eq bootpc
permit udp any any eq bootps
In access-list 100
permit udp any eq bootpc any
permit udp any eq bootps any

HTH
Regards

Carlo

Sent from Cisco Technical Support iPhone App

Sent from Cisco Technical Support iPhone App
Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
5 REPLIES

Re: DHCP ACCESS


Hi.
In you access-list 101 and 102 you need to add
permit udp any any eq bootpc
permit udp any any eq bootps
In access-list 100
permit udp any eq bootpc any
permit udp any eq bootps any

HTH
Regards

Carlo

Sent from Cisco Technical Support iPhone App

Sent from Cisco Technical Support iPhone App
Sent from Cisco Technical Support iPhone App

Please rate all helpful posts "The more you help the more you learn"
Community Member

Re: DHCP ACCESS

hi carlo thanks a lot for replying.

                     after i posted this, i tried changing the 100 acl as below and it worked..

access-list 100 permit ip any 172.20.1.0 0.0.0.127

access-list 100 permit host 0.0.0.0 host 255.255.255.255

access-list 100 permit ip any host 172.20.0.1

access-list 100 deny   ip any any

because the client does not have any ip address initially..  hope this helps many other sout there.

have a nice day..

DHCP ACCESS

For DHCP to work, you need to have the ip helper-address command on each vlan interface, pointing to the DHCP server. VLAN 6 is incorrect.

If you want to restrict traffic with the ACLs that are applied, you will need to add what Carlo has provided.

If you want full access from 2 & 6 to 3, just remove the ACLs and leave the helper-address.

Community Member

DHCP ACCESS

yeah. i am sorry. i guess i was excited a little bit!!

i did  what carlo  adviced.. now it works with int vlan 2 and i am able to see that clients in vlan 2 getting dhcp ip addess.

but the in vlan 6 is still not working. i have a linux client and it says  "database sleeping" after doing DHCPDISCOVER for quite a few number of time..

Community Member

DHCP ACCESS

hi guys. figured it out. some issues with my old linux box. changed to a win7 client. everything is working superb both according to carlo's advice and also access-list 100 permit host 0.0.0.0 host 255.255.255.255

  my thanks again to carlo and robert..

4791
Views
0
Helpful
5
Replies
CreatePlease to create content