Access Lists and DHCP

[arpboy]

We're working with a 3550 and we want to filter DHCP responses from all non-authorized servers. To do so, we used an access-list like the following:

access-list 100 permit udp host 1.2.3.4 any eq bootpc

access-list 100 permit udp host 1.2.3.5 any eq bootpc

access-list 100 deny udp any any eq bootpc

access-list 100 permit ip any any

By using a map with a forward action, everything works fine. Now my question: when using a map with a "drop" action, why won't the following work?

access-list 100 deny udp host 1.2.3.4 any eq bootpc

access-list 100 deny udp host 1.2.3.5 any eq bootpc

access-list 100 permit udp any any eq bootpc

We've tested both; the first works beautifully; the second drops all DHCP. Why?

[Georg Pauwen]

Hello,

can you post the full configuration ? I just wonder how the forward action is defined for traffic allowed by access-list 100.

Regards,

Georg

[arpboy]

Thanks, Georg. Here it is:

Current configuration : 1776 bytes

!

version 12.1

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname Switch

!

enable password xxxxxxx

!

ip subnet-zero

!

vtp mode transparent

!

spanning-tree mode pvst

spanning-tree extend system-id

!

!

vlan access-map DHCPFilter 10

action forward

match ip address 100

vlan filter DHCPFilter vlan-list 224

!

vlan 72,96,100

!

vlan 112

name Host

!

vlan 133,136,139

!

vlan 176

name PACS

!

vlan 180

name POC-Lab

!

vlan 200,220

!

vlan 224

name Client

!

vlan 260

!

vlan 278

name Pyxis

!

vlan 455,777

!

!

interface GigabitEthernet0/1

switchport mode dynamic desirable

!

interface GigabitEthernet0/2

switchport mode dynamic desirable

!

interface GigabitEthernet0/3

switchport mode dynamic desirable

!

interface GigabitEthernet0/4

switchport mode dynamic desirable

!

interface GigabitEthernet0/5

switchport mode dynamic desirable

!

interface GigabitEthernet0/6

switchport mode dynamic desirable

!

interface GigabitEthernet0/7

switchport mode dynamic desirable

!

interface GigabitEthernet0/8

switchport mode dynamic desirable

!

interface GigabitEthernet0/9

switchport mode dynamic desirable

!

interface GigabitEthernet0/10

switchport mode dynamic desirable

!

interface GigabitEthernet0/11

switchport access vlan 224

switchport mode access

!

interface GigabitEthernet0/12

switchport access vlan 224

switchport mode access

!

interface Vlan1

no ip address

shutdown

!

interface Vlan224

no ip address

!

ip classless

ip http server

!

!

access-list 100 permit udp host 1.2.3.4 any eq bootpc

access-list 100 permit udp host 1.2.3.5 any eq bootpc

access-list 100 deny udp any any eq bootpc

access-list 100 permit ip any any

!

line con 0

line vty 0 4

login

line vty 5 15

login

!

end