Access Lists and DHCP

arpboy · ‎04-23-2004

We're working with a 3550 and we want to filter DHCP responses from all non-authorized servers. To do so, we used an access-list like the following:

access-list 100 permit udp host 1.2.3.4 any eq bootpc

access-list 100 permit udp host 1.2.3.5 any eq bootpc

access-list 100 deny udp any any eq bootpc

access-list 100 permit ip any any

By using a map with a forward action, everything works fine. Now my question: when using a map with a "drop" action, why won't the following work?

access-list 100 deny udp host 1.2.3.4 any eq bootpc

access-list 100 deny udp host 1.2.3.5 any eq bootpc

access-list 100 permit udp any any eq bootpc

We've tested both; the first works beautifully; the second drops all DHCP. Why?

Georg Pauwen · ‎04-23-2004

Hello,

can you post the full configuration ? I just wonder how the forward action is defined for traffic allowed by access-list 100.

Regards,

Georg

arpboy · ‎04-26-2004

Thanks, Georg. Here it is:

Current configuration : 1776 bytes

!

version 12.1

no service pad

service timestamps debug uptime

service timestamps log uptime

no service password-encryption

!

hostname Switch

!

enable password xxxxxxx

!

ip subnet-zero

!

vtp mode transparent

!

spanning-tree mode pvst

spanning-tree extend system-id

!

vlan access-map DHCPFilter 10

action forward

match ip address 100

vlan filter DHCPFilter vlan-list 224

!

vlan 72,96,100

!

vlan 112

name Host

!

vlan 133,136,139

!

vlan 176

name PACS

!

vlan 180

name POC-Lab

!

vlan 200,220

!

vlan 224

name Client

!

vlan 260

!

vlan 278

name Pyxis

!

vlan 455,777

!

interface GigabitEthernet0/1