ACL to Allow only the DHCP Server

[Mohamed Lotfy]

Dear All,

I have 3 VLANs (it's an example configration):

1- Vlan 10

     ip address 10.10.10.1 255.255.255.0

     ip helper 10.10.10.15

   Vlan 20

     ip address 20.20.20.1 255.255.255.0

     ip helper 10.10.10.15

   Vlan 30

     ip address 30.30.30.1 255.255.255.0

      ip helper 10.10.10.15

router ospf 1

     network 10.10.10.0 0.0.0.255 area 0

     network 20.20.20.0 0.0.0.255 area 0

     network 30.30.30.0 0.0.0.255 area 0

-------------------------------------------------------------------------

Now I need all clients & network components on VLAN 20 to access everything on VLAN 10.

But for the VLAN 30 clients, I need to access only the DHCP Server on VLAN 10 , and can’t access anything on VLAN 20.

Can I use the ACL to do that? If yes how?

And do I have any other features can help me also?

Thanks,

Mohamed Lotfy

[John Blakley]

Mohamed,

You can try this:

On vlan 10, you can take the helper address off since the dhcp server resides on  that subnet.

On vlan 30, apply an acl like the following:

access-list 101 permit udp any eq bootpc any eq bootps

access-list 101 deny ip any any

int vlan 30

ip access-group 101 in

The acl only allows dhcp traffic to come in from hosts on the vlan 30, but it doesn't allow them to do anything outside of vlan 30 once they get an address. If you need to allow them to get to hosts in the vlan 10, you'll also need to allow them that and then deny them to vlan 20.

access-list 101 permit udp any eq bootpc any eq bootps

access-list 101 permit ip any 10.10.10.0 0.0.0.255

access-list 101 deny ip any any

Or if you want to allow them everywhere and deny them ONLY to the vlan 20:

access-list deny ip any 20.20.20.0 0.0.0.255

access-list permit ip any any

HTH,

John

Please rate...

[Mohamed Lotfy]

Dear Brother John,

relly thank you, it's a very helpful answer from you

thanks again

Lotfy

[John Blakley]

Not a problem Thank you for the rating!

[spamspambaconspam]

This post is 3 years old, but I'm tossing this up for future reference

To permit | deny just DHCPv4 traffic...

1. Create an extended ACL with 2 lines.
2. Use the following parameters to create each statement:
   ► UDP port 67 (That's a DHCP server)
   ► UDP port 68 (That's a DHCP client)

BillTheCat(config)# access-list 173 permit udp 30.30.30.0 0.0.0.255 any eq 67
BillTheCat(config)# access-list 173 permit udp any 30.30.30.0 0.0.0.255 eq 68
BillTheCat(config)# end

(Yes, I know there are 9,003 ways to make this ACL better, but I'll leave that to you...☺)

► You have the implicit deny at the end, which will block anything that has not been explicitly permitted.

► However, I like to add an explicit deny at the end, so that I can see the stats for it.
(John Blakley also had this in his answer, so hat tip to John)

BillTheCat(config)# access-list 173 permit udp 30.30.30.0 0.0.0.255 any eq 67
BillTheCat(config)# access-list 173 permit udp any 30.30.30.0 0.0.0.255 eq 68
BillTheCat(config)# access-list 173 deny ip any any
BillTheCat(config)# end

(Yes, I know there are 9,002 ways to make this ACL better, but I'll leave that to you...☺)

► You can use it to debug:

BillTheCat# debug ip packet 173
IP packet debugging is on for access list 173
*IP: s=0.0.0.0 (GigabitEthernet0/1), d=255.255.255.255, len 333, rcvd 2
*IP: s=0.0.0.0 (GigabitEthernet0/1), d=255.255.255.255, len 333, stop process pak for forus packet
*IP: s=30.30.30.1 (local), d=255.255.255.255
(GigabitEthernet0/1), len 328, sending broad/multicast
 

► And if you want to see the DHCP activity from 30.30.30.0/24 LAN, you can use:

debug ip dhcp server events

BillTheCat# debug ip dhcp server events
DHCPD: returned 30.30.30.26 to address pool LAN-POO-30
DHCPD: assigned IP address 30.30.30.71 to client
0100.0103.85e9
DHCPD: checking for expired leases.
DHCPD: the lease for address 30.30.30.16 has expired.
DHCPD: returned 30.30.30.16 to address pool LAN-POO-30

Well, hope that helps someone in their quest to sort out DHCP traffic...

Cheers!

▬ spammy

[wyvern92]

This problem bugs me up for the last few weeks and this line "permit udp any eq bootpc any eq bootps" saves the day.