DHCP is responding without IP-Helper Address

[shyamradhe]

Hello all

I have 7 VLANs in our core switch, VLAN-1 is for management,so i did not introduced ip helper address command on interface vlan 1.

but problem is that the pc is getting ip from dhcp, from vlan-1 ip range,

don't know how is this happening,

kindly let me know how to stop this, and how is this possible?

[Evgeniy Prichinin]

You have dhcp in vlan 1. You can get ip of dhcp server from PC network connection info. 

[shyamradhe]

DHCP server is also placed in VLAN-1(same range of vlan-1)

"means this is why DHCP responding for that request from client" ?

[Evgeniy Prichinin]

Yes, Client discovers dhcp server using broadcasts.

[Mark Malone]

whats the config on vlan1 and is the pc pulling an ip address from one of the core switch dhcp pools ? is there a pool for vlan 1 on the core switch ?

[shyamradhe]

DHCP server is also placed in VLAN-1(same range of vlan-1)

"means this is why DHCP responding for that request from client" ?

[Mark Malone]

if the dhcp server is in the same vlan 1 , the pcs will look for an address as they broadcast out when set as dhcp and the server will respond if it has a pool for that vlan as its in same broadcast domain  , that's the way it works , if you don't want them asking for an address set them as static or remove the pool for vlan1 from the dhcp settings so even if they broadcast out looking theres no ips for them to be assigned

[shyamradhe]

Ok thanks,

Can i use an access list like.

ip access list extended DHCP_BLOCK

  deny udp any any eq bootpc

int vlan 1

  ip -access-group DHCP_BLOCK out

"will this work ? or it will deny every other things too?"

[Mark Malone]

that wont work as the dhcp server is in the same broadcast domain vlan 1 , that will only prevent it breaking out if the dhcp server was in another vlan to get an address

if vlan 1 is for management then really the devices should be getting static addresses only and there should be no dhcp pool for vlan 1 on your server , that way the pcs that are in the same vlan cant pick up any address

[shyamradhe]

ok mark

thanks. for your quick response :)