ip directed broadcast

[avilt]

My management vlan on a L2 switch is 172.16.0.0/24.

I have added the  command "no ip directed broadcast" on the vlan interface.

But when I ping from a client PC to the broadcast address 172.16.0.255 the switch responds to this address.  How can I disable this?

[rsimoni]

Hi,

you need the command on the last L3 device routing traffic into 172.16.0.0/24 subnet.

The command prevents a router from sending traffic to directed brodcast address not a device from replying to it.

Riccardo

[avilt]

How can I prevent the end device from responding to the broadcast address?

[Kevin Dorrell · Accepted solution]

ip access-list extended no-dbc-ping  

  deny icmp any host 172.16.0.255 echo

  permit ip any any

interface F0/0

  ip access-group no-dbc-ping in

Unfortunately you cannot do this as the corresponding outgoing ACL because outgoing ACLs do not affect packets generated by the router itself.

Kevin Dorrell

Luxembourg

[rsimoni · Accepted solution]

Kevin is right.

Anyway, as I wrote already, if you don't want your switch to reply to directed brodcasts you need to prevent them from entering to the management subnet at all... and how you do that? By configuring 'no ip directed broadcast' on the last L3 device routing traffic into 172.16.0.0/24 subnet.

On the contrary any device will reply to local broadcasts as they are forced to do so.

Riccardo

[avilt]

So with this command the L3 device will not forward/move the traffic to the broadcast address from a remote system to its directly connected subnet right?

So if I have a L3 device, is it advisable to put this command on all vlan interfaces?

[rsimoni]

yes and yes (unless you need local brodcasts of course)