Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I've been presented with some odd "security conventions" in a large company I'm contracting with and am trying to get some perspectives on them.

I need to build a number of servers virtualization servers in a data center but have been told that I can not 1) relay any "layer 2" protocols outside of their origin network and 2) use native vlan on a trunked interface to a server.

So instead of enabling a bootp relay on the Cisco 6513 on a number of network segments I instead need to presumably build 3 or 4 DHCP servers and place them out close to the internet in each relevant vlan. Why would you ever deny relaying of DHCP? It's surely much more secure to keep a secure resilient DHCP server at the back of a network that various others dotted around the place in much more exposed locations. I really can't see any benefits here in the slightest.

As for not being allowed a native VLAN, This sounds like a convention whereby trunks on IOS devices should be configured to not leave VLAN 0 open as native by default on inter switch trunks (along with vtp etc.) accidentally exposing your network infrastructure to attack.

Does this policy seem familiar to anyone else? It certainly feels that some best practises have steadily warped over time to become just plain stupid.



share|improve this question

1 Answer 1

bootp/dhcp relay is encapsulation inside layer 3, using UDP packets between the relay and the server. So local serving is L2 because of the broadcasts, but relayed traffic is always firmly L3 unicast and fine, per my reading of what you wrote.

Sounds like they're trying to prohibit bridging a private network to another one, which is reasonable. That doesn't prohibit DHCP relaying by my interpretation. If in doubt, ask for clarification.

share|improve this answer
Oh i've asked.... they say "You can not relay DHCP, it's the rules". There is no question of a technical perspective at all, it's "for security", although having more servers closer to the internet (which would also have ssh running etc. is clearly less secure). As for the vlan side, I can have two cables entering a box, one with 20 8021q vlans and one with a native one. And then I can bridge them as the sysadmin if i'm dumb, just like I can bridge them if they're on the same link... I'd like to think I'm missing something here, but it doesn't feel like it. –  Chris Phillips Jan 19 '11 at 8:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.