1

I'm having some trouble with forwarding DHCP from a subnet behind an access list on a Cisco Catalyst 4500 switch. I'm hoping somebody can see the mistake I'm making.

The subnet is defined like this: (first three octets of IP addresses and vrf name anonymized)

interface Vlan40
  ip vrf forwarding vrf_name
  ip address 10.10.10.126 255.255.255.0 secondary
  ip address 10.10.10.254 255.255.255.0
  ip access-group 100 out
  ip helper-address 10.10.20.36
  no ip redirects

I tried turning on a VMWare machine on this subnet that was configured to use DHCP, but I never got a DHCP response and the DHCP server didn't receive a request. I tried putting the following in the access-list:

access-list 100 permit udp host 10.10.10.254 host 10.10.20.36 eq bootps
access-list 100 permit udp host 10.10.10.254 host 10.10.20.36 eq bootpc
access-list 100 permit udp host 10.10.20.36 host 10.10.10.254 eq bootps
access-list 100 permit udp host 10.10.20.36 host 10.10.10.254 eq bootpc

That didn't help. Can anybody see what the problem is?

  • I know that the DHCP server works; our whole network is running off of this DHCP server
  • I also know that the subnet works because we have active servers running on the network
  • The DHCP scope is already defined on the DHCP server
  • The subnet is correctly defined on the VMWare server (already servers running on the subnet on VMWare)

Edit 2012-10-19: This is solved! The subnet had formerly been defined as a /25 network, but was then expanded into a /24 network. When the DHCP scope was altered after this change it was done incorrectly; the gateway was moved to .254, the leasable IP range was in the lower half of the /24 subnet but we forgot to change the CIDR prefix from /25 into /24. This happened some 2 years ago, and we didn't need to use DHCP on this server network again until this week.

Thank you MDMarra and Jason Seemann for looking at the question and trying to troubleshoot.

Now I'm wondering if I should mark Jason's answer as the accepted answer (I am new to the Stack Exchange network, so I don't know the etiquette of what to do if I misstated the question like in this case).

3
  • 1
    "I tried turning on a VMWare machine on this subnet that was configured to use DHCP" - VMWare what? VMWare is a company, not a product and all of their products behave differently.
    – MDMarra
    Oct 15, 2012 at 10:31
  • I started a VM on our VMWare ESXi server, the VM was defined to be on this subnet and was supposed to perform a DHCP request on boot. Oct 15, 2012 at 11:34
  • +1, Add your own answer and accept it... I upvoted Jason's answer, but you should mark the exact solution to your problem as the answer. Nov 23, 2012 at 11:12

1 Answer 1

2

Note 1: Generally outbound ACLs should not affect outbound router-originated traffic, so in your case I'm not so sure that the ACL is directly stopping DHCP from working.

Note 2: I mocked up a simple lab to confirm the above. Essentially I just put a permit IP any any log ACL in place to confirm the router traffic doesn't hit the ACL - it didn't in my case.

Note 3: So I hooked up a sniffer to understand the packet format of the DHCP reply on VLAN40. The DHCP reply would be sourced from the router interface (10.10.10.254 in your case), and destined to the broadcast IP 255.255.255.255. Source port BOOTPS, destination port BOOTPC. If you like you can sculpt the ACL to this packet format (permit udp host 10.10.10.254 eq bootps host 255.255.255.255 eq bootpc), but again I don't think you'll see any hits due to Note #1.

One note, my ACL did pick up a ping test coming from the DHCP server on to the subnet to validate that the IP address it wanted to assign was available. Even if you deny this DHCP should still work, but mostly just FYI.

Take a closer look at your server and client and other parameters - you say DHCP works on this subnet. Or just basic confirmation remove the ACL entirely and see if it works.

1
  • Thank you Jason. Your answer lead me in the right direction when I continued to troubleshoot. I did find the problem and fixed it (see edit of original question above). Oct 19, 2012 at 3:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .