Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm having some trouble with forwarding DHCP from a subnet behind an access list on a Cisco Catalyst 4500 switch. I'm hoping somebody can see the mistake I'm making.

The subnet is defined like this: (first three octets of IP addresses and vrf name anonymized)

interface Vlan40
  ip vrf forwarding vrf_name
  ip address secondary
  ip address
  ip access-group 100 out
  ip helper-address
  no ip redirects

I tried turning on a VMWare machine on this subnet that was configured to use DHCP, but I never got a DHCP response and the DHCP server didn't receive a request. I tried putting the following in the access-list:

access-list 100 permit udp host host eq bootps
access-list 100 permit udp host host eq bootpc
access-list 100 permit udp host host eq bootps
access-list 100 permit udp host host eq bootpc

That didn't help. Can anybody see what the problem is?

  • I know that the DHCP server works; our whole network is running off of this DHCP server
  • I also know that the subnet works because we have active servers running on the network
  • The DHCP scope is already defined on the DHCP server
  • The subnet is correctly defined on the VMWare server (already servers running on the subnet on VMWare)

Edit 2012-10-19: This is solved! The subnet had formerly been defined as a /25 network, but was then expanded into a /24 network. When the DHCP scope was altered after this change it was done incorrectly; the gateway was moved to .254, the leasable IP range was in the lower half of the /24 subnet but we forgot to change the CIDR prefix from /25 into /24. This happened some 2 years ago, and we didn't need to use DHCP on this server network again until this week.

Thank you MDMarra and Jason Seemann for looking at the question and trying to troubleshoot.

Now I'm wondering if I should mark Jason's answer as the accepted answer (I am new to the Stack Exchange network, so I don't know the etiquette of what to do if I misstated the question like in this case).

share|improve this question
"I tried turning on a VMWare machine on this subnet that was configured to use DHCP" - VMWare what? VMWare is a company, not a product and all of their products behave differently. – MDMarra Oct 15 '12 at 10:31
I started a VM on our VMWare ESXi server, the VM was defined to be on this subnet and was supposed to perform a DHCP request on boot. – Ásgeir Bjarnason Oct 15 '12 at 11:34
+1, Add your own answer and accept it... I upvoted Jason's answer, but you should mark the exact solution to your problem as the answer. – Mike Pennington Nov 23 '12 at 11:12

Note 1: Generally outbound ACLs should not affect outbound router-originated traffic, so in your case I'm not so sure that the ACL is directly stopping DHCP from working.

Note 2: I mocked up a simple lab to confirm the above. Essentially I just put a permit IP any any log ACL in place to confirm the router traffic doesn't hit the ACL - it didn't in my case.

Note 3: So I hooked up a sniffer to understand the packet format of the DHCP reply on VLAN40. The DHCP reply would be sourced from the router interface ( in your case), and destined to the broadcast IP Source port BOOTPS, destination port BOOTPC. If you like you can sculpt the ACL to this packet format (permit udp host eq bootps host eq bootpc), but again I don't think you'll see any hits due to Note #1.

One note, my ACL did pick up a ping test coming from the DHCP server on to the subnet to validate that the IP address it wanted to assign was available. Even if you deny this DHCP should still work, but mostly just FYI.

Take a closer look at your server and client and other parameters - you say DHCP works on this subnet. Or just basic confirmation remove the ACL entirely and see if it works.

share|improve this answer
Thank you Jason. Your answer lead me in the right direction when I continued to troubleshoot. I did find the problem and fixed it (see edit of original question above). – Ásgeir Bjarnason Oct 19 '12 at 3:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.