We are currently providing network connectivity to an apartment complex with the following setup.
Cisco 2821 Router -> Cisco Catalyst 3750 24-port Fiber Switch -> Cisco Catalyst 2590 24-port Ethernet Switch (1 per Bldg) -> AMP NetConnect16-port unmanaged switch (8 units per Bldg) -> RJ-45 jacks in rooms = Internet in each room
The focus is between the Cisco 2590 and the tenants connections at any one buliding. Each 2950 is setup as a DHCP server to give out a certain IP range (Bldg 5 = 192.168.5.xx , Bldg 13 = 192.168.13.xx) so a tenant plugs their computer into a wall jack, computers sends request to the 2950 which responds with appropriate IP. Each individual building is on its' own VLAN for security and network efficiency purposes.
The problem comes in when a tenant decides they want a wireless conection so they go out and buy a wireless router (Linksys / Netgear) and plug it into one of the switch ports on the router instead of the WAN/Internet port. These start acting as DCHP servers themselves and tenants in other units of the building start receiving incorrect IP addresses and gateways (192.168.0.xxx) which causes a loss of internet for everyone. Currently the only recourse is to call a tenant who has a problem, individually starting shutting off ports on the 2950 and have them renew their IP address until they begin receiving the correct addresses again.
We have higher level ACL's applied to the router but a very basic ACL in place currently on the 2590s for some usual problematic ports. We have tried some ACL's but none seem to work. The DHCP client to the DHCP server use UDP source port 68 and UDP destination port 67 whereas messages from the DHCP server to the DHCP client use UDP source port 67 and UDP destination port 68. How can we use an ACL to ensure the computers only get their DHCP response from the 2950 and not from tenant equipment? I am including a sample config. Thanks.
!
version 12.1
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname KZOO_5
!
no logging console
enable secret 5 XXXXXXXXXXXXX
enable password XXXXXXXXXXXXX
!
ip subnet-zero
ip dhcp excluded-address 192.168.5.1 192.168.5.10
!
ip dhcp pool kzoo5pool
network 192.168.5.0 255.255.255.0
dns-server 24.247.15.53 24.247.24.53
default-router 192.168.5.1
lease 60
!
!
spanning-tree mode pvst
no spanning-tree optimize bpdu transmission
spanning-tree extend system-id
!
!
!
!
interface FastEthernet0/1
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
interface FastEthernet0/2
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
interface FastEthernet0/3
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
interface FastEthernet0/4
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
<<<Port 5 -> Port 23 - Shortened for readability>>>
!
interface FastEthernet0/24
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
interface FastEthernet0/25
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
interface FastEthernet0/26
switchport access vlan 5
switchport mode access
ip access-group 107 in
!
interface Vlan1
no ip address
no ip route-cache
shutdown
!
interface Vlan5
ip address 192.168.5.2 255.255.255.0
no ip route-cache
!
ip default-gateway 192.168.5.1
ip http server
access-list 107 deny tcp any any eq 445
access-list 107 deny tcp any any eq 1433
access-list 107 deny tcp any any eq 135
access-list 107 deny tcp any any eq 136
access-list 107 deny tcp any any eq 137
access-list 107 deny tcp any any eq 138
access-list 107 deny tcp any any eq 139
access-list 107 deny tcp any any eq 6346
access-list 107 permit ip any any
access-list 112 permit ip any any
!
line con 0
line vty 0 4
password XXXXXX
login
line vty 5 15
password XXXXXX
login
!
!
end
