vielmetter
asked on
I need help blocking DHCP on a trunk port
I have 2 Procurve switches connected via gbic fiber. Both switches have DHCP servers in the network segments they handle (10.10.20.x/16 and 10.10.30.x/16). Unfortunately sometimes clients attached to one switch grab an IP address from the dhcp server on the other switches network segment. In essence I need to block DHCP from going across that GBIC wire. How can I configure this?
Any help would really be appreciated.
Any help would really be appreciated.
ASKER
My DHCP's need to talk to each other, they are DC's and they need to be able to communicate with each other across a trust relationship.
Is there a way to make adjustments on the switch that will prevent these packets going back and fourth between switches and networks?
Is there a way to make adjustments on the switch that will prevent these packets going back and fourth between switches and networks?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
kyleb84, I like your solution and will credit you the points because I think this solution will work. I do have a cisco router with 2 ethernet interfaces. If I use it for to do ACL's (as you suggest above) how would I go about it? what would a basic acl look like to block DHCP? And if I do this aren't I limiting my connection between the two switches from 1000 (GBIC speed) to 100 (router ethernet port speed)? In any case, I'd be curious as to how to create an ACL that blocks DHCP on a cisco router, especially if if both networks are in the same subnet.
ASKER
Great answer! Not just an idea, but a clear concrete set of steps that will resolve the problem.
Thanks
Thanks
To give a better example, what model is the Cisco router?
The access list would look like this:
access-list 111 deny udp any eq bootps
access-list 111 deny udp any eq bootpc
access-list 111 permit ip any any
Assign it to an interface:
int Vlan1
ip access-group 111
You would then have to put this router in-line between the switches, and yes, you would lose your Gigabit speeds, unless your DC's are on 100mbit and you throw it in between them and the switches (2 x ciscos required).
Depending on the model, you'd have to make both ports a member of a bridge to keep the same subnet across them.
But in any case, that'd be the general solution.
The access list would look like this:
access-list 111 deny udp any eq bootps
access-list 111 deny udp any eq bootpc
access-list 111 permit ip any any
Assign it to an interface:
int Vlan1
ip access-group 111
You would then have to put this router in-line between the switches, and yes, you would lose your Gigabit speeds, unless your DC's are on 100mbit and you throw it in between them and the switches (2 x ciscos required).
Depending on the model, you'd have to make both ports a member of a bridge to keep the same subnet across them.
But in any case, that'd be the general solution.
Sorry, should add this command to the bottom of either Switch config to actually turn on routing.
ip routing
ip routing
ASKER
My procurve doesn't have the ip default-gateway 10.10.20.254 command. Do I just use 0.0.0.0 0.0.0.0 10.10.20.254 instead? or is that wrong?
From what I am seeing in your question:
"Both switches have DHCP servers in the network segments they handle (10.10.20.x/16 and 10.10.30.x/16)"
If this is the exact setup then your issue is that the network mask is wrong because the network ID would be 10.10.0.0.
1) Check that you have the DHCPs set to a subnet mask of 255.255.255.0