Link to home
Start Free TrialLog in
Avatar of vielmetter
vielmetter

asked on

I need help blocking DHCP on a trunk port

I have 2 Procurve switches connected via gbic fiber. Both switches have DHCP servers in the network segments they handle (10.10.20.x/16 and 10.10.30.x/16). Unfortunately sometimes clients attached to one switch grab an IP address from the dhcp server on the other switches network segment. In essence I need to block DHCP from going across that GBIC wire. How can I configure this?

Any help would really be appreciated.
Avatar of Brooklyn_Shogun
Brooklyn_Shogun
Flag of United States of America image

Hello:

From what I am seeing in your question:

"Both switches have DHCP servers in the network segments they handle (10.10.20.x/16 and 10.10.30.x/16)"

If this is the exact setup then your issue is that the network mask is wrong because the network ID would be 10.10.0.0.

1) Check that you have the DHCPs set to a subnet mask of 255.255.255.0
Avatar of vielmetter
vielmetter

ASKER

My DHCP's need to talk to each other, they are DC's and they need to be able to communicate with each other across a trust relationship.

Is there a way to make adjustments on the switch that will prevent these packets going back and fourth between switches and networks?
ASKER CERTIFIED SOLUTION
Avatar of kyleb84
kyleb84
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
kyleb84, I like your solution and will credit you the points because I think this solution will work. I do have a cisco router with 2 ethernet interfaces. If I use it for to do ACL's (as you suggest above) how would I go about it? what would a basic acl look like to block DHCP? And if I do this aren't I limiting my connection between the two switches from 1000 (GBIC speed) to 100 (router ethernet port speed)? In any case, I'd be curious as to how to create an ACL that blocks DHCP on a cisco router, especially if if both networks are in the same subnet.
Great answer! Not just an idea, but a clear concrete set of steps that will resolve the problem.
Thanks
To give a better example, what model is the Cisco router?

The access list would look like this:

access-list 111 deny udp any eq bootps
access-list 111 deny udp any eq bootpc
access-list 111 permit ip any any

Assign it to an interface:

int Vlan1
 ip access-group 111

You would then have to put this router in-line between the switches, and yes, you would lose your Gigabit speeds, unless your DC's are on 100mbit and you throw it in between them and the switches (2 x ciscos required).

Depending on the model, you'd have to make both ports a member of a bridge to keep the same subnet across them.

But in any case, that'd be the general solution.



Sorry, should add this command to the bottom of either Switch config to actually turn on routing.

ip routing
My procurve doesn't have the ip default-gateway 10.10.20.254 command. Do I just use 0.0.0.0 0.0.0.0 10.10.20.254 instead? or is that wrong?