topic RE: DHCP Forwarding in ExtremeSwitching (EXOS/Switch Engine)

DHCP Forwarding

Alex — Wed, 14 Nov 2018 04:31:00 GMT

We have a VLAN that we want isolated from the rest of the network (hosts on this VLAN can only talk to hosts on same VLAN). The problem is, we also want DHCP on this VLAN (traffic should get out of that VLAN just to get DHCP addresses from our server). I have enabled bootprelay on the core router. The problem is: if I enable IPForwarding on this VLAN, it won't be isolated anymore.

Is there a way to keep IPForwarding disabled while routing DHCP traffic only?

Thanks in advance.

RE: DHCP Forwarding

BradP — Wed, 14 Nov 2018 04:35:00 GMT

Hi Alex,

You would have to have a separate DHCP server for that vlan. One option is to enable it on the router or firewall--just for that vlan.

Thanks
Brad

RE: DHCP Forwarding

Alex — Wed, 14 Nov 2018 04:35:00 GMT

Thanks for the input Brad. However, having a separate DHCP for that VLAN is not an option, as we want to manage IPs on that scope with our campus DHCP server.

RE: DHCP Forwarding

Alex — Wed, 14 Nov 2018 04:35:00 GMT

Brad, we were actually able to convince management to setup DHCP services in the core routers just for this VLAN. We've configured and tested this; all looking good.

TY

RE: DHCP Forwarding

Eric_Burke — Wed, 14 Nov 2018 06:13:00 GMT

Perhaps a policy to deny all but dhcp originating in that vlan?

RE: DHCP Forwarding

Alex — Wed, 14 Nov 2018 06:13:00 GMT

Yep, it's looking like I may have to go this route (I was trying to avoid deploying an ACL in our Core router). It'd be nice if Extreme switches could have IPForwarding disabled but bootpr enabled for a particular VLAN  .

RE: DHCP Forwarding

Eric_Burke — Wed, 14 Nov 2018 06:15:00 GMT

Another thought. Can you stretch the vlan to a subinterface on your dhcp and disable other services on that interface?

RE: DHCP Forwarding

Alex — Wed, 14 Nov 2018 06:15:00 GMT

Interesting idea... however, the DHCP server is managed by a different group and they will not allow this setup.