ACL to block DHCP/Bootp/PXEBoot from all but certain servers?

[Ron_Prague]

I work in an engineering focused company and several of our products do DHCP. Problem is, absent minded engineers keep plugging these devices and virtual machines into the corporate network, creating a headache for our tech support team.

General layout is:
Office vlan
Manufacturing vlan
Engineering vlan
Server vlan (contains corporate DHCP server at 172.16.5.50)
Support vlan
PXE vlan (contains corporate PXE boot server for imaging at 172.16.55.50)

Switch config is pretty basic for this stuff right now:

configure bootprelay add 172.16.5.50 vr VR-Default
configure bootprelay add 172.16.55.50 vr VR-Default
enable bootprelay ipv4 vlan OFC
enable bootprelay ipv4 vlan ENG
enable bootprelay ipv4 vlan SVR
enable bootprelay ipv4 vlan MFG
enable bootprelay ipv4 vlan SUP
enable bootprelay ipv4 vlan PXE

The only DHCP servers we want to be able to answer live on the server vlan for normal boring DHCP and the PXE boot server that lives in the PXE vlan.

Is it possible to build an ACL that will block DHCP replies from anything but the bootprelay configured servers?

[Johannes_Dennin]

you could just block port 4011 (which should be the port used for pxe boot) via ACL on the vlans you dont want PXE boot

[Ron_Prague]

I like that idea EtherMAN, going to add an snmp-trap and set the port to disable.

We already disable ports via ELRP when engineers make loops so they have to enter a ticket to get them turned back on 

[EtherMAN]

also have it send you an alarm... that way it will do a snmp trap and you can track down rogue dhcp server... We also do this on edge access ports that are pulling from a trusted dhcp server and we go one step further on the edge we have the switch disable the port along with throwing a trap... makes it near impossible for a rogue to come in and makes it super easy to track down the guilty party 

[Ron_Prague]

We have 3 edge stacks, all dhcp is handled by a DHCP server attached to our core 8810s.

For example, on edge stack IDF01 for vlan ENG, the configuration would look like this:

configure trusted-servers vlan ENG add server 172.16.5.50 trust-for dhcpserver
enable ip-security dhcp-snooping vlan ENG ports all violation action drop-packet

Does that look correct?