Correct rule to allow DHCP in ACL for a VLAN

[Ilya_Semenov]

Hello, everybody!

I need to allow DHCP traffic for a certain VLAN in ACL. Is my rule correct?

entry DHCP { if {

protocol udp ;

destination-port 67,68 ;

} then {

permit ;

}

}

Should it be applied to VLAN as "ingress"?

Could you please, check it? Thank you!!!

[Erik_Auerswald]

Hi Ilya,

that entry denies all IP (version 4) traffic, but still allows non-IP Ethernet frames. That is OK and equivalent to the implicit deny any of Extreme EOS (or Cisco IOS) IP access-lists (router ACL).

Erik

[Henrique]

That rule would allow IP broadcast traffic only.

[Ilya_Semenov]

Yes, I have the deny-all rules in the end of ACL.

My additional questuon was about does this rule

entry dhcp { if {
destination-address 255.255.255.255/32 ;
} then {
count dhcp ;
permit ;
}
}

have a sense at all?

What does this rule exactly allow?

Thank you very much!

[Ilya_Semenov]

Many thanks to you!

Then, I am correct that this allow all ip traffic? No only DHCP, yes?

entry dhcp { if {
destination-address 255.255.255.255/32 ;
} then {
count dhcp ;
permit ;
}
}

Thank you!

[Erik_Auerswald]

The IP address 255.255.255.255 is the local (not global, my mistake) broadcast address for IP version 4, also known as all ones. This includes any protocol and any port, thus it is not just DHCP.

It is not every broadcast packet either, because IP version 4 supports directed broadcasts (directed broadcasts should be disabled for security reasons, it allows e.g. amplification in Smurf attacks).