Correct rule to allow DHCP in ACL for a VLAN

[Ilya_Semenov]

Hello, everybody!

I need to allow DHCP traffic for a certain VLAN in ACL. Is my rule correct?

entry DHCP { if {

protocol udp ;

destination-port 67,68 ;

} then {

permit ;

}

}

Should it be applied to VLAN as "ingress"?

Could you please, check it? Thank you!!!

[Ilya_Semenov]

But Eric wrote: "That rule would allow IP broadcast traffic only." Who is right?

[Erik_Auerswald]

That would allow all global IP broadcast packets, not just DHCP.

[Henrique]

Hi, just change the comma to dash for destination-port match-condition.

entry DHCP {
if {
protocol udp ;
destination-port 67-68 ;
} then {
permit ;
}
}

After creating the .pol file you can use the "check policy " to check the syntax. Lets say your filename is "rule1.pol". You should use the command below to check the syntax:

check policy rule1

Please take a look into the article below for more details:

https://gtacknowledge.extremenetworks.com/articles/How_To/How-to-create-and-apply-an-ACL-in-EXOS

[Kawawa]

Looks good, should work just fine, you can apply it on the Ingress port if it is an Uplink, otherwise, YES you can apply it on the VLAN in the Ingress direction.. You might want to add a count to it for troubleshooting purposes.