Business Community > Switches > How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
< Switches

How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
2025-01-24 12:23:56

I have need to prevent devices with a specific VLAN tag from receiving DHCP on a group of ports on one particular switch - they instead must be set as statics.  I want to force this so the users must set a static on the device before it can work rather than relying on DHCP.  I need DHCP to continue to serve all the rest of the network as normal for that VLAN. 

 

Things I have tried:

 

Switch ACL to prevent "Network - Tech" > DHCP Server IP Ports 67-68 UDP applied to only that group of switch ports specifically

Switch ACL to prevent DHCP Server IP Ports 67-68 UDP > "Network - Tech" applied to only that group of switch ports specifically (reverse of above)

 

Switch ACL to prevent UDP Ports 67-68 > IPgroup_Any applied to only those ports

Switch ACL to prevent IPgroup_Any > UDP Ports 67-68 applied to only those ports (reverse of above)

 

I have tried the above 4 ACLs using the DHCP servers source switch port instead

 

I have tried using the DHCP servers MAC address in a MAC group, and used ACLs in both directions to and from it.

 

I still, always get DHCP served on those ports!

 

WHY ?????

 

The only way i can seem to block DHCP is a blanket UDP 67-68 > IP_Group_Any applied to all switch ports across entire network.

 

Can anyone assist?

Main: ER8411 x1, SG3428X x1, SG3452 x1, SG2428LP x1, SG3210 x1, SG2218P x1, SG2008P x3, ES208G x1, EAP650 x6 Remote: ER7206 v2 x1, ER605 v2 x3, SG2008P x2, EAP650 x2, ES205G x1 Controller: OC300
  0      
 
  0      
 
#1
Options
4 Reply
Re:How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
2025-01-26 08:33:13

Hi @GRL 

Thanks for posting in our business forum.

Prevent the GW IP instead of any. Block the GW IP(DHCP server IP) in that broadcast range.

  0  
  0  
#2
Options
Re:How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
2025-01-26 08:38:36

  @Clive_A 

 

I have tried that

 

ACL

Block UDP 67-68 <> GW IP. those switch ports only

 

DHCP still passes!

Main: ER8411 x1, SG3428X x1, SG3452 x1, SG2428LP x1, SG3210 x1, SG2218P x1, SG2008P x3, ES208G x1, EAP650 x6 Remote: ER7206 v2 x1, ER605 v2 x3, SG2008P x2, EAP650 x2, ES205G x1 Controller: OC300
  0  
  0  
#3
Options
Re:How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
2025-01-26 08:46:32

Hi @GRL 

Thanks for posting in our business forum.

GRL wrote

  @Clive_A 

 

I have tried that

 

ACL

Block UDP 67-68 <> GW IP. those switch ports only

 

DHCP still passes!

DHCP IP still got assigned to them the clients?

Rule 1 IP-Port subnet of this VLAN, port UDP 67 68

Rule 2 GW IP to VLAN, port 66 67. The GW IP means the IP in that VLAN. Not the default VLAN 192.168.0.1, for example.

VLAN 10.0.0.0/24, IP is 10.0.0.1/24 if you configure it.

  1  
  1  
#4
Options
Re:How can i stop DHCP being served to a group of ports on one particular switch on a particular vlan?
2025-01-26 08:50:33

  @GRL 

 

Yes this is exatly what i tried

 

VLAN 6 (not management

GW IP 192.168.6.254

 

Switch ACL

 

192.168.6.0/24 UDP port 67-68  ..........  192.168.6.254 UDP port 67-68     Applied to Switch 3 ports 1-8 only

 

I tried it the other way around as well, and also as one and the reverse in a seperate acl

 

DHCP always passed.

 

DHCP doesnt pass if i apply the rule to all switch ports.  It only not works if i apply to a selection of ports on any particular switch.

Main: ER8411 x1, SG3428X x1, SG3452 x1, SG2428LP x1, SG3210 x1, SG2218P x1, SG2008P x3, ES208G x1, EAP650 x6 Remote: ER7206 v2 x1, ER605 v2 x3, SG2008P x2, EAP650 x2, ES205G x1 Controller: OC300
  0  
  0  
#5
Options

Information

Helpful: 0

Views: 425

Replies: 4

About Us
Press
Copyright © TP-Link Systems Inc. All rights reserved.