WOL - IP Directed Broadcast - Concerns

[CHiLL]

I have been doing some testing and I've managed to get our SCCM (1610) server's WOL feature to work on our clients on a different VLAN/Subnet. I enabled the features within SCCM Site Properties, using subnet-directed broadcasts and port 9, however WOL simply was not working. I've since learnt that enabling 'ip directed-broadcast' on our core switch has allowed SCCM to wake clients up across the subnets and VLANs. We have a HP 5406 Core Switch and HP 2530 edge switches. I just have a couple of questions:

 

1) I've read about the potential dangers of enabling 'ip directed-broadcast', including potential 'smurf attacks'. Since we are only a school environment, does this having it enabled pose that much of a risk?

 

2) Linked to question 1), I've read about access-lists for 'ip directed-broadcast'

a) Are access lists required if question 1) is deemed too much of a security risk?

b) What are the commands I would need to use to enable this? I've found the commands to limit the access list, but not to create the access list containing the valid subnets

c) If we are to use access lists, would I simply need to allow the source IP/subnet/VLAN that the WOL packets are coming from, or also the destination IP/subnet/VLANs?

 

3) We had issues with Impero not being able to WOL across subnets/VLANs, so we had to put all our clients on the same VLAN. I've not been able to test this as of yet, and will probably be unable to for a while...could this potentially solve that issue and allow Impero to WOL machines on another subnet/VLAN?

 

Hope that all makes sense!

Edited January 17, 2017 by CHiLL

[FN-GM]

1) You can set it up to only allow the directed broadcast from your SCCM server via an ACL.

2) A. On Cisco some kind of ACL is required even if its setup to allow everything. I think HP is the same.

B. Not sure on HP.

C. set the source as your SCCM server to any destination

3) Yep should be able to solve that.