Router ACLs

[FatBoy]

I need to add a ACL line on my router to let a DHCP server (10.143.1.11) on my 10.143.0.0 subnet access my APs on the 10.140 subnet which all have the address 10.140.3.x

 

An example of the ACL now would be

ip access-list extended MainVLAN

permit tcp any host 10.144.5.1 eq www

permit tcp any host 10.144.5.1 eq 443

permit tcp any host 10.144.5.1 eq 3389

permit tcp 10.140.1.0 0.1.0.255 10.140.5.0 0.0.0.255 eq telnet

permit ip host 10.140.1.10 10.141.0.0 0.0.255.255

permit ip 10.140.1.0 0.0.0.127 any

permit tcp host 10.0.1.51 any

permit ip host 10.0.1.51 any

 

If I add the line "permit ip host 10.143.1.11 10.140.3.0 0.1.1.255" would that work? I always get confused with the wildcard subnet masks

[FatBoy]

Or would a better way be permit ip 10.140.3.0 0.0.0.255 host 10.143.1.11??

 

I assume though that you need to let the traffic though both ways would I bet correct?

 

so I would also need "permit ip host 10.143.1.11 10.140.3.0 0.0.0.255"

 

Can any one help?

Edited September 8, 2010 by FatBoy

[SYNACK]

I'm assuming you have dhcp helper on to handle the broadcast fowarding from one subnet to the other.

[FatBoy]

I haven't because my support people said that if I tag the ports correctly for the 10.143, VLAN 20 network even thought the APs are on a 10.140 address and the DHCP server is on 10.143 the VLAN should get the IP address though does that sound right to you? because I wasn't 100% convinced!

[SYNACK]

Unless there is some helper method in place they are full of it, DHCP works using broadcast traffic which is not routable. The way this has been mitigated in most networks is to set the router up with an ip helper address which pays attention to these broadcasts and fowards them as a unicast packat to the DHCP server on another network. As the unicast packet has a source address of the routers ip from the other network the DHCP server can tell that it is supposed to allocate an adress from that pool (assuming a pool is setup for that address range) and can then send it back to the router which fowards it along to the requesting station.

 

If it has worked for them either the fowarding method had somehow been setup in the past or the networks are not actually seporated and the broadcasts have leaked from one segment to another.

[FatBoy]

Added the IP Helper did work thanks SYNACK