Sfruttare al meglio DHCP a ACL ad esso collegate.

[zot]

837 con 12-4-5b e la seguente configurazione:

no service pad
service timestamps debug uptime
service timestamps log uptime
service password-encryption
!
hostname router
!
username zot privilege 15 password xxxxxxxxxxxxx
!
ip domain name xxxxxxxxxxxxx.lan
ip name-server 151.99.125.1 151.99.0.100
ip dhcp excluded-address 192.168.1.1 192.168.1.19
ip dhcp excluded-address 192.168.1.99 192.168.1.254
!
ip dhcp pool CI_CLIENT
network 192.168.1.0 255.255.255.0
domain-name xxxxxxxxxxxxx.lan
default-router 192.168.1.1
dns-server 151.99.125.1 151.99.0.100 212.216.112.112
lease 1 0 0
!
ip dhcp pool TS_SERVER
host 192.168.1.10 255.255.255.0
client-identifier 0030.058b.dd71
!
ip dhcp pool DB_SERVER
host 192.168.1.60 255.255.255.0
hardware-address 0100.50ba.c413.bc
!
ip inspect name myfw cuseeme timeout 3600
ip inspect name myfw ftp timeout 3600
ip inspect name myfw rcmd timeout 3600
ip inspect name myfw realaudio timeout 3600
ip inspect name myfw tftp timeout 30
ip inspect name myfw udp timeout 15
ip inspect name myfw tcp timeout 3600
ip inspect name myfw h323 timeout 3600
ip audit notify log
ip audit po max-events 100
!
interface Ethernet0
description Interfaccia Ethernet Interna
ip address 192.168.1.1 255.255.255.0
ip access-group 130 in
ip nat inside
no ip route-cache
no ip mroute-cache
hold-queue 100 out
no shutdown
!
interface ATM0
no ip address
no ip route-cache
no atm ilmi-keepalive
dsl operating-mode auto
no shutdown
!
!
interface ATM0.1 point-to-point
description Interfaccia WAN Esterna
ip address yyy.yyy.yyy.yyyy 255.255.255.0
ip access-group 120 in
ip nat outside
ip inspect myfw out
no ip route-cache
no ip mroute-cache
no shutdown
pvc 8/35
encapsulation aal5snap
!
ip nat pool IP_NAT_OUTSIDE yyy.yyy.yyy.yyyy yyy.yyy.yyy.yyyy netmask 255.255.255.0
ip nat inside source list 100 pool IP_NAT_OUTSIDE overload
ip classless
ip route 0.0.0.0 0.0.0.0 ATM0.1
!
access-list 23 remark *** ACL per Teleassistenza
access-list 23 permit xxx.xxx.xxx.xxx.
access-list 23 permit 192.168.1.0 0.0.0.255
access-list 100 remark *** ACL per IP_NAT_OUTSIDE
access-list 100 permit ip 192.168.1.0 0.0.0.255 any
access-list 120 remark *** ACL controllo ingressi ATM0.1 NET_IN
access-list 120 permit icmp any any administratively-prohibited
access-list 120 permit icmp any any echo
access-list 120 permit icmp any any echo-reply
access-list 120 permit icmp any any packet-too-big
access-list 120 permit icmp any any time-exceeded
access-list 120 permit icmp any any traceroute
access-list 120 permit icmp any any unreachable
access-list 120 deny ip any any
access-list 130 remark *** ACL controllo ingressi Ethernet0 NET_OUT
access-list 130 permit icmp 192.168.1.0 0.0.0.255 any
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq 23
access-list 130 permit udp 192.168.1.0 0.0.0.255 any eq domain
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq domain
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq www
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq 443
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq smtp
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq pop3
access-list 130 permit tcp 192.168.1.0 0.0.0.255 any eq ftp
access-list 130 deny ip any any
!
line con 0
exec-timeout 120 0
no modem enable
stopbits 1
line aux 0
line vty 0 4
access-class 23 in
exec-timeout 120 0
length 0
!
scheduler max-task-time 5000

I problemi sono due 1)non riesco a far prendere degli indirizzi IP fissi tramite MAC address ho provato sia client-identifier che hardware-address
ma non ne vogliono sapere,si prendono sempre gli indirizzi rilasciati dal pool CI_CLIENT.
2)La ACL 130 per il traffico OUT così com'è non lascia passare traffico in broadcast in particolare per l'assegnazione degli indirizzi in DHCP ho provato con " access-list 130 permit udp any any eq bootpc " ma oltre a non funzionare,leggendo,mi è sembrato di capire che serva nel caso di rilasci indirizzi tramite file o qualcosa del genere.
Qualche suggerimento?

[zot]

OK il primo punto l'ho risolto : semplicemente è bastato clear ip dhcp binding * infatti se ha già salvata l'associazione MAC ed indirizzo ip dinamico,continua a fornirgli quest'ultimo.Per la cronaca anche se è stato ridetto mille volte con Windows è quasi obbligatorio usare client-identifier
Mi manca il secondo punto : una ACL per permettre ai CLient di fare traffico "per la richiesta" DHCP.

[active]

Entrata porta 68 e uscita porta 67?

[zot]

Grazie così va....avevo confuso "bootpc" con "bootps"

access-list 130 permit udp any any eq bootps