Unsolved
This post is more than 5 years old
3 Posts
0
1552
January 16th, 2017 07:00
Mac based ACE blocking DHCP traffic? (PowerConnect 5548)
Hi all,
we have a PowerConnect 5548 switch here that is only used for IP phones.
To be sure that no other device works at a port of the switch a mac based ACL was created.
It is applied to port gi1/0/1 which is connected to the router with a DHCP server and looks like that:
mac access-list extended mac-voip-devices-acl1
permit 00:08:5d:00:00:00 00:00:00:ff:ff:ff any vlan 21
permit any 00:08:5d:00:00:00 00:00:00:ff:ff:ff vlan 21
permit 00:0e:08:00:00:00 00:00:00:ff:ff:ff any vlan 21
permit any 00:0e:08:00:00:00 00:00:00:ff:ff:ff vlan 21
....
.... some more ACE
....
....
deny any any vlan 21
exit
All the phones with a MAC address of the specified ranges are working fine.
No we got a new IP phone that does not belong to any of these MAC address ranges so I created a new entry. Now it looks like this:
mac access-list extended mac-voip-devices-acl1
permit 00:08:5d:00:00:00 00:00:00:ff:ff:ff any vlan 21
permit any 00:08:5d:00:00:00 00:00:00:ff:ff:ff vlan 21
permit 00:0e:08:00:00:00 00:00:00:ff:ff:ff any vlan 21
permit any 00:0e:08:00:00:00 00:00:00:ff:ff:ff vlan 21
....
.... some more ACE
....
....
permit bc:c3:42:00:00:00 00:00:00:ff:ff:ff any vlan 21
permit any bc:c3:42:00:00:00 00:00:00:ff:ff:ff vlan 21
deny any any vlan 21
exit
Unfortunatly this phone does not get an IP address of the DHCP server when the ACL is applied.
As soon as I remove the ACL from the port the phone gets an IP address and works. When I set a static IP address in the managment interface of the phone it also work.
Could you tell me what I am doing wrong?
Best regards
Marco
0 events found
msiefert_htgf
3 Posts
0
January 17th, 2017 05:00
Hi Daniel,
thanks for the information.
I could not find anything in the switch logs that is related to the problem.
As you wrote I have double and triple checked the MAC address, copied it from the address table and the ACL to notepad, compared it etc. A collegue also checked it.
The ACE counters all show 0.
We made a packet capture on the phone port and on the router facing port.
On both ports we see a DHCP discover packet from the phone.
On the router facing port we see a DHCP offer packet sent by the router but it seems that it does not reach the phone.
33 293.264650 0.0.0.0 255.255.255.255 DHCP 375 DHCP Discover - Transaction ID 0x69368774
34 293.265572 192.168.0.1 255.255.255.255 DHCP 342 DHCP Offer - Transaction ID 0x69368774
Do you have more suggestions?
Thanks a lot
Marco
msiefert_htgf
3 Posts
0
January 18th, 2017 00:00
Yes we have some other phones that are connected to the switch and are working fine. Just this phone has the problem. It seems to handle DHCP different than the other phones.
The switch is on firmware version 4.0.1.11 so it seems that I should update it to 4.1.0.20.