IP helper with ACL on SVI

Just another short post about IP helpers:

It took me last week a few minutes to figure out why my new configured IP helpers were not working.

The starting config was like:

interface Vlan6
 description Voice VLAN
 ip address
 ip access-group Voice in
 ip helper-address
 ip helper-address
 no ip redirects
 no ip unreachables
 standby 6 ip
 standby 6 timers 1 2
 standby 6 priority 110
 standby 6 preempt
ip access-list extended Voice
 permit ip host
 permit ip host
 permit ip
 permit ip any host

At this point, clients in Vlan 6 are not receiving a IP address from the DHCP server.

As we all know, a DHCP request starts with a broadcast on IP These packets are being blocked by the incoming ACL at this moment! You can check this with debugging the ACL. The problem is clear: we have to edit the ACL.

Adding the following ACL rule, will allow these DHCP request packets to get to the IP helper address:

 permit udp any host eq bootps

Problem solved :-)