Avaya G430 Manual page 511

Configuring dynamic local peer IP for a DHCP Client
Procedure
1. Permit DHCP packets in the ingress access control list (ACL) and the egress
Administering Avaya G430 Branch Gateway
ACL.
To do so, perform the following:
a. Use the no ip access-group command to deactivate both the ingress ACL
and the egress ACL on the FastEthernet interface.
b. Add a rule to the ingress ACL and to the egress ACL, permitting DHCP packets
to pass (for information on defining ACL policy rules, see
configuration on page 568).
c. Use the ip access-group command to activate the ingress ACL and the
egress ACL on the FastEthernet interface.
For example:
! Deactivate the Ingress and Egress ACLs on the FastEthernet Interface
!
Gxxx-001(config)# interface fastethernet 10/3
Gxxx-001(config-if:FastEthernet 10/3)# no ip access-group in
Done!
Gxxx-001(config-if:FastEthernet 10/3)# no ip access-group out
Done!
Gxxx-001(config-if:FastEthernet 10/3)# exit
!
! Add a Permit rule to the Ingress ACL for DHCP
!
Gxxx-001(config)# ip access-control-list 301
Gxxx-001(config-ACL 301)# ip-rule 25
Gxxx-001(config-ACL 301/ip rule 25)# source-ip any
Done!
Gxxx-001(config-ACL 301/ip rule 25)# destination-ip any
Done!
Gxxx-001(config-ACL 301/ip rule 25)# ip-protocol udp
Done!
Gxxx-001(config-ACL 301/ip rule 25)# udp source-port eq bootps
Done!
Gxxx-001(config-ACL 301/ip rule 25)# udp destination-port eq bootpc
Done!
Gxxx-001(config-ACL 301/ip rule 25)# composite-operation permit
Done!
Gxxx-001(config-ACL 301/ip rule 25)# exit
Gxxx-001(config-ACL 301)# exit
!
! Add a Permit rule to the Egress ACL for DHCP
!
Gxxx-001(config)# ip access-control-list 302
Gxxx-001(config-ACL 302)# ip-rule 25
Gxxx-001(config-ACL 302/ip rule 25)# source-ip any
Done!
Gxxx-001(config-ACL 302/ip rule 25)# destination-ip any
Done!
Gxxx-001(config-ACL 302/ip rule 25)# ip-protocol udp
Done!
Gxxx-001(config-ACL 302/ip rule 25)# udp source-port eq bootpc
Done!
Gxxx-001(config-ACL 302/ip rule 25)# udp destination-port eq bootps
Done!
Gxxx-001(config-ACL 302/ip rule 25)# composite-operation permit
Done!
IPSec VPN
Policy rule
October 2013 511