Cisco Vlan block access

Question

So I have 2 core switches and 1 access switch, I have the vlans 1, 10, 20, 30 and 100. Vlan 10 is voip and what I would like to do is stop anyone on the other vlans from being able to see that subnet, but the phones get dhcp from a server on vlan 100. Vlan 100 is just servers so if it comes to it vlan 100 can access vlan 10.

My main gole it's to ensure that no one on the other vlans can see the phone network and the phones can still get dhcp. Currently for intervlan routing I am using ospf on a 2811 router with the network as 0.0.0.0

The ip ranges are as follows:

Vlan 1 - 10.1.1.0/24 -Mgmt Vlan 10 - 10.1.10.0/24 - VOIP Vlan 20 - 10.1.20.0/24 - PC's Vlan 30 - 10.1.30.0/24 - WiFi Vlan 100 - 10.1.100.0/24 - Servers

Thanks

Answer 1

On the 2811:

ip access-list extended VOIP-ONLY 
permit udp <address of dhcp server> any eq bootps

interface x/y.z
description The 2811 interface that connects to VLAN10
ip access-group VOIP-ONLY out
ip helper-address <address of DHCP server>

Answer 2

Configure access -list in L3 switch as per your business requirements and isolate traffic among VLANs . And ensure DHCP hosted server Vlan and other vlans to talk to each other . So that ip location will be proper .

Answer 3

You can configure

ip helper-address <address of DHCP server>

on Vlan10 (and in fact on all other Vlan interfaces as well). Only DHCP packets will go between Vlan10 and Vlan100, and all other L2 traffic remains isolated as expected.

Answer 4

in your 2811 router, on the sub-interface connecting to vlan10 you can give "ip helper-address x.x.x.x" ( where x.x.x.x is DHCP server IP). when phones send DHCP discover broadcasts, router will relay it to DHCP server (relay IP address field will be filled with that sub-interface ip so that DHCP server can assign IP address from particular pool).

You can do the same on each sub interface if every network IPs are given by DHCP server. you can use access lists or zone-based firewall in 2811 for access restrictions