So I have 2 core switches and 1 access switch, I have the vlans 1, 10, 20, 30 and 100. Vlan 10 is voip and what I would like to do is stop anyone on the other vlans from being able to see that subnet, but the phones get dhcp from a server on vlan 100. Vlan 100 is just servers so if it comes to it vlan 100 can access vlan 10.

My main gole it's to ensure that no one on the other vlans can see the phone network and the phones can still get dhcp. Currently for intervlan routing I am using ospf on a 2811 router with the network as

The ip ranges are as follows:

Vlan 1 - -Mgmt Vlan 10 - - VOIP Vlan 20 - - PC's Vlan 30 - - WiFi Vlan 100 - - Servers


  • Can you explain what exactly you mean by "no one on the other vlans can see the phone network" ? E.g. do you want ping from 10.1.100.x to 10.1.10.x to fail? – mere3ortal Mar 11 '18 at 2:57
  • I don't want vlan 10 to be 'pingable' from any other vlan – AvidPontoon Mar 11 '18 at 11:55
  • OK, in that case, in addition to the helper-address you will have to configure appropriate ACLs on vlan 10 to prevent traffic from other VLANs entering vlan 10. – mere3ortal Mar 11 '18 at 13:01

On the 2811:

ip access-list extended VOIP-ONLY 
permit udp <address of dhcp server> any eq bootps

interface x/y.z
description The 2811 interface that connects to VLAN10
ip access-group VOIP-ONLY out
ip helper-address <address of DHCP server>

Configure access -list in L3 switch as per your business requirements and isolate traffic among VLANs . And ensure DHCP hosted server Vlan and other vlans to talk to each other . So that ip location will be proper .


You can configure

ip helper-address <address of DHCP server>

on Vlan10 (and in fact on all other Vlan interfaces as well). Only DHCP packets will go between Vlan10 and Vlan100, and all other L2 traffic remains isolated as expected.

  • 2
    This won’t stop other vlans from reaching vlan 10 – Ron Trunk Mar 10 '18 at 19:04

in your 2811 router, on the sub-interface connecting to vlan10 you can give "ip helper-address x.x.x.x" ( where x.x.x.x is DHCP server IP). when phones send DHCP discover broadcasts, router will relay it to DHCP server (relay IP address field will be filled with that sub-interface ip so that DHCP server can assign IP address from particular pool).

You can do the same on each sub interface if every network IPs are given by DHCP server. you can use access lists or zone-based firewall in 2811 for access restrictions

  • 2
    This won’t stop other vlans from reaching vlan 10 – Ron Trunk Mar 10 '18 at 19:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.