N10-009 Question 61
Single answerDHCP: 67/68A network administrator deploys a new DHCP server for a branch office. After the change, users on the local subnet report they are not receiving IP addresses automatically. A packet capture from a client shows DHCPDISCOVER messages leaving the client on UDP source port 68, but no DHCPOFFER messages are returned. The DHCP server is online and reachable by IP from other managed devices. The administrator suspects a firewall rule between the client VLAN and the server VLAN is blocking required DHCP traffic. Which firewall change is the BEST way to restore DHCP service?
- A
Allow UDP traffic from client source port 68 to server destination port 67
- B
Allow TCP traffic from client source port 68 to server destination port 67
- C
Allow UDP traffic from server source port 68 to client destination port 67
- D
Allow TCP traffic from server source port 67 to client destination port 68
Show answer and explanation
Correct answer: A
Explanation
DHCP for IPv4 uses UDP ports 67 and 68. Clients send from UDP 68 to UDP 67, and servers respond from UDP 67 to UDP 68. In this scenario, the capture shows the client's DHCPDISCOVER leaving successfully but no offer returning. The best immediate firewall change is to allow the client-to-server DHCP request path using UDP 68 to 67. In practice, administrators often need to allow both directions or use stateful inspection so return traffic from UDP 67 to 68 is also permitted automatically. This behavior aligns with standard DHCP operation as documented in RFC 2131, which defines DHCP message exchange and port usage.
- A. Correct.
Correct. DHCP uses UDP, not TCP. A client sends DHCPDISCOVER and DHCPREQUEST messages from UDP port 68 to UDP port 67 on the DHCP server or relay destination. If this traffic is blocked, the server will never receive the client's request and cannot respond with a DHCPOFFER. This is the most direct rule needed based on the capture described.
- B. Incorrect.
Incorrect. DHCP does not use TCP for normal address assignment. Someone might choose this if they remember the port numbers but confuse the transport protocol. Permitting TCP 68 to 67 would not help DHCP clients obtain leases.
- C. Incorrect.
Incorrect. This reverses the standard DHCP port usage. Server replies such as DHCPOFFER and DHCPACK are typically sent from UDP port 67 to UDP port 68 on the client. Choosing this option reflects a common mistake of swapping client and server port roles.
- D. Incorrect.
Incorrect. This option uses the correct general direction of server-to-client port numbering, but the wrong transport protocol. DHCP replies are sent with UDP, not TCP, so this rule would not restore service.