Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
ma25sc
Explorer

DHCP Relay over Site-to-Site VPN

Jump to solution

Hi Checkmates,

 

I’ve recently setup a Site-to-Site VPN link between our head office and a remote office that will shortly be opened.  The VPN link is stable and works as expected, but I’m having trouble DHCP relaying for the remote site.  The remote site is quite small, so I want to use the DHCP servers in the head office for IP address leases.

Is there a guide that explains how to configure DHCP relay across a site-to-site VPN?

We have multiple VLANS in the head office, DHCP relay is enabled on the gateways and it works flawlessly.

Any help, pointers greatly appreciated.

PS. I have already configured DHCP relay on the remote gateway and added firewall rules as per sk104114.

PSS. Overview diagram of infrastructure is below.

Thank you.

 

.Diagram.png

0 Kudos
2 Solutions

Accepted Solutions
Timothy_Hall
Champion
Champion

Can't say that I have ever set something like this up, but the instructions to do this with embedded Gaia firewalls is described here:

sk107097: Configuring DHCP relay through Site-to-Site VPN on GAIA embedded Appliances

Also be sure to follow all steps precisely as shown in this SK, as it is a rather lengthy setup:

sk104114: Configuration of IPv4 BOOTP/DHCP Relay using new services

If I'm reading that first SK correctly, for your 5500 firewall you may need a manual NAT rule that ensures the initial DHCP Request is source NATted to the internal IP address of your 5500 on the interface where the DHCP request came in.  This internal IP Address must be contained within the 5500 firewall's VPN domain, which therefore will get encrypted into the tunnel to HQ assuming DHCP Relay is properly configured in the Gaia OS of the 5500. Setting the primary address in the DHCP Relay setup to the inside address of the 5500 may do the trick as well.

This NAT setup should be the equivalent of the "use internal IP as source" checkbox mentioned in the first SK, although the fwx_dhcp_relay_nat variable in the second SK might take care of this for you, not sure.

"Max Capture: Know Your Packets" Video Series
now available at http://www.maxpowerfirewalls.com

View solution in original post

(1)
genisis__
Advisor

I've got DHCP working across VPN, not really seen any issues with this other then on odd occasion rule reordering made it work.

Ensure on your remote gateway you have actually setup a relay, ensure the encryption domain contains the remote gateway and subnets.

 

As Tim mentions below ensure fwx_dhcp_relay_nat is set to 1 (I think this is only required if your using legacy DHCP) 

Ensure your routing is correct.

 

View solution in original post

2 Replies
Timothy_Hall
Champion
Champion

Can't say that I have ever set something like this up, but the instructions to do this with embedded Gaia firewalls is described here:

sk107097: Configuring DHCP relay through Site-to-Site VPN on GAIA embedded Appliances

Also be sure to follow all steps precisely as shown in this SK, as it is a rather lengthy setup:

sk104114: Configuration of IPv4 BOOTP/DHCP Relay using new services

If I'm reading that first SK correctly, for your 5500 firewall you may need a manual NAT rule that ensures the initial DHCP Request is source NATted to the internal IP address of your 5500 on the interface where the DHCP request came in.  This internal IP Address must be contained within the 5500 firewall's VPN domain, which therefore will get encrypted into the tunnel to HQ assuming DHCP Relay is properly configured in the Gaia OS of the 5500. Setting the primary address in the DHCP Relay setup to the inside address of the 5500 may do the trick as well.

This NAT setup should be the equivalent of the "use internal IP as source" checkbox mentioned in the first SK, although the fwx_dhcp_relay_nat variable in the second SK might take care of this for you, not sure.

"Max Capture: Know Your Packets" Video Series
now available at http://www.maxpowerfirewalls.com

View solution in original post

(1)
genisis__
Advisor

I've got DHCP working across VPN, not really seen any issues with this other then on odd occasion rule reordering made it work.

Ensure on your remote gateway you have actually setup a relay, ensure the encryption domain contains the remote gateway and subnets.

 

As Tim mentions below ensure fwx_dhcp_relay_nat is set to 1 (I think this is only required if your using legacy DHCP) 

Ensure your routing is correct.

 

View solution in original post