cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6725
Views
10
Helpful
7
Replies

ASA dhcprelay per interface

ippolito
Level 1
Level 1

I have an ASA-5505 with 3 vlans: outside, inside1, and inside 2. I'd like DHCP requests from inside1 and inside2 to go to different DHCP servers, depending on which interface the requests are received on. It would be the equivalent of issuing ip helper-address commands on two different router interfaces. It doesn't appear to be possible on the ASA-5505. Is that really correct??? If so, then do any of the other ASA models provide this capability?

Thanks

Mike

1 Accepted Solution

Accepted Solutions

that's correct. give it a go and let me know the outcome.

Franco

View solution in original post

7 Replies 7

amritpatek
Level 6
Level 6

For your network you should better use a router or a switch for DHCP requests to be guided to DHCP servers depending on the interface. You can put the ASA after the router in your network.

you can configure your ASA to be a Dynamic Host Configuration Protocol (DHCP) relay.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a008075fcfb.shtml

Franco

Please rate if this helps.

Thanks, I know about dhcp relay -- this is exactly what I'm trying to use. But I want to relay to two different dhcp servers - one for dhcp requests on vlan1, one for dhcp requests on vlan2. If I understand how the ASA works, it will forward all packets from all vlans on which dhcp relay is enabled to ALL of the dhcp relay servers that are configured.

All the ASA is doing is just relay the dhcp request between client and server. When the DHCP relay agent on the ASA appliance receives a DHCP request from a host on one of it interface, it will forward the request to one of the specified DHCP servers on an interface the servers are behind. When the DHCP server replies to the client, the security appliance forwards that reply back.

to answer your question: Just make sure both that both DHCP servers are setup on the asa for example if the servers are behind the inside interface "dhcprelay server **** inside" and make sure the servers are setup with the correct dhcp scope for the vlan1 and vlan 2. when the request is sent fromt her asa to the dhcp server, as long as the server have a dhcp scope for the correct vlan, it will respond back with an ip address to the asa and the asa will relay it to the client.

I'm i making sense?

Franco

That makes sense, thank you very much. If I understand correctly: as long as the ASA 5505 is compliant with RFC 1542, it will substitute its own gateway address into the dhcp request packet before it forwards it to the dhcp servers.

Then when the dhcp servers receive the request, it will know whether it needs to reply with an address based on if it has a dhcp scope configured that corresponds to the relay address provided in the request. (assuming the dhcp servers are also rfc compliant and don't just blindly reply to all dhcp requests)

Do I have that correct?

thanks

mike

that's correct. give it a go and let me know the outcome.

Franco

That worked, thank you very much for your help. How to I tag this message as having been resolved?

Thanks,

Mike

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: