Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Baffling PIX VPN problem!

Hi

I have encountered a problem which is baffling me.

I have 2 PIXs - say PIX A and PIX B. A LAN to LAN VPN tunnel runs between the outside interface of PIX A and the inside interface of PIX B. This tunnel is up.

To PIX A's inside interface is connected a laptop set as a dhcp client.

The dhcp config on PIX A is as follows:

dhcprelay server 172.18.65.2 outside

dhcprelay enable inside

and IP details:

System IP Addresses:

ip address outside 10.95.230.26 255.255.255.0

ip address inside 172.18.25.254 255.255.255.0

PIX B at the remote end is connected (via it's outside interface) to a 6509 on which sits the dhcp server.

When I trace a dhcp request from the laptop on PIX A I get (what seems to me) a strange result.

The trace is ran on PIX B's outside interface as a 'debug packet' command. The destination address is the dhcp server (172.18.65.2) as I'd expect. However the source address is 10.95.230.26. This is the address of PIX A's outside interface - i.e the VPN tunnel starting point. A packet trace on the 6509 confirms the source ip address to be 10.95.230.26. Surely once the packet has exited the tunnel on PIX B the tunnel encapsulation should be stripped off, leaving the original source and destination IP addresses.

I was expecting the source address for the dhcp request to be 172.18.25.254, which is the IP of the interface to which the dhcp client is connected. This is causing me some big headaches with routing and security access on the 6509- am I missing something?!

1 REPLY
Silver

Re: Baffling PIX VPN problem!

The PIX A will use the IP address of its outside interface and not of the inside interface. Thsi is fine as long as you are not facing any problems with your DHCP relay clients.

114
Views
0
Helpful
1
Replies
CreatePlease to create content