topic Re: Cisco FTD DHCP Problem in Network Security

Cisco FTD DHCP Problem

behrouz6408021 — Thu, 28 Jan 2021 07:35:53 GMT

Hello

I have Collapse Core Network and My Core Switch is 6500 . The Core handling Inter VLAN Routing and it is gateway for my clients . in the next hop after Core Switch i have ASA 5525X . and every things is OK

when replace ASA with FPR4110 all of things OK except DHCP traffic

My DHCP server is Windows Server . when cliente request IP address from DHCP Server Some Client can obtain IP Address and many not obtain IP address .

Re: Cisco FTD DHCP Problem

balaji.bandi — Thu, 28 Jan 2021 10:52:20 GMT

have you configured DHCP relay agent :

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200475-Configure-DHCP-Server-Relay-on-FTD-Using.html

Re: Cisco FTD DHCP Problem

Marius Gunnerud — Thu, 28 Jan 2021 14:28:34 GMT

in addition to what @balaji.bandi has mentioned, are all the clients on the same subnet or are they on different subnets? Is traffic opened for UDP/53 in the FDT firewall for DHCP traffic that needs to traverse the firewall?

Re: Cisco FTD DHCP Problem

behrouz6408021 — Fri, 29 Jan 2021 13:50:07 GMT

Our Clients are in different subnets and Core Switch (6500) is the gateway of our clients

and all of config related to "IP helper " under Core Switch interface is done .

this scenario is OK with ASA and all of DHCP traffic are allowed in ASA .

when replaced ASA with FTD 4110 ( DHCP Traffic allowed on FTD ) clients cannot obtain IP Address from DHCP server . our DHCP Server is Microsoft windows Server.

One of the things I suspect is DHCP Snooping and DHCP option on our Access Switch and Core Switch. but i cannot test it

DHCP traffic is UDP/67 and UDP/68 .

Re: Cisco FTD DHCP Problem

behrouz6408021 — Fri, 29 Jan 2021 13:56:49 GMT

But what is different between Cisco ASA and FTD in DHCP Snooping Options and Packet ?

when ASA is the next hop of Core Switch all of thing about DHCP and IP address obtaining are OK

when replaced with FTD 4110 i cannot seen DHCP requested from Source Interface VLAN on Core Switch .

Re: Cisco FTD DHCP Problem

Marius Gunnerud — Fri, 29 Jan 2021 14:45:41 GMT

Yes, sorry, I got mixed up with another case when I mentioned UDP/53.

I have seen this issue a few times. In the situations that I was involved with the connection table showed that connections for DHCP was setup towards the outside interface (i.e. default route for internet was being established before dynamic routing). A clear connection on the FTD CLI solved the issue.

I had TAC on the case and they did a change...which escapes me right now. I will try to find the solution they came with

Re: Cisco FTD DHCP Problem

vikas.gupta@pbfenergy.com — Wed, 02 Mar 2022 14:53:03 GMT

Were you able to find the solution that TAC did?

Thanks