topic Re: FPR-1010 sub inerfaces and DHCP relay in Network Security

FPR-1010 sub inerfaces and DHCP relay

Martin — Thu, 18 Jul 2024 19:22:34 GMT

Hi,

I need to create sub ports on the inside interface for VLANs 10,20,30,40 and 100 and each subport needs to be pointed to my DHCP server is this possible please.

I could get away with creatin just access ports for each VLAN but would still need to point them to me DHCP server.

Is this possible, if so any guides for this?

TIA

Re: FPR-1010 sub inerfaces and DHCP relay

MHM Cisco World — Thu, 18 Jul 2024 19:26:37 GMT

I check FTD there is no restriction of use subinterface as dhcp relay
so you can use it

MHM

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Thu, 18 Jul 2024 19:53:03 GMT

How do I set it up though please

Re: FPR-1010 sub inerfaces and DHCP relay

MHM Cisco World — Thu, 18 Jul 2024 21:01:56 GMT

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200475-Configure-DHCP-Server-Relay-on-FTD-Using.html

check this link

MHM

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Thu, 18 Jul 2024 23:21:06 GMT

thats good guide but the software is totaly differnt to mine

Re: FPR-1010 sub inerfaces and DHCP relay

ccieexpert — Fri, 19 Jul 2024 01:41:05 GMT

If its ASA code use this:

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116265-configure-product-00.html

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 13:20:28 GMT

Its not ASA

It is FPM, i have done the sub interfaces all i need is a simple instruction to point them to the DHCP server

Re: FPR-1010 sub inerfaces and DHCP relay

MHM Cisco World — Fri, 19 Jul 2024 13:22:42 GMT

are you use FDM for FPR ?

MHM

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 13:27:07 GMT

i log straight into the management port of the device and it has Firepower Manager

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 13:28:48 GMT

Sorry it is FDM, this is the screen shot

Re: FPR-1010 sub inerfaces and DHCP relay

MHM Cisco World — Fri, 19 Jul 2024 13:35:52 GMT

BugZero | Cisco BugID CSCvt25678 - ENH: Firepower Device Manager FDM to include DHCP ... (findbugzero.com)

I dont think it support by FDM
but let me see the cisco new update maybe it can support dhcp relay

MHM

Re: FPR-1010 sub inerfaces and DHCP relay

Rob Ingram — Fri, 19 Jul 2024 13:53:13 GMT

@Martin you cannot natively configure DHCP relay using FDM, you can use the Firepower Threat Defense API to configure DHCP relay. Using DHCP relay on an interface, you can direct DHCP requests to a DHCP server that is accessible through the other interface. You can configure DHCP relay on physical interfaces, subinterfaces, EtherChannels, and VLAN interfaces. You cannot configure DHCP relay if you configure a DHCP server on any interface.

To open the API Explorer, where you can view the resources, log into FDM, then click the more options button () and choose API Explorer.

https://community.cisco.com/t5/network-security/cisco-ftd-7-0-manage-by-fdm-dhcp-relay/td-p/4469376

If you are unfamilar with using API it might be easier configuring the local switch with ip helper-address.

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 14:03:45 GMT

Thanks, im not sure about using APIs, i can look into it.

I dont have the SVIs on the switch as i was using an ASA5506 previously that i could setup sub interfaces and DHCP relay on each no problem and worked a treat.

If i setup the SVIs on the local switch can i then still use the sub interfaces on the 1010 to control each vlan independantly

Re: FPR-1010 sub inerfaces and DHCP relay

MHM Cisco World — Fri, 19 Jul 2024 14:08:26 GMT

if you have SW then the config will be
1- config SVI in SW for each VLAN
2- config ip dhcp helper under SVI
3- config DHCP server to use FPR subinterface IP as GW for Host not use SVI of SW

that solve your issue since FDM not support dhcp reply
NOTE:- I can you need to allow dhcp traffic in FPR between VLAN by add ACL

MHM

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 14:10:03 GMT

Sorry what is SW?

Re: FPR-1010 sub inerfaces and DHCP relay

MHM Cisco World — Fri, 19 Jul 2024 14:12:54 GMT

Switch

MHM

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 14:29:11 GMT

if i upgrade to 7.2.x then that adds the DHCP relay to the GUI

Re: FPR-1010 sub inerfaces and DHCP relay

Rob Ingram — Fri, 19 Jul 2024 14:36:16 GMT

@Martin no, unfortunately that is for FMC not if using FDM, as per the 7.2 release notes under the Management Server section https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/release-notes/threat-defense/720/threat-defense-release-notes-72.html

And the FDM 7.4 guide still states you configure DHCP relay using API. https://www.cisco.com/c/en/us/td/docs/security/firepower/740/fdm/fptd-fdm-config-guide-740/fptd-fdm-advanced.html

If you don't require NGFW functionality on the FDM, you could just reimage the device to ASA code.

Re: FPR-1010 sub inerfaces and DHCP relay

Martin — Fri, 19 Jul 2024 16:19:32 GMT

Is there any guide on doing it with API?

Re: FPR-1010 sub inerfaces and DHCP relay

ccieexpert — Sat, 20 Jul 2024 02:50:05 GMT

Here is a good guide to how to use the API:

https://developer.cisco.com/learning/modules/fdm-api/FDM_RESTAPI_102/introduction/

i can help you 🙂