topic Re: How to differentiate between two external DHCP servers in Network Security

How to differentiate between two external DHCP servers

Ditter — Fri, 25 Oct 2024 15:13:09 GMT

Hi to all ,

running software version (FMC) 7.4.2-172 and FTD 7.2.8.

How can i differentiate and use as external DHCP server , for example DHCP-SERVER-1 for some vlans and for some other vlans to use as DHCP server the DHCP-SERVER-2?

I have added both servers is DHCP servers tab , but in DHCP Relay tab , i can not differentiate for each vlan the server i need to use.

Any ideas?

Thanks,

Ditter.

Re: How to differentiate between two external DHCP servers

balaji.bandi — Fri, 25 Oct 2024 16:25:01 GMT

Hope your DHCP Server have respected DHCP pool relation to the VLAN right, or both DHCP Sever have all VLAN IP address (then that is tricky)

if the each DHCP host different VLAN IP address then that does not matter client will go order of DHCP Server to get IP address - based on the vlan its orginating from)

as long as the VLAN SVI have correct helper address.

Re: How to differentiate between two external DHCP servers

Ditter — Fri, 25 Oct 2024 16:40:05 GMT

Thanks @balaji.bandi

All the vlans in the FTD should use one of two external DHCP Servers , so the FTD relays this info, but i do not understand how to define the correct helper address in the FTD (an mentioned some FTD vlans use one dhcp server and some others should use another DHCP server).

I can not find how to indicate to different vlans a different external DHCP server (a DHCP server serves many vlans and resides in the outside interface of the FTD).

Thanks,

Ditter

Re: How to differentiate between two external DHCP servers

Rob Ingram — Fri, 25 Oct 2024 16:58:53 GMT

@Ditter I don't believe you still cannot define a different DHCP server per VLAN. You'd have to define multiple DHCP servers for all VLANs, which DHCP server has the scope for that network would respond. Or use a helper address on the local switch instead of the FTD and then you define different DHCP servers per VLAN.

Re: How to differentiate between two external DHCP servers

Ditter — Fri, 25 Oct 2024 17:11:26 GMT

Sorry but i am confused. Look at the two screenshots , maybe i can not express correctly what i mean.

I would like vlan 3 to point to external dhcp server 192.168.65.7 and vlan 100 to point to external server 192.168.65.8.

Is that possible?

Currently it works OK when i have only dhcp server 192.168.65.7 , but when i add another dhcp server 192.168.65.8 how can i point clients in vlan 100 to go to 192.168.65.8 (instead of 192.168.65.7). Shouldn't i be able to define the helper address inside the FTD?

Re: How to differentiate between two external DHCP servers

Rob Ingram — Fri, 25 Oct 2024 17:17:56 GMT

@Ditter no, that's not possible.

Re: How to differentiate between two external DHCP servers

Ditter — Fri, 25 Oct 2024 17:26:01 GMT

@Rob Ingram @balaji.bandi That is sad, it would help to differentiate FTD Vlans pointing to different DHCP Servers.

Maybe in a future release?

We will see,

Ditter

😞

Re: How to differentiate between two external DHCP servers

balaji.bandi — Sat, 26 Oct 2024 07:56:28 GMT

Since its Firewall we don't expect more of the enterprise Lan features needed, that is my views.

firewall in the path, so end edge device make decision what DHCP Server to be used most cases.

Re: How to differentiate between two external DHCP servers

MHM Cisco World — Tue, 29 Oct 2024 12:22:19 GMT

I dont see why you can not do that
you have two interface one for each VLAN
then using different server to assign IP for each client

can you more elaborate

thanks

MHM

Re: How to differentiate between two external DHCP servers

Cristian Matei — Tue, 29 Oct 2024 23:44:25 GMT

Hi,

You can't make a one-to-one mapping on FTD, however you can apply a workaround. As long as DHCP server on 192.168.65.7 ONLY has pool configured for VLAN3 subnet and DHCP server on 192.168.65.8 ONLY has pool configured for VLAN100, it will work with provided config. FTD will relay each DHCP Client Discovery message from both VLANs to both DHCP servers, however only the DHCP server with the configured pool will reply, as FTD will insert its VLAN3 and VLAN100 IPv4 addresses as GIADDR field within DHCP payload, thus instructing DHCP servers from which pool to assign IP addresses.

Best,

Cristian.

Re: How to differentiate between two external DHCP servers

Ditter — Wed, 30 Oct 2024 14:51:03 GMT

Hi MHM, i have described it above.

Some vlans on the FTD need to ask a specific DHCP server that serves these specific FTD based vlans , but i need for a specific vlan on the FTD to use another DHCP server. I send again the two png from my config:

In these pngs you can see only two user vlans but there exist more.

Thanks.

Re: How to differentiate between two external DHCP servers

Ditter — Wed, 30 Oct 2024 14:55:35 GMT

Thanks for your answer.

The problem is that one of these DHCP servers, serves many vlans and the second DHCP server serves only one vlan.