topic dhcp server for pix in Network Security

dhcp server for pix

rpalacio — Fri, 21 Feb 2020 08:32:16 GMT

dhcp server----pix-----dhcp clients

is it possible to have a dhcp server machine located on say the inside interface and the dhcp clients are on the dmz?

thanks

Re: dhcp server for pix

s.elmrabet — Sat, 19 Nov 2005 06:50:12 GMT

Hi Palacio

You cannot do this because the inside interface and the DMZ are on different broadcast domai!! you can use the pix as dhcp server on the DMZ interface but I don't know you architecture or you need.

Best Regards

Re: dhcp server for pix

rpalacio — Sat, 19 Nov 2005 07:07:55 GMT

what i was planning is putting a static command

static (inside, dmz) 192.168.2.2 192.168.1.2

where 192.168.1.2 is the dhcp server in the inside

and 192.168.2.2 is the ip address traslation to the dmz.

i understand that dhcp queery is on broadcast, and by this rule if my users on the dmz are doing this queery, isnt it 192.168.2.2 will catch that traffic and forward it to the dhcp server coz it was map into it by our static command?

Re: dhcp server for pix

s.elmrabet — Sat, 19 Nov 2005 07:20:55 GMT

No the pix act on layer 3 and above dhcp (boadcast) is layer 2, and when using access-list you specify IP, TCP or UDP you cannot specifie DHCP!!!

My question is why you need DHCP if you use the pix as dhcp server dose it solve your problem?

Regards

Re: dhcp server for pix

jackko — Sat, 19 Nov 2005 07:51:57 GMT

a feature named dhcprelay should resolve your issue. i've done the opposite, i.e. the dhcp server on the outside and the client on the inside. nonetheless, i guess the command "dhcprelay" should do.

e.g.

dhcprelay server 192.168.2.2 inside

dhcprelay enable dmz

Re: dhcp server for pix

rpalacio — Sat, 19 Nov 2005 10:22:33 GMT

customer dont want to put the dhcp burden on the pix. hence he has a dedecated dhcp machine

Re: dhcp server for pix

jackko — Sat, 19 Nov 2005 10:36:44 GMT

the way i posted is to relay the dhcp request. i.e. when pix receives the dhcp request broadcast from dmz interface, it will then relay the request to the pix inside interface dhcp server. in other words, pix doesn't act as a dhcp server, but a dhcp relay agent.

Re: dhcp server for pix

rpalacio — Sat, 19 Nov 2005 11:52:53 GMT

great answer..ive tried both directions and its ok..

thanks a lot.