topic Re: FWSM DHCP-Relay in Network Security

FWSM DHCP-Relay

Mon Baul — Mon, 11 Mar 2019 19:55:01 GMT

Hi All,

I'm in th process of configuring FWSM to relay DHCP request from the client pc/ip phone going to our DHCP server. But the thing is, my client pc/ipphone are not connected directly to FWSM instead i have a L3 switch for the data/voice vlan and configure ip-helper address 10.1.1.200 on svi.

The FWSM and L3 switch are connected via P2P. Is there any way that this will work, I know that it says on cisco documentation that clients should be connected to FWSM but I hope there will be workaround or else I will configure DHCP server on the L3 switch which is not a good practice.

I attached my diagram for reference. I will appreciate all your comments/suggestions. Thanks in advance!

Cheers,

Reymon

Re: FWSM DHCP-Relay

martin_knorre — Wed, 23 Feb 2011 12:40:39 GMT

hi Reamon,

you issued the IP Helper command on every VLAN, so the BC is turned into a Unicast and is directed to the DHCP Server. So you have to allow the Unicast from the Subnet / VRF Instance on the Security Context of the FWSM. And I think that should work, in this case the FWSM is nothing other than a normal firewall --> permit (bootps port:67).

Regards Martin

Re: FWSM DHCP-Relay

Mon Baul — Thu, 24 Feb 2011 06:51:23 GMT

Hi Martin,

Thanks for your reponse.

I already did what you have said to allow udp 67/68 from client subnet to dhcp server vice-versa but still no success.

You are correct that the fwsm should be a normal firewall in this way but it's not. Have you tried doing this before, if yes can you please tell me how did you do it?

Thanks and Best Regards

Reymon

Re: FWSM DHCP-Relay

martin_knorre — Thu, 24 Feb 2011 07:51:00 GMT

Hi Reymon,

sorry we have another structure in our DC, with a security context for every vlan, so we usually assign the relay agent to this context without a Layer 3 instance before the FWSM.

Do you notice the reject of the communication on the Firewall logging?

rgds Martin

Re: FWSM DHCP-Relay

Mon Baul — Thu, 24 Feb 2011 08:00:05 GMT

Hi Martin,

So each context has relay agent configured and client pc is connected directly to context vlan, right? The logs that I see is only the bootpc udp 67 coming from client pc subnet but nothing from dhcp server interface.

regards

reymon

Re: FWSM DHCP-Relay

martin_knorre — Thu, 24 Feb 2011 08:54:49 GMT

Hi Reymon,

so when the answer from the server didn't come back, maybe this is the problem, have you checked the routing? Can you trace a route ?

Regards

Martin

Re: FWSM DHCP-Relay

Mon Baul — Mon, 28 Feb 2011 05:21:16 GMT

Hi Martin,

Traceroute is working on both side. What i did is setup another server and create another vlan for the server and put the server in there. After activating thd dhcp scope, it works fine. The one I notice is that dhcp ps doesn't work when the dhcp server is connected to another router and router to fwsm.

Anyway, this issue is resolve.

Many thanks!

Reymon