Cisco FirePower 1010 DHCP Options

[rob1456657]

Hi all, I have a new Cisco FirePower 1010 that I have configured for a small remote office. I have most of what I need working including the S2S VPN Tunnel to an ASA 5515.

Now, I'm trying to get Cisco APs to lite up over the tunnel and I need to configure DHCP option 43. This was easy on the ASA 5506 but I am at a loss with this 1010.

Can anyone point me in the right direction here?

I cannot find any advanced area for DHCP in the FTD 1010.

Thanks for any assistance anyone can provide.

[marce1000]

 - FYI : https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/200475-Configure-DHCP-Server-Relay-on-FTD-Using.html#anc8

 M.

[rob1456657]

Thanks for the reply, I had found this config myself, but I'm running software 6.4.0-102 and these docs don't match up. 

I attempted to use the CLI console, but none of the standard ASA commands I'm used to working actually work.

[Karsten Iwen · Accepted solution]

In Firepower Device Manager (FDM) you have to use FlexConfig for this:

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/fdm/fptd-fdm-config-guide-670/fptd-fdm-advanced.html

[rob1456657]

Thanks for the reply. I have been reading through the FlexConfig but don't see a clear way of adding DHCP Option 150. For now, since we need this site to work on Monday I configured a Windows DHCP Server with the options I need.

The necessary traffic I need is flowing through the Tunnel from the remote office to HQ and vice versa so things look good. Perhaps I can figure out the whole advanced DHCP options in time. Right now Windows DHCP will do what I need. Thanks again.

[rob1456657]

I dug into the FlexConfig and I was able to get the correct configuration settings. I found a bug, that is what kept me from correctly configuring DHCP Option 150, to begin with. Turns out version 6.4 has a bug. Every time I configured the FlexConfig object and added the "dhcpd" command it would yell about the command and the deployment would fail.

I upgraded the 1010 to v6.6-91 and re-added the "dhcpd" command and then it accepted the configuration. Once I re-enabled the DHCP server Option 150 was now provided via the DHCP server.

Thanks, Karsten for the information that you provided.