FWSM DHCP-Relay

[Mhon Baul]

Hi All,

  I'm in th process of configuring FWSM to relay DHCP request from the client pc/ip phone going to our DHCP server. But the thing is, my client pc/ipphone are not connected directly to FWSM instead i have a L3 switch for the data/voice vlan and configure ip-helper address 10.1.1.200 on svi.

The FWSM and L3 switch are connected via P2P. Is there any way that this will work, I know that it says on cisco documentation that clients should be connected to FWSM but I hope there will be workaround or else I will configure DHCP server on the L3 switch which is not a good practice.

I attached my diagram for reference. I will appreciate all your comments/suggestions. Thanks in advance!

Cheers,

Reymon

[martin_knorre]

hi Reamon,

you issued the IP Helper command on every VLAN, so the BC is turned into a Unicast and is directed to the DHCP Server. So you have to allow the Unicast from the Subnet / VRF Instance on the Security Context of the FWSM. And I think that should work, in this case the FWSM is nothing other than a normal firewall --> permit (bootps port:67).

Regards Martin

[Mhon Baul]

Hi Martin,

Thanks for your reponse.

I already did what you have said to allow  udp 67/68 from client subnet to dhcp server vice-versa but still no success.

You are correct that the fwsm should be a normal firewall in this way but it's not. Have you tried doing this before, if yes can you please tell me how did you do it?

Thanks and Best Regards

Reymon

[martin_knorre]

Hi Reymon,

sorry we have another structure in our DC, with a security context for every vlan, so we usually assign the relay agent to this context without a Layer 3 instance before the FWSM.

Do you notice the reject of the communication on the Firewall logging?

rgds Martin

[Mhon Baul]

Hi Martin,

   So each context has relay agent configured and client pc is connected directly to context vlan, right? The logs that I see is only the bootpc udp 67 coming from client pc subnet but nothing from dhcp server interface.

regards

reymon

[martin_knorre]

Hi Reymon,

so when the answer from the server didn't come back, maybe this is the problem, have you checked the routing? Can you trace a route ?

Regards

Martin         

[Mhon Baul]

Hi Martin,

  Traceroute is working on both side. What i did is setup another server and create another vlan for the server and put the server in there. After activating thd dhcp scope, it works fine. The one I notice is that dhcp ps doesn't work when the dhcp server is connected to another router and router to fwsm.

Anyway, this issue is resolve.

Many thanks!

Reymon