DHCP Proxy Problem

[royda1061]

I'm using the "DHCP Network Scope" field in order to provide a specific scope for a Group of users. The VPN concentrator for the DHCP Discover request uses its own IP address into the IP source field and inserts into the GIADDR field of the DHCP Discover message the "DHCP Network Scope" information. The DHCP server then uses the GIADDR as the return address and consequently my VPN concentrator doesn't receive the DHCP Offer.

Does anybody have a solution or information?

Thanks.

Regards.

David Roy.

[gfullage · Accepted solution]

You need to set up the routing on your internal network so that whatever subnet you've defined is routed back to the private interface of the concentrator.

For example, let's say you put 200.1.1.1 into the DHCP Network Scope field under the Group parameters. This IP address then gets put into the GIADDR field in the DHCP request the concentrator sends out. The reply from the DHCP server will be unicast back to 200.1.1.1, with an IP address in the 200.1.1.0 subnet allocated within the DHCP packet. Your internal network needs to route this network back to the private IP address of the concentrator, not just for the DHCP reply to make it back, but for the subsequent replies to all the VPN clients packets to make it back also.

You can't allocate a DHCP Network Scope for some existing subnet on your network, because when the VPN clients send packets, all the replies back to them will be routed off to this existing subnet. The replies to the VPN clients, including the reply to the initial DHCP request from the concentrator, needs to be routed back to the concentrator itself.

[royda1061]

Thank you for your help.

I've tested it. This configuration works well.

Regards.