fwsm and dhcprelay agent

[lb-netsvcs]

Folks,

I'm hoping to use dhcprelay agent to provide DHCP addresses to devices behind my FWSM. The DHCP server is on a network a hop away from the (outside) interface, while the network I want to provide DHCP service to is on an (inside) interface.

I can set a static address already on the (inside), and NAT is working using PAT on the global (outside) interface. The FWSM is in Router mode.

Anyone know of anything special here? Does the DHCP server have to be directly connected to the (outside)? The FWSM can ping my DHCP server just fine. Clients with static addresses on the (inside) can browse the web and do other things, as the acl is 'ip any any'.

Regards,

Craig K

Network Engineering Manager, CSU Long Beach

[jackko]

i guess the dhcp server needs to be located directly on the outside subnet. you mentioned "The DHCP server is on a network a hop away from the (outside) interface". just wondering if there is a router in between.

e.g. fwsm <--> outside subnet <--> router <--> dhcp server

router will by default drop broadcast (i.e. dhcp request), thus i guess you need to again run the dhcp agent on the router. unfortunately, i don't think the agent will work with another agent again.

[lb-netsvcs]

Yes, a router will by default drop a DHCP broadcast, but once it is passed as broadcast on the (inside) interface to the dhcprelay agent running on the FWSM, the FWSM sends it via Unicast to the DHCP server specified in the dhcpagent config. It works fine elsewhere using "helper-address". There should be no need to add another helper-address to the MSFC side of this FWSM connection...

[mlowery]

If the outside is a "shared" resources, you can forget about relaying anything DHCP... I've run into this before. Cisco's "workaround" was to place a DHCP server on each vlan behind the FWSM.

[lb-netsvcs]

Yeah, that's pretty much what I found after a few more attempts and getting some packet captures involved.

Decided to go a different route and explore Transparent mode and multiple contexts... talk about expensive though :(