VRF DHCP help!

[frederick.mercado]

So I have my VRF lite setup in the WLC 9800 oddly enough that includes VLAN(Mobile clients) and Interface twoGi0/0/0 out to the ISP. I cannot however get DHCP. The DHCP server is behind VLAN  on the corp network, as we have to have it windows based due to policy, if not I would surely set one up locally. The only issue is that we do not have a SVI on the corp for VLAN...I know the route leak from VRF to global but VLAN is not in the global...but I am unsure of how to set that up... as I do not want communication with anything but DHCP to that VRF.

[Flavio Miranda]

Edit you post please and delete sensitivy information.

[Flavio Miranda]

Try this config:

ip vrf MOBILE-SSID
description MOBILE to ISP
rd 1:1

!

access-list 101 permit ip 207.91.252.28 0.0.0.255 10.74.35.10 0.0.0.255

route-map VRF_TO_GLOBAL permit 10
match ip address 101
set global

!
interface TwoGigabitEthernet0/0/0
description LOCAL INTERNET
no switchport
ip vrf forwarding MOBILE-SSID
ip address 207.91.252.28 255.255.255.248
ip helper-address 10.74.35.10
ip nat outside
negotiation auto
no snmp trap link-status
ip policy route-map VRF_TO_GLOBAL

!

[frederick.mercado]

Configured but not working.

[Flavio Miranda]

But the VLAN 126 and 35  are  an interface vlan?  Or they are only layer 2 vlans?

If they are interface vlan then, is different from what I thought

The  policy must be applied on the interface vlan that has the VRF on it

ip policy route-map VRF_TO_GLOBAL

The access list must use the source IP of the interfac vlan with VRF and destination the VLAN on the global vrf

access-list 101 permit ip 207.91.252.28 0.0.0.255 10.74.35.10 0.0.0.255

[frederick.mercado]

They are layer 2 vlans on the 9800 WLC.

[paul driver]

Hello

You have a post open already (here) relating to the same query ( vrf, vlan 126,dhcp) in this that post it was summarized to

---

@paul.driver wrote
So just to summarise, you have a HSRP vlan that you want isolated from the rest of the network, be able to receive dhcp allocation and append NAT redundancy to froma 9300 series switch?

@frederick.mercado wrote:

That would be a correct summarization. VLAN126 is for mobile traffic to be isolated from other VLANs, minus the possible DHCP,