DHCP Relay through IPSEC VPN Tunnel - Supported or No?

Gerald Wiltse · ‎03-12-2011

Here is the high-level question, please only respond if you have a conclusive answer with documentation to back it up. It seems simple, but all my research on forums and things have been confusing and conflicting.

When "ip helper-address" is used to enable the dhcp-relay function, will the DHCP packets get relayed through the VPN tunnel (if thats where the DHCP server is?) This question applies to Cisco IOS Routers and VPN appliances which have a Site-to-Site IPSEC VPN Tunnel to a place that hosts a DHCP server.

I'm using the Cisco 880 and 1800 series routers. I've already got DHCP relaying through IPSEC tunnels, but so far I've only set it up where my 2960 switch relays the DHCP messages to the VPN router on site (which is a separate device). I want to know if the router can pickup and relay through it's own tunnel natively.

Regards,

Jerry

manish arora · ‎03-14-2011

This would be helpful :-

https://supportforums.cisco.com/community/netpro/security/firewall/blog/2011/01/07/asa-pix-dhcp-relay-through-vpn-tunnel

Manish

Gerald Wiltse · ‎03-14-2011

Thanks for reading and responding Manish.

I see that you've copied and pasted your response from another question about DHCP Relay and IPSEC. I have read the linked article twice now and have filed it under "not what I was looking for". It is a very long and drawn out account of one persons issue, which refers to a specific case, with a specific hardware that is different from the one I asked about (this article is regarding a pix, my question is regarding ISR routers).

Again, I was hoping for a simple, succinct, and conclusive answer from Cisco, directly addressing the question. Then, if the documentation exists, a link to an official configuration guide dealing with the specific situation.

Anyone from Cisco care to clear this one up?

Thanks again,

Jerry

ahmad82pkn · ‎11-26-2013

Hi Gerald,

did you set it up successfuly? i am also in same situation.

i have a vlan on Core switch. i have to get ip addresses on PC from a helper address that is residing other end of IPSEC VPN tunnel , i am assuming source subnet will be my complate VLAN and Destination would be DHCP server IP. question is same, will my PC get IP address? i still need to test it out . any help would be appreciated.