IP helper-address and VPN

[pthaynes]

I have a VPN between a PIX 506 (at the central site) and a 837 router at a remote site. I would like to use an "ip helper-address" command to allow some thin-client devices at the remote site to tftp down configuration. Unfortunately the devices don't support getting the address of the tftp server via DHCP, so the helper-address seems to be my only option. My question is will the configuration work, and if so what access-list stuff or other special configuration will I need to add?

I believe the tftp works as a directed broadcast and so won't work over IPSec. Is that the case?

Thanks in advance,

Peter

[drolemc]

I guess, as long as you can ping that tftp server through the ipsec tunnel, the setup should work.

[Richard Burts]

I do not understand your statement about tftp working as a directed broadcast. I would expect the thin client to send a broadcast request to tftp server to the local LAN. The router would receive the request and if a helper-address is configured the router will generate a packet to the address configured in the command. That address can be unicast or directed broadcast. I am not aware of anything that prevents it running over IPSec.

In terms of what you need to be careful about in the config: since the tftp packet outbound is coming from the router be sure that it is permitted in the access lists that define the VPN traffic.

HTH

Rick