PIX VPN Site-to-site with dhcprelay

[sjdixon]

How do I get dhcprelay traffic to be included in a PIX IPSec site-to-site tunnel? The dhcprelay server traffic needs to flow across the tunnel. Should the IP address of the DHCP server be included as a destination? What should the source IP address be for the flow to the DHCP server?

[ebreniz]

You need to include this traffic in the " interesting traffic" definitions. I assume that you have the DHCP relay agent on one side (location A) and the DHCP server on the other side(location B).

On location A;

The source will be the IP address of the DHCP relay agent and destination will be that of the DHCP server.

On location B;

The source will be the IP addres of DHCP server and destination will be that of DHCp relay agent.(mirror of loc A)

[sjdixon]

Thanks for the reply. I was able to get this working by adding an access-list entry for the tunnel using the outside IP of the DHCP Relay PIX to the IP address of the DHCP server plus the mirror of that access-list entry on the central site PIX that anchors the tunnel.