Cisco WAN :: 1841 DHCP Relay Through GRE Over IPsec
Mar 17, 2011
I have a data center with virtual desktops and other shared infrastructure serving remote sites, some of which are connected to the data center with GRE over IPsec.
IP address management including DHCP is centralized in my architecture, but I simply cannot figure out how to relay DHCP requests through GRE over IPsec to my DHCP server cluster. I am working with Cisco 800 series VPN peers, and the VPNs are terminated either on a 1841 or a Juniper SRX. Everything else is just fine and dandy, but DHCP is not forwarded across the GRE tunnel.
As a workaround I am forced to use local DHCP pools on the VPN peers, which is extra work from a management point of view, and also precludes static IP address assignment where a local DHCP pool is in a VRF. My LAN devices are mostly thin clients, so I don't care if DHCP stops working when the WAN link fails. As such local pools have no upsides, they are only a tremendous hassle.
My config is very basic, public WAN in global routing table and WAN + GRE tunnel in a VRF. NAT is not used. Here are the DHCP-related configs I have tried:ip helper-address on the LAN gateway, both with and without ip forward-protocol udp bootpcip dhcp pool with relay options configured
In every case, I can see the UDP broadcasts hit the LAN gateway, but relayed packets never arrive at the other GRE tunnel endpoint let alone the DHCP server.
Here is the high-level question, please only respond if you have a conclusive answer with documentation to back it up. It seems simple, but all my research on forums and things have been confusing and conflicting.
When "ip helper-address" is used to enable the dhcp-relay function, will the DHCP packets get relayed through the VPN tunnel (if thats where the DHCP server is?) This question applies to Cisco IOS Routers and VPN appliances which have a Site-to-Site IPSEC VPN Tunnel to a place that hosts a DHCP server.
I'm using the Cisco 880 and 1800 series routers. I've already got DHCP relaying through IPSEC tunnels, but so far I've only set it up where my 2960 switch relays the DHCP messages to the VPN router on site (which is a separate device). I want to know if the router can pickup and relay through it's own tunnel natively.
I have some DHCP trouble since I subnetted my network with a 2921. My clinets are in 172.16.2.0/23 and DHCP servers are in 172.16.5.0/24.Sometimes, randomly I guess, I get NACK from my DHCP server, and if I look into DHCP logs I got something like this:
Have a client wanting to hand out public ip addresses to all clients from a PFSense Firewall terminating the internet connection.
How do I allow the Cisco Switches currently in place, configured with private ip addresses in the 10.10.x.x ranges and Vlans, where the main 3550 layer 3 has defined dhcp scopes for each vlan, to relay dhcp requests from all vlans to the PFSense firewall?
I assume I would take off the currently defined dhcp scopes for the vlans and configure each vlan/switch with the ip helper address and specify the PFSense firewall and that Nat would have to be disabled onthe firewall?
I'm having a problem getting DHCP working with an ASR9k as shown in this document. I've successfully implemented very similar setups with some Cisco IOS routers, but the IOS XR on the ASR seems to be defeating me. Router A (happens to be a 3750)A DHCP/BOOTP/TFTP server, connected to router ARouter B - this is the ASR, running software version 4.0.3.Router A and B are connected by a layer-3 link.Router C (happens to be a Broadcom embedded router). It's connected to Router B by a VLAN trunk link.Device 1, this one needs to get its configuration by DHCP/BOOTP/TFTP. It's connected to Router C by a VLAN trunk link.Device 2, this one doesn't need any DHCP/BOOTP/TFTP. It's connected to Router C by a VLAN trunk link (its port is the same as Device 1's) Device 2 works great - it can ping the DHCP/BOOTP/TFTP server (and vice versa) and everything else it needs.
I have a firewall that I want acting as a DHCP relay. This firewall has a number of VLAN interfaces serving clients. The DHCP relay destination is the IP address of a Windows 2012 Server running Microsoft DHCP which has multiple scopes configured, one for each client VLAN.What I'm finding confusing is how the DHCP will identify the client. Does the DHCP relay insert an identifier of some sort (opt. 54?) based on which VLAN the DHCPREQUEST comes from and then this identifier can be configured to be recognized on the DHCP server?
I have defined several V LAN's and the corresponding IP Addresses on the SGE2000. The static routing works fine. On one V LAN there is a Windows 2003 DHCP Server which I have defined as DHCP Relay Server (Option 82), but no packets are relayed. Has anyone a functional setup, with dhcp relay?
I am trying to get an understanding of some behaviour I am seeing on my N7Ks regarding DHCP relay.I have two identically configured Vlans interfaces both configured with the same two dhcp relay servers in the same order. The only difference between the two vlans is that one is HSRP active on the A side switch and the other is active on B side switch. All clients in Vlan136 (active on B side) are getting DHCP leases from the first of the two dhcp relay servers configured while all clients on Vlan 137 (active on A side) are getting DHCP leases from the second of the two dhcp relay servers. I would expect that all clients on both vlans would get leases from the first relay server configured unless that device was unavailable.
Would like to impliment VLAN's on Cisco IOS Software, C3560 Software (C3560-IPSERVICES-M), Version 12.2(25)SEB4...But I need a DHCP Realy to my Windows Based DHCP Server. How do I enable DHCP Relay on the 3560?
DHCP Relay on a SGE2000 switch.I have configured two VLANs on the switch, VLAN2 (192.168.10.x/24) and VLAN3 (192.168.9.x/24). I have the switch in Layer 3 mode. I have configured the DHCP relay server of 192.168.10.4 and the DHCP Interfaces as VLAN3. All of the IP Static Routes were generated by the switch.
If I put a client computer on a port that is Untagged VLAN 3 and try to get a DHCP address from the server on an Untagged VLAN 2 port I never get a response back.I have done some packet captures and here is what I have found:
I see the DHCP broadcast on the client computerI see the DHCP Request on the DHCP server coming from the IP assiged to the switch on VLAN 3 (192.168.9.254)I see the DHCP server respond with a DHCP OfferThe DHCP offer never gets to the client computer I can't seem to get a DHCP address to any system not on the same VLAN as the DHCP server. Option 82 is disable and I did try enabling it, which made no difference.
My network is set up such that I have a Wireless Network in VLAN 1, which is the primary network that we use. The subnet is 10.5.1.x.
My goal is to set up a completely isolated Guest Wireless Network, however it would work best. What I am trying to do now is I created a seperate VLAN (VLAN 2, IP range 10.5.2.x) and turned on DHCP on the WRVS4400N. However, in the Guest Network, it is always picking up a 10.5.1.x IP which is handed out by the DHCP server (10.5.1.5, Win 2003) and still routing all of the traffic to/from our private network.
Here's What I have set:
Wireless>Security Settings>Guest Network (SSID 2) Wireless Isolation (between SSID w/o VLAN): EnabledWireless Isolation (within SSID): EnabledSetup>LAN>VLAN 1 Router IP 10.5.1.1, WLAN IP 10.5.1.3DHCP Relay for 10.5.1.5Setup>LAN>VLAN 2 Router IP 10.5.2.1DHCP Enabled for 10.5.2.x subnetDHCP Relay option is grayed out (not sure why)Setup>Advanced Routing Inter-VLAN Routing: Disabled Any way to solve this would be fine. I just do not want traffic routing through our internal network. Ideally, if I could get the Windows server to hand out 10.5.2.x addresses, that would be perfect, but I'm not sure how to configure it for such.
I am actually more of a 3Com guy than Cisco but I like to think I know my stuff and having just discovered this site I hope to join in as it looks a good place.I have a question about the general theroy underneath DHCP relay (IP Helper in the Cisco world I believe!)I've always put the DHCP server in VLAN1 only. A few weeks ago, I repatched the DHCP server in one of our offices (small site, single switch) into a different port by mistake. A few days ago I noticed (when doing something entirely unrelated) that I had left it in a port on both VLANs meant for PC's/phones. So, untagged on VLAN1, tagged on the voice VLAN. It had continued to work properly all that time however.By contrast, at a larger site, a new DHCP server came online and was put on a switch elsewhere in the building and was also put into a port on both VLANs - however things didn't work at all - of course we noticed immediately and changed the port setting to VLAN1 only, and it came back.In the second example, the server was on a different switch to where the main L3 switch for the Voice VLAN was (which also does the DHCP relay), and was connected over a fibre trunk link.Is there any reason why it should work on a single switch on a port on both VLANs, but not when connected over a trunk link? The server does not understand tagging. In the case where it worked, the phones were getting an IP from the correct scope; so the relay obviously must have been working with the server issuing an address based on the GIADDR field.
I have a 2921 with 4 segments: [code] My DHCP server is 172.16.5.2 and I need to serve clients from 172.16.2.0/23 by MAC address and only to that segment.
I am having some issues with getting DHCP Relay to fuction properly over our SG300-20 Switch.Out current layout is as follows. Hanging off the SG300-20 are a pair of Clustered Checkpoint Gateways with VLAN'ed interfaces in Both of our 2 VLANs, a 3COM 4200G In VLAN1 which has the DHCP server (And all the other Servers) connected to it, and a Pair of HP Procurve 2520's Stacked in VLAN 2 to provide PoE for our Phones/connectivity for our PCs.The problem is I cannot get the DHCP Relay to fuction from VLAN 1 to VLAN 2. If I assign an address in VLAN 2 manually to a device connected to the Procurves, everything works fine. I am able to reach both VLAN 1 and VLAN 2, but DHCP aquisition fails even if the device is connected directly to a port assigned to VLAN 2 on the SG300. The SG300 is running at Layer 3 currently also.
Here is a copy of the running config: -------------------------------------------------------------------------------------------------------------- switch4db24f#show running-config vlan database vlan 2 exit interface range gi8,gi16 switchport default-vlan tagged
I have a Cisco 7200 acting as the DHCP relay agent on my network. From a security standpoint, I want to disable the bootp server, with 'no ip bootp server'. What bearing, if any, does 'no ip bootp server' have on DHCP activity?
Windows Server 2008 R2 has two DHCP scopes 192.168.1.x (for data) and 192.168.2.x (for VOIP). The Catalyst 2960-S has Vlan1 for the Data V LAN and V lan 2 for the VOIP network. How do I setup DHCP relay for Vlan2 to get their IPs from the scope on the Windows server?
Used to doing ip helper-address x.x.x.x in other Catalyst switches, but not available here.
We have a SBS 2003 server with two NIC's, one for the internal LAN and the other connecting to the WAG160Nv2 that is hooked up to the internet.The internal LAN clients are all getting IP addresses from the DHCP server in the SBS Server (192.168.16.XXX). The DHCP server is sat at 192.168.16.2.The only thing connected to the LAN ports on the WAG160Nv2 is the Internet facing NIC from the server.What I want to do is to get the WAG160Nv2 to give IP addresses to Wireless connections going through the router, can I configure the DHCP relay option on the WAG160Nv2 to do this, I have looked at the DHCP relay option but it doesn't seem to work, my wireless connections are getting private 169.254.xxx.xxx addresses.Also is there anything I can do to make the wireless more Apple friendly, iPhones and iPads drop of the wireless frequently, that's why I trying a different approach.
I have upgraded a C3750G-12S-E to c3750-ipserviceslmk9-tar.122-55.SE5This switch is a distribution layer switch for one of my remote sites. it contains an ip helper-address on the site vlan's SVI.DHCP relay is no longer functioning for client PCs. Static address assignment allows full network functionality. I enabled debug ip dhcp server packet. [code] Actually I am betting you upgraded your IOS from something before 12.2(50)SE to 12.2(50)SE or later. We added enhancement CSCso19800 which will validate DHCP options when we are a relay agent.
I am trying to configure two 3845 routers to act as dhcp server and dhcp relay. Clients are connected to the router that relays all dhcp requests to the vrf instance which is used to connect it to the router wich is running dhcp server.
Router1 ip vrf dhcp_dns rd 8:1 int gi0/0 ip vrf forwarding dhcp_dns ip address 192.168.200.5 255.255.255.248
[code]...
So far I can see dhcp requests coming from the R1 and dhcp server on R2 replies with the dhcp offer but PC is not getting any ip.
How to configure cisco 3560 to force the client only can get ip by dhcp-relay server ?
The company i am working in has 5 vlans which have been set an lay-3 switch(3560), uses the dhcp-relay server .(in svi configuration: ip helper-address X.X.X.X) well , that works ok~
Now , I got my problem: I need to force the client only can get ip by dhcp-relay server, that means if anyone set static IP manunally , he can't really access to anywhere (to provent anyone set static IP with malignancy )
I know if a h3c router , how to set this configuration n svi configuration : dhcp relay security address-check enable ) the how to configure on a cisco 3560 ?
I faced with issue on ME3800. [code] With that configuration there is no problem with DHCP Relay packets.But if I add on interface #xconnect 82.199.1 19.1 77 encapsulation mpls it will stop forward DHCP relay packets immediately. All other traffic transfers without problem.
i have 6 sites using tandberg visioconference system, each site have a cisco router 1841 configured with ipsec vpn, i have a 4 conference a week and my bandwidth is 2 meg, and when people are working we have a lot of problems and cut in our visio conference.
I have a big problem, i want to make a high level QOS priority to my TANDBERG visio conference system between my sites, the issues is that there is an IPSEC VPN in my cisco routers between those sites and as i know if the traffic is crypted we can not separate the packets or give higher priority to packets over anothers.
can i mark traffic in the lan interface and and make a high priority befors the packets go through the ipsec tunnel?
I want to establish VPN with GRE over IPsec. As ASA can't end GRE tunnels, I should pass it through inside to another 1841 router in datacentar network. Since datacentar is connected to internet via two wan links (separate ISPs) is it possible to establish two gre simultanous sessions between 1841 at branch office and 1841 at datacentar, one session per wan link at datacentar? That way, I need 8 gre separate sessions (tunnels) at datacentar 1841 router. Is it supported?Is GRE passthrough works like regular port forwarding or it is something that ASA handles with some special commands?
I have two Cisco RV220W routers and I would like to realy DHCP from the home office to the remote office accross the IPsec Tunnel. Is this possible and if so how?
I have already gone into the IPv4 LAN (Local Network) settings on the remote router and set the DHCP mode to "DHCP Relay" providing the internal ip address of the home office router as the remote DHCP server.
We have set up a site to site IPSEC VPN between a Pix 515E running 8.0 (4) and an 1841 using static IP addresses at both ends. We used CCP on the router and ASDM on the pix to build the initial tunnels. Now the site with the router is changing to a Dynamic IP address from the ISP so we have set up Dynamic DNS to update the dynamic IP address.
The problem we have is that ASDM will not allow us to set a domain as the peer address, it will only accept an IP address. We think the solution will be to remove the static Crypto Map and replace with a Dynamic Crypto map on the Pix side. Our questions are simply; is this the best solution? can we edit the original static list or is it better to delete and make a new dynamic crypto map? Is there a short cut to change the config in command line? This is a live network so just want to check before we make changes on live kit.
We are currently experiencing a problem on an IP SEC VPN tunnel that has all of us here completely stumped. We are hoping that one of you experts out there will be able to assist. Here are some basic details:
NETWORKS An IPSEC site to site tunnel has been built between the two sites on different networks. PIX 515E - MAIN SITE Network 172.16.0.0/24 CISCO 1841 - REMOTE SITE Network 172.16.99.0/24
ISSUE All traffic flows over the VPN from the 172.16.99.0 network in the direction of the Pix, such as RDP, SIP etc. Pings will go in both directions across the tunnel. Other than the pings most traffic will NOT flow over the tunnel from the 172.16.0.0 network on the pix to the 172.16.99.0 network on the 1841. It would appear that something on the 1841 is blocking traffic coming in over the tunnel from the 172.16.0.0 network as we can not get a wire shark capture on a PC on the 172.16.99.0 network, other than the ICMP traces. Usually this is an access list problem but we have checked and double checked the configuration and can't see anything.
TROUBLESHOOTING SO FAR
1. Have tried inserting various access list changes to the tunnel on the 1841 to make specific reference to the 172.16.0.0 network. 2. Have tried various NAT entries. 3. Have removed and then recreated the VPN tunnel from a fresh start. 4. Have made the MTU 1400 on the inside interfaces on the Pix and the 1841.
The tunnel is fully up at all times and as we say can ping in both directions.
