We have two sites: 10.0.1.0/24 and 10.0.2.0/24. They are connected with site-to-site VPN using two PIX 501s. Both PIXs are running OS 6.3(5). The VPN connection is working fine, and the hosts can access network resources both ways.
First site has a DHCP server (Win2003) with an IP address of 10.0.1.10. It has scopes for both networks. The PIX at the 10.0.2.0 site is configured as a DHCP relay using this config:
dhcprelay server 10.0.1.10 outside dhcprelay enable inside
However, the setup doesn't work. The clients at the 10.0.2.0 network don't get their IP from the DHCP server at 10.0.1.0 site. The local clients at the 10.0.1.0 site do get their IPs from their scope.
This is what the PIX at site 10.0.2.0 shows:
pix501# sh dhcpr stat Packets Relayed BOOTREQUEST 0 DHCPDISCOVER 45 DHCPREQUEST 0 DHCPDECLINE 0 DHCPRELEASE 0 DHCPINFORM 0
BOOTREPLY 0 DHCPOFFER 0 DHCPACK 0 DHCPNAK 0
I've found very little documentation from Cisco regarding DHCP relay through a VPN connection.
Any ideas what to try?
Didn't find your answer? Ask the community — no account required.
M
Merv
Did you reboot the PIX after you configured the DHCP relay ?
I believe there is a Cisoc bug that requires a reboot.
P
pawn_daniels
Merv kirjoitti:
I've also heard about the bug, and yes, the PIX has been rebooted after configuring the DHCP relay. Quite a few times, actually. Rebooting didn't solve the problem.
Any other ideas?
M
Merv
use the capture command to verify that PIX is receiving DHCP requests on inside interface and sending them on outside interface
no access-list DHCP access-list DHCP permit udp any any eq bootpc access-list DHCP permit udp any any eq bootps
A little alternative advice. Don't use DHCP relay, use the DHCP server on the PIX. With the relay you add traffic (albeit only a little) and if the Internet connection or VPN tunnel goes down, you also loose your DHCP service.
However, nothing gets to the DHCP server at site1. I ran a network monitor there, and no packet reaches the server. So I guess the problem is the PIX at site1?
Here's some configs from boths PIXes...
PIX at site 1:
name 10.0.2.0 site2 access-list inside_outbound_nat0_acl permit ip 10.0.1.0 255.255.255.0 site2 255.255.255.0 access-list outside_cryptomap_20 permit ip 10.0.1.0 255.255.255.0 site2
So it would appear the PIX DHCP relay agent feature is working just fine.
Perhaps the DHCP traffic is not being permitted by the crypto map Since you masked out the IP address for the outbound DHCP packet I will assume that it is the outside interface. If that is the case then your crypto map does not not permit that to be placed into the VPN tunnel access-list outside_cryptomap_20 permit ip 10.0.2.0 255.255.255.0 site1
255.255.255.0
See Cisco PIX config example for SNMP and SYSLOG over VPN tunnel:
formatting link
SNMP and SYSLOG both use UDP as transport.
P
pawn_daniels
Yes, the masked xxx-address is the outside interface address of the PIX at site2.
After reading the config example for SNMP and SYSLOG over VPN, I changed the access-lists like this:
PIX at site 1: name 10.0.2.0 site2 access-list outside_cryptomap_20 permit ip 10.0.1.0 255.255.255.0 site2
255.255.255.0 access-list outside_cryptomap_20 permit ip host 10.0.1.10 host xxx.xxx.xxx.xxx
PIX at site 2: name 10.0.1.0 site1 access-list outside_cryptomap_20 permit ip 10.0.2.0 255.255.255.0 site1
255.255.255.0 access-list outside_cryptomap_20 permit ip host xxx.xxx.xxx.xxx host
10.0.1.10 It still doesn't work...
M
Merv
does show access-list show any hits against the second entry in the crypto access-list ?
Join the Discussion
Have something to add? Share your thoughts — no account required.
Didn't find your answer?
Ask the community — no account required
Report Content
You are reporting this content to the moderators. They will look at it
ASAP.