Configuring DHCP Relay Services
A DHCP relay agent allows the security appliance to forward DHCP requests from clients to a router connected to a different interface.
The following restrictions apply to the use of the DHCP relay agent:
• The relay agent cannot be enabled if the DHCP server feature is also enabled.
• Clients must be directly connected to the security appliance and cannot send requests through another relay agent or a router.
• For multiple context mode, you cannot enable DHCP relay on an interface that is used by more than one context.
Note DHCP Relay services are not available in transparent firewall mode. A security appliance in transparent firewall mode only allows ARP traffic through; all other traffic requires an access list. To allow DHCP requests and replies through the security appliance in transparent mode, you need to configure two access lists, one that allows DCHP requests from the inside interface to the outside, and one that allows the replies from the server in the other direction.
Note When DHCP relay is enabled and more than one DHCP relay server is defined, the security appliance forwards client requests to each defined DHCP relay server. Replies from the servers are also forwarded to the client until the client DHCP relay binding is removed. The binding is removed when the security appliance receives any of the following DHCP messages: ACK, NACK, or decline.
To enable DHCP relay, perform the following steps:
Step 1 To set the IP address of a DHCP server on a different interface from the DHCP client, enter the following command:
hostname(config)# dhcprelay server ip_address if_name
You can use this command up to 4 times to identify up to 4 servers. Step 2 To enable DHCP relay on the interface connected to the clients, enter the following command:
hostname(config)# dhcprelay enable interface
Step 3 (Optional) To set the number of seconds allowed for relay address negotiation, enter the following command:
hostname(config)# dhcprelay timeout seconds
Step 4 (Optional) To change the first default router address in the packet sent from the DHCP server to the address of the security appliance interface, enter the following command:
hostname(config)# dhcprelay setroute interface_name
This action allows the client to set its default route to point to the security appliance even if the DHCP server specifies a different router.
If there is no default router option in the packet, the security appliance adds one containing the interface address.
The following example enables the security appliance to forward DHCP requests from clients connected to the inside interface to a DHCP server on the outside interface:
hostname(config)# dhcprelay server 201.168.200.4 hostname(config)# dhcprelay enable inside hostname(config)# dhcprelay setroute inside
Continue reading here: Enabling WCCP Redirection
Was this article helpful?