Cisco 500 Series, Configuration Manual

Page: 173 / 1140

10-5
Cisco Security Appliance Command Line Configuration Guide
OL-12172-03
Chapter 10 Configuring DHCP, DDNS, and WCCP Services
Configuring DHCP Relay Services
•
To provide information for DHCP requests that include an option number as specified in RFC-2132,
enter the following command:
hostname(config)# dhcpd option number value
• To provide the IP address or name of a TFTP server for option 66, enter the following command:
hostname(config)# dhcpd option 66 ascii server_name
•
To provide the IP address or names of one or two TFTP servers for option 150, enter the following
command:
hostname(config)# dhcpd option 150 ip server_ip1 [ server_ip2 ]
The server_ip1 is the IP address or name of the primary TFTP server while server_ip2 is the
IP address or name of the secondary TFTP server. A maximum of two TFTP servers can be
identified using option 150.
•
To set the default route, enter the following command:
hostname(config)# dhcpd option 3 ip router_ip1
Configuring DHCP Relay Services
A DHCP relay agent allows the security appliance to forward DHCP requests from clients to a router
connected to a different interface.
The following restrictions apply to the use of the DHCP relay agent:
• The relay agent cannot be enabled if the DHCP server feature is also enabled.
•
Clients must be directly connected to the security appliance and cannot send requests through
another relay agent or a router.
• For multiple context mode, you cannot enable DHCP relay on an interface that is used by more than
one context.
Note DHCP Relay services are not available in transparent firewall mode. A security appliance in transparent
firewall mode only allows ARP traffic through; all other traffic requires an access list. To allow DHCP
requests and replies through the security appliance in transparent mode, you need to configure two
access lists, one that allows DCHP requests from the inside interface to the outside, and one that allows
the replies from the server in the other direction.
When DHCP relay is enabled and more than one DHCP relay server is defined, the security appliance
forwards client requests to each defined DHCP relay server. Replies from the servers are also forwarded
to the client until the client DHCP relay binding is removed. The binding is removed when the security
appliance receives any of the following DHCP messages: ACK, NACK, or decline.
To enable DHCP relay, perform the following steps:
Step 1 To set the IP address of a DHCP server on a different interface from the DHCP client, enter the following
command:
hostname(config)# dhcprelay server ip_address if_name
You can use this command up to 4 times to identify up to 4 servers.