5.3. DHCP Relaying
The DHCP Problem
With DHCP, clients send requests to locate the DHCP server(s) using broadcast messages.
However, broadcasts are normally only propagated across the local network. This means that the
DHCP server and client always need to be on the same physical network. In a large Internet-like
network topology, this means there would have to be a different DHCP server on every network.
This problem is solved by the use of a DHCP relayer.
The DHCP Relayer Solution
A DHCP relayer takes the place of the DHCP server in the local network and acts as the link
between the client and a remote DHCP server. It intercepts requests coming from clients and relays
them to the DHCP server. The DHCP server then responds to the relayer, which forwards the
response back to the client. DHCP relayers use the TCP/IP Bootstrap Protocol (BOOTP) to
implement this relay functionality. For this reason DHCP relayers are sometimes referred to as
BOOTP relay agents.
The Source IP of Relayed DHCP Traffic
For relayed DHCP traffic, the option exists in NetDefendOS to use the interface on which it listens
as the source interface for forwarded traffic or alternatively the interface on which it sends out the
forwarded request.
Although all NetDefendOS interfaces are core routed (that is to say, a route exists by default that
routes interface IP addresses to Core) for relayed DHCP requests this core routing does not apply.
Instead, the interface is the source interface and not core.
Example 5.3. Setting up a DHCP Relayer
This example allows clients on NetDefendOS VLAN interfaces to obtain IP addresses from a DHCP server. It is
assumed the NetDefend Firewall is configured with VLAN interfaces vlan1 and vlan2 that use DHCP relaying, and
the DHCP server IP address is defined in the NetDefendOS address book as ip-dhcp. NetDefendOS will add a
route for the client when it has finalized the DHCP process and obtained an IP.
Command-Line Interface
1.
Add the VLAN interfaces vlan1 and vlan2 that should relay to an interface group called ipgrp-dhcp:
gw-world:/> add Interface InterfaceGroup ipgrp-dhcp
Members=vlan1,vlan2
2.
Add a DHCP relayer called vlan-to-dhcpserver:
gw-world:/> add DHCPRelay vlan-to-dhcpserver Action=Relay
TargetDHCPServer=ip-dhcp
SourceInterface=ipgrp-dhcp
AddRoute=Yes
ProxyARPInterfaces=ipgrp-dhcp
Web Interface
Adding VLAN interfaces vlan1 and vlan2 that should relay to an interface group named as ipgrp-dhcp:
1.
Go to: Interface > Interface Groups > Add > InterfaceGroup
2.
Now enter:
5.3. DHCP Relaying
Chapter 5. DHCP Services
262
Summary of Contents for NetDefend DFL-1660
Page 28: ...1 3 NetDefendOS State Engine Packet Flow Chapter 1 NetDefendOS Overview 28 ...
Page 88: ...2 6 3 Restore to Factory Defaults Chapter 2 Management and Maintenance 88 ...
Page 166: ...3 10 DNS Chapter 3 Fundamentals 166 ...
Page 254: ...4 7 5 Advanced Settings for Transparent Mode Chapter 4 Routing 254 ...
Page 268: ...5 4 IP Pools Chapter 5 DHCP Services 268 ...
Page 368: ...6 7 Blacklisting Hosts and Networks Chapter 6 Security Mechanisms 368 ...
Page 390: ...7 4 7 SAT and FwdFast Rules Chapter 7 Address Translation 390 ...
Page 414: ...8 3 Customizing Authentication HTML Pages Chapter 8 User Authentication 414 ...
Page 490: ...9 8 6 Specific Symptoms Chapter 9 VPN 490 ...
Page 528: ...10 4 6 Setting Up SLB_SAT Rules Chapter 10 Traffic Management 528 ...
Page 544: ...11 7 HA Advanced Settings Chapter 11 High Availability 544 ...
Page 551: ...12 3 5 Limitations Chapter 12 ZoneDefense 551 ...
Page 574: ...Default 512 13 9 Miscellaneous Settings Chapter 13 Advanced Settings 574 ...
Page 575: ...13 9 Miscellaneous Settings Chapter 13 Advanced Settings 575 ...