Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 131 / 861

131 Establishing your network
Allowing DHCP traffic
Allowing DHCP traffic
Some hosts do not statically configure their network information, but instead, rely on a commonly
used protocol called dynamic host control protocol (DHCP) to dynamically obtain their network
addresses. DHCP uses a network’s broadcast address to communicate, and since broadcast packets are
not propagated through the security gateway, any host requiring DHCP configuration information
must be on the same network as the DHCP server. To change this behavior, you can configure the
DHCP Relay proxy to let clients receive configuration information through the security gateway.
How the security gateway handles DHCP traffic
There are two deployment situations that determine the security gateway configuration for the DHCP
relay proxy:
■
Single-hop case
This is the typical scenario, where all DHCP clients and DHCP servers lie on a subnet serviced by a
gateway interface. Client DHCP requests will make at most one hop, from one gateway interface to
another, to arrive at a server.
See
“DHCP traffic–single-hop example” on page 131.
■
Multi-hop case
The client requests traverse two or more relay agents, including the security gateway relay proxy.
See
“DHCP traffic–multi-hop example” on page 132.
DHCP traffic–single-hop example
Figure 5-6 demonstrates a typical DHCP relay deployment, where the client reaches the server in a
single hop. There are two networks, 10.3.3.0/24 and 10.4.4.0/24, separated by a security gateway.
Normally, the security gateway blocks the DHCP client’s request for lease information from the DHCP
server. Configuring the DHCP relay instructs the security gateway to retransmit DHCP requests,
replies, and lease information.
Figure 5-6 Example single-hop DHCP relay network
For example, if you would like to reach a DHCP server, 10.3.3.2, attached to the 10.3.3.0/24 network,
from a DHCP client attached to the 10.4.4.0/24 network, you would configure the security gateway to
relay broadcast requests by means of unicast messages to the DHCP server. You can accomplish this by
converging DHCP address requests from network 10.3.3.0/24 through the security gateway at
10.3.3.50 and out to network 10.4.4.0/24 through 10.4.4.50 by configuring the DHCP Relay proxy. In
addition, you must configure the DHCP server to lease addresses to the 10.4.4.0/24 network.
Security gateway
DHCP server DHCP client
10.3.3.0/24
10.3.3.2
10.4.4.0/24
10.3.3.50 10.4.4.50