Symantec Security 5600 Series, Security 5400 Series,Clientless VPN 4400 Series, Administration Manual

Page: 132 / 861

132 Establishing your network
Allowing DHCP traffic
DHCP traffic–multi-hop example
Multi-hop DHCP traffic uses a chain of relay agents to pass client requests. These agents can include
any number and mix of Symantec security gateways and third-party security gateways.
Figure 5-7 shows a multi-hop DHCP relay.
Figure 5-7 Example multi-hop DHCP relay network
This example shows three networks. The gateways between the networks are a third-party security
gateway and DHCP relay and a Symantec security gateway and DHCP relay. Relay requests from clients
on the 10.5.5.0/24 subnet to the DHCP server on the 10.3.3.0/24 subnet will result in responses
addressed directly to the third-party gateway. The Symantec security gateway is configured similarly
to the single-hop case, in regards to port control and modifications to the dhcprelay.conf file. In
addition, to facilitate the response from the DHCP server, the Symantec security gateway is configured
with a rule for a UDP GSP on port 67, with an arrival point of the 10.3.3.0/24 subnet and a destination
of the 10.4.4.0/24 subnet. The UDP GSP is configured for both source and destination ports of 67. If
there were additional relays in this network, all the relays except the one closest to the client should be
configured to pass a UDP port 67 datagram response.
Configuring the security gateway to allow DHCP traffic
You can configure the security gateway for single or multiple DHCP servers. To support DHCP Relay
functionality, you must configure the DHCP relay proxy daemon by editing a configuration file. You
may also need to configure your DHCP server’s routing table to have routes to any network to which it
distributes addresses, if those routes are not known.
Prerequisites
None.
Configure the security gateway to allow DHCP traffic
To configure the security gateway to allow DHCP traffic, you must do the following:
■
Configure the DHCP relay proxy
■
Open a port for DHCP traffic
These configurations are required for both single-hop and multiple-hop DHCP traffic. For multiple-hop
DHCP traffic, you must also do the following:
■
Configure a UDP protocol that uses the GSP proxy, with both the source and destination port of 67.
■
Add the protocol to a service group.
■
Create a rule that uses the service group, with the arrival point of the interface that connects to the
subnet that is closest to the DHCP server and a destination point of other interface of the security
gateway.