DHCP from CSM Server VLAN

Is there a way to add a helper-address (or something similiar) to the CSM server VLAN? My unix team is planning on setting up a PIXE server boot server and a few of their servers that would need the ability to boot from it are in the server VLAN that my CSM hosts, I'm not sure how a DHCP request would ever leave that VLAN is I don't have some way of adding a helper address to it.
Thanks for any help....Jeff

Hello-
The CSM does not have any DHCP Helper address equivelants. However, you can configure the server VLAN in question in a bridged mode with a vlan on the MSFC that does do DHCP and the CSM will bridge the BOOTP requests to it.
Regards,
Chris Higgins

Similar Messages

Clients not getting DHCP from external server

Hi,
I have a 4402 (version 7.0.235) working with 10 units of 1121 APs connected to it. The WLC is not configured to work in LAG mode. Physical portt #1 is connected to the Main Switch (trunk). I have 3 WLAN mapped to 3 Different VLAN and Everything (security and internal, external DHCP) is working swell...
Now- I have connected Physical port #2 directly to an ADSL Router (giga port), Configured Port 2 as untaggedwith the proper IP details.
I have configured this interface to receive DHCP from the ADSL Router and for some reason, Clients are not getting addresses.
When I assign a Static address to my laptop I get internet access and all is nice. I tried configuring The WLC internal DHCP server (instead of the ADSL router) and that didn't help. It seems like a DHCP problem but I dont understand the source of the problem of think of the solution.
When turning off the proxy settings I noticed that it helped. Is there anything to do with that? The problem was that after a while the other WLANs starting causing DHCP issues as well.
What is supposed to be configured? Any Expert is the House?
I attached a crappy drawing..

Hi Scott,
Thanks for your answer.
So what you are basicly saying is that I have 2 choices: 1 - disable the Proxy option on the WLC and work with external DHCP servers (internal will not work when this is enabled). 2 - Enable the Proxy option and only work with the WLC internal DHCP.
I have installed many WLCs this way, having Different DHCP Servers (external and internal) for multiple WLANs.
What do you think may be different this time? The router that I am using isn't the most expencive but it is providing DHCP to other clients (wired client) with no problems.
Thanks!!!

DHCP does not load as a service from the Server Admin

Dear friends,
I have faced the following problem.
The task is to do internet sharing among other services on mac mini server.
Started with the clean install of OS X Lion, upgraded it to Server and then installed all updates.
USB Ethernet (en2) is looking into ISP with static IP, Ethernet (en0) is LAN.
Since I need specific address scope for the LAN I have actived DHCP from the Server admin and configured it to provide
192.168.8.11 to 192.168.8.200 as an adress scope, mask 255.255.0.0 on the interface en0.
Everything was working just fine for a couple of minutes and the LAN clients got their IP addresses from the DHCP scope. In a very short time Server Admin popped up and error message:
Try to refresh the view (aserver.local./Server). (kReceivedUnknownError)
Niether grey nor green bubble apears near the DHCP on the service list.
I keep recieving this error for all other services until I manage to disable dhcp on the services tab of server settings. After all I cant make it run again. I tried to restart dhcp from the terminal but it does not help. "sudo serveradmin fullstatus dhcp shows nothing".
Do you have any ideas how to make it work?

So you're not using NAT between the two? Even though you're using 255.255.0.0 so both network can talk (basically you have a class B network setup using Class C ip addresses), your network masks for each should be something like 255.255.255.xxx depending on how many subnets you need. NAT or Network Address Translation should be running and that will provide the interconnectivity between the two.
Your DHCP server should be set up only with 255.255.255.0 for the DHCP service since you are only serving IP addresses to the one subnet 192.168.8.x. Your starting address in DHCP setup is 192.168.8.11 ending address 192.168.8.200 and the netmask should be 255.255.255.0.

CSM server originated connections

Hi,
I have a CSM running in router mode with one client vlan, one server vlan and two server vlans for SCAs. Load Balancing is ok, connections directly to the servers and the SCAs through the CSM are ok.
Connections from the server vlan directed to the outside via next hop into the client vlan
(the opposite direction of the usual access) don't work.
Scenario: Server - CSM - MSFC
The client VLAN has the MSFC vlan interface configured as its gateway, the cisco docu says,
that server originated connections should work by default without any NAT, but they don't here.
I also tried "static nat <ip>" and "static nat virtual", no success. The outside vlan interface of the CSM is the last point I can ping, the MSFC doesn't respond, though it is the gateway
address.
Funny: I can ping the SCAs in their vlans and the SCAs can ping the gateway on the MSFC,
it's only from the servers into the client vlan that has trouble...
Does anyone have an idea what's wrong?
Thanks for every hint
Uli

It works for me.
Do a 'sho mod csm X conn' and look for the entry created for the ping from the server to the msfc.
Make sure the response from the msfc matches the entry - same vlan !!!
Check the route from msfc to server and make sure it goes to the same vlan as traffic from server to msfc.
Also, if you did some modification in the vlans or static routes, clear the csm connections since icmp creates long lived entry.
Regards,
Gilles.

CSM Server LB across L3 Devices

I have a pair of 6513's with a CSM in each. These are port-channelled together to provide FT.
I have a number of server vlan's defined on the 6500 and 2 of these need to be LB through the CSM.
Do I define these servers as CSM server vlans (which I have now done) or define the servers as 6500 server vlans with L3 interfaces defined on the 6500's and add route commands to the CSM server VLAN's to route back to these servers via the 6500 L3. I am concerned on this last point about Nat requirements for client connections and how to guage the number of nat pool addresses I need.
My reason for this question is that I am having trouble getting ping access to these LB servers through the CSM even though I have defined server farms with a predictor of forward. Cisco give information on forwarding using TCP / UDP but give no indication of whether the CSM predictor forward supports ICMP.

I am having trouble pinging from an interface on the sup720 / switch fabric on a different subnet to a server on a vlan defined in the CSM as a server vlan.
Not seeing any hits on the csm for this serverfarm.
You said the servers can be on either the CSM or MSFC, but if put the servers to be load balanced on the MSFC, I will need to put in client Nat on the serverfarm to ensure the real server does not attempt to reply directly back to the requestee. If this is the case, does the CSS use a 1 to 1 Nat relationship or does it essentially do a many to 1 address (PAT)

ACE - ICMP Client --- Server VLAN

I am still trying to get the idea why it is not possible to get some ICMP replys from the ALIAS of the server VLAN when requesting the echo coming from the client side.
The ICMP and also the traceroute works great with the inspection of ICMP for RSERVER -> Server VLAN -> Client VLAN -> OUT.
The problem or issue is only when you try to get echo replys from the Server VLAN Alias and it's according ip and peer ip addresses.
Funny thing is one of the interface addresses answers. In a context A it is the "ip address" and in a context B it is the "peer ip address".
Kind off questions my sanity here. :)
My inspection rules are applied to the client vlan's or transfer network interfaces whatever view you prefer and work so far as intended.
Any idea Gilles?
Roble

I see, but i also have the same beahvior when routing inside a context.
Have a look at context "Test" config. It has a client side vlan (444) and a server side vlan (555).
The communication path for my ping looks like below.
MyWorkstation <-> L3 Device <-> Context Test (Vlan 444) <-> Context Test (Vlan 555) -> ip, peer ip, alias
As you can see i am staying inside the context test just passing the packet coming from the vlan 444 to an ip address inside vlan 555. So this should work.
I am not talking about following communication path which can't work regarding you're statement above.
Context Admin (Vlan 444) <-> Context Test (Vlan 444) <-> Context Test Vlan (555)-> ip, peer ip, alias
Roble

CSM Loadbalancing multiple server VLANs

Is it possible to loadbalance servers located in multiple VLANs using the CSM? I have a need to loadbalance sites the may be located in different VLANs/Subnets but I am unable to consolidate them into a single subnet.

Its possible.
Just make sure that return traffic from Real Servers should not bypass CSM.
This can be achieved by using one of the three methods.
1. By configuring CSM's server Vlan IP as the Default Gateway on Real Servers.
Or
2. Using Source NAT on CSM.
Or
3. Using PBR
HTH
Syed Iftekhar Ahmed

Cannot ping REAL server IP addresses from CSM 6500

I have a dual 6500/CSM routed topology in which the traffic from clients to the server VIP works fine. However, in preparation for some upcoming work, I find that I cannot ping the REAL server IP addresses. This would seem to be an important troubleshooting step. Any ideas why this wouldn't work?

Gilles, followup question. If I understand this, what you outlined above will allow traffic external coming into the 6500/CSM to be forwarded thru to the REAL server IPs. If it wasn't clear, I was trying to ping from the native-mode 6500 that contains the CSM. I've tried regular and extended pings using the CSM-configured server VLAN's IP and alias IP, but get no response back from any of the REAL server IP addresses.
Is what you've indicated required to ping even if I'm on the 6500 which contains the CSM?

Upgrading CSM server from 3.1.1 SP 3 to CSM 3.2 SP1

I am getting an error when attempting to Upgrade my CSM server 3.1.1 SP1 to 3.2 SP1... (See attachement) (Incorrect CSM version, 3.1.1 is not compatible with this version service pack)I need to bring my CSM server to 3.2 to be able to support me IDSM-2 sensors at version 6.1
Thanks,

I am trying to Upgrade from 3.1.1 to 3.2 as recommedned. But I am getting fatal error during installation: Discard or deploy changes to DB on CSM server before upgrade....I logged into the CSM server and Submited and also Discarded all the changes
(There was no changes to be deployed)...Still getting same errors. Any suggestion out there ??
Thanks,

Migration DHCP from server 2012 R2 to 2012

Hi,
how to do DHCP role transfer from windows server 2012 R2 server to 2012 server. tried to export and import db ,while importing db getting an error "TLS configured but not supported"
Thanks,
Shamal

Hi,
In addition, you can install Windows Server Migration Tools on the destination and source servers and then use Windows PowerShell cmdlets to perform migration. For more detailed information, please refer to the links below:
DHCP Server Migration: Preparing to Migrate
Install, Use, and Remove Windows Server Migration Tools
DHCP Server Migration: Migrating the DHCP Server Role
Best regards,
Susie

ACE: Initiate connections from server vlan to client

With my ACE, I'm trying to initiate connection from server to client side. This connection is refused by ACE (ACE sends a RST for this connection). I think I missing something.
From client to servers off course I have no problem. Thanks in advace for your help.

You need an inbound access-list for traffic to be passed. Probably you do have an inbound access-list on the client vlan but not on the server vlan ?

CSM Multiples VLANs

In my enviroment lab, I´ve configured multiples vlans servers in CSM module, each vlan server belongs to a different subnet.
Is there some way to prevent real servers from a vlan server to access real servers from a different vlan server?

What about using a VACL to prevent access between VLANs?
~Zach

Is there a way to prevent DHCP from egress per port via ACL?

Is there a way to prevent DHCP from egress per port via ACL?
i am running serveral SRW248G4's in a MDU enviroment. I need a way to not have dhcp from one customer to the other, however get mine through uplink port.
Any ideas?

i don't think that this would be possible. when you setup acl to prevent services (dhcp in your case), you would need to specify an ip or range of ip address. if computers is yet to receive an ip then it wont even communicate with the dhcp server.

Need Help Streaming Video From Web Server Built Into Application - Linksys WRT54g Router

Very much appreciate any help getting streaming video feed from web server built into video application to work properly using port forwarding on my Linksys WRT54g wireless router.
Here is the situation:
My PC is connected to the internet via a Linksys WRT54g wireless router.
The Windows XP Pro SP2 firewall is enabled, with a firewall exception established for the video camera application.
On the router, forwarding of port 80 is enabled for the LAN IP address of the PC running the video application with an embedded web server, and the web server in the video camera application is also set to use port 80.
I have a free DYNDNS account and also run the DYNDNS updater program on the PC running the video application with embedded web server. According to the DYNDNS web site and the DYNDNS updater program, the IP address assigned to the machine running the video application with embedded web server is set correctly in my dyndns account.
When I open a browser (Explorer or Firefox) on the PC running the video camera application with embedded web server, I am able to connect to the video application's web server by going to the dyndns address linked to the machine running the video application. The video application's web server is set to use the dyndns address. That's the good news. The bad news is that I can't connect to the video application's web server from any machine that connects to the internet that uses a router other than the router used by the PC running the video application. I am only able to connect to the streaming video from the application's web server only on machines that connect to the internet using the same (home) router used by the PC that is running the video application.
Since I am able to connect to the video app's embedded web server successfully on the machine running the video application, it seems that at least something about the current port forwarding settings is correct. For example, if I uncheck 'enable' for forwarding of port 80 on the router settings page, I am no longer able to connect to the video app's web server when I try to do so in a browser running on the machine running the video app. When I re-enable port 80 forwarding on the router, I am again able to connect to the web server of the video application on the machine running the video app. I thought that by enabling forwarding of port 80 on the router and associating that port with the LAN IP of the machine running the video application, it would be possible to connect to the streaming video of the video app's embedded web server from ANY machine connected to the internet, but that is not the case. There must be some other router settings to update/change in order to get the port forwarding working to enable a successful connection to the video web server, but I am stumped. Very grateful for any suggestions as to how to get this working properly.
Thanks in advance...

The firewall log can be configured on the third tab in the window for the firewall settings, where you can turn the firewall on and off completely.
From your tests, though, it does not seem to be the firewall. However, to be sure, it would be good to check the log. It will help to eliminate the firewall as the culprit and you may find it handy in the future, too. ;-) Just don't forget to turn the log off again after you are done because it may cause some performance penalty on your system while on.
From what you write, it seems as if I should give a little networking background on the ip addresses you'll see. Your setup is (or should be) a modem connected to the WAN/Internet port of the WRT. The computer is connected into a LAN port of the WRT.
Your router has two IP addresses (that's what makes it a router): a WAN address and a LAN address. The WAN address is the address assigned by the ISP. It is a normal internet IP address. Everyone is able to send packets to this IP address. The WAN address is the one reported by whatismyipaddress.com, it should be listed in the dyndns record and it is the address that your router shows on the Status page. It's the public IP address of your router. Dyndns maps your dyndns.org name to that IP address.
Your router also has an IP address on the LAN side. You can configure it to be whatever you want. The default is 192.168.1.1 with netmask 255.255.255.0 and it is better to leave it like that or at least inside the network 192.168.*.*. 192.168 is a special, reserved IP address range for private networks. Basically, routers in the internet are not supposed to forward addresses in this range. That makes them suitable for private LANs as the packets never can get anywhere. Most people using Linksys routers have there LAN in 192.168.1.*.
The router acts as gateway, which means it forwards packets from PCs in the LAN to the internet and back. As all your PCs in your LAN share a single WAN IP address, the gateway does address translation (NAT). This works only in one direction: from the inside to the outside. The router remembers when a PC in your LAN sends something out and accepts the responses in and sending them back to the PC. If something comes in from the internet which cannot be associated with a ongoing communication the packet is dropped unless you use port forwarding.
All computers in your LAN either have a static IP address assigned or use DHCP to get it automatically. The router has a DHCP server as well which gives out IP address from 192.168.1.100-149 if not changed. With a router with default settings static IP addresses can be in the range of 192.168.1.2-99 and 150-254.
ipconfig /all reports your IP address in your LAN, i.e. an address 192.168.1.*. The gateway in this output should be 192.168.1.1 which is your router. And packet no in the LAN address range 192.168.1.* is send to the router which forwards the packets into the internet.
An address 192.168.1.* should not appear as internet address in the Status page of the router nor should it appear at dyndns.
Port forwarding is used to operate a server in the LAN. By default, a server in the LAN cannot be reached from the internet. You have to configure port forwarding for this. You configure that traffic bound for a specific port (e.g. TCP port 80 for http) on your WAN IP address is forwarded to the same port on a specific LAN IP address. If your server runs on 192.168.1.50 than traffic to your WAN IP address port 80 is forwarded to 192.168.1.50 port 80. That way your HTTP server can be reached from the internet. As you can only configure a fixed IP address in port forwarding it is recommended that the server uses a static IP address and not DHCP as in the latter case the IP address may change over time...
O.K. so much for networking. I hope that makes things a little clearer and you can verify that your setup is how it is intended to be.
I suggest the following: on the router's security page there is an option to block WAN requests. Remove the check if it is set (meaning: do not block). After you did that change you should be able to ping your WAN address (e.g. ping xxxx.dyndns.org) from the internet. That way we know that it is on the correct address.
Also on the Administration page make sure that remote management is disabled (should be like that per default) or that the management port is NOT 80 but for example 8080. What is your your UPnP settings on the same page?
O.K. that should be enough for the moment...

CSS- traffic orignating from real server + Virtual interface

Hi all,
I am designing a solution at the moment, in which I shall have 2 servers behind a pair of CSS & their default gateway will be the Virtual Interface ip address of CSS.
Is there any problem forseen in traffic getting initiated from the server to any other subnet in the network and the return traffic to the server.
Servers shall connect to a pair of 3750 being used as L2 in stack .
The Stacked 3750's shall be placed below the CSS pair & the CSS pair shall further connects to a single 6509 upstream....
Each 3750-L2 connects single port to each CSS
(3750-L2-1 to CSS1 &
3750-L2-2 to CSS 2)
Both CSS connect to the SINGLE 6509 on diff blades. for better redundency.
The CSS shall not be connected to each other directly.
Both 3750-L2 connect to each other as well
IIS-1---L2_Sw1---CSS1---6509---Othr_Subent
IIS-1---L2_Sw2---CSS2---6509---Othr_Subent
Note: I shall have VIP/Virtual Interface config on my CSS's.
Appreciate validation and recomendations on this design.
Many Thanks,
gagan

Hi Gilles,
Many thanks for the confirmation.
Request verification on the below as well~
1. With the above scenario; I do not require any group (NAT) configuration, either for my servers initiating traffic for going out or for clients hitting the VIP to reach servers. The client & server shall be in diff VLAN?s of course.
2. With VIP & Virtual Interface configuration & couple of server VLAN's below on server side, I should be able to use both the gigabit interfaces on the 11503 to connect up and down stream as TRUNK. I mean to ask Virtual intf. & VIP has no problems working on the same TRUNK interface?
3. I understand that Fate sharing and critical service helps full failover (client & server side).
As an upstream router or L3 switch fails or the upstream connecting gigabit interface on CSS fails, the failover happens.
Will the same be applicable to downstream L2 switch & CSS interface failure? If any of these on the downstream fails will the CSS failover to the standby unit.
I think this above should work, just need confirmation coz I have not done this before.
Thanks a lot again,
Gagan

DHCP from CSM Server VLAN

Similar Messages

Maybe you are looking for