DHCP Relay through another firewall

Hello,
I have set up two ISA Servers in my lab (learning environment).
One faces the internet, the other one is in between the lan and the perimetral network.
Sort of:
LAN  <--- ISA2--->  DMZ  <---ISA1---> INTERNET.
The thing is that the other office connects to ISA1 through a VPN-Site-to-Site, and it goes all fine except that ISA1 cannot take any ip from the dhcp server standing on the lan.
I have read this: http://technet.microsoft.com/en-us/library/cc302680.aspx
But in my lab, there are two isa servers , so I don't know how to send dhcp requests from isa1 to isa2 excepto for broadcast 255.255.255.255 , but the isa1 does not know how to forward that to the dhcp server in the lan.
I am mixed up because I am not an expert and am learning now about this dhcp relay thing now.
Thanks in advance!!
Luis Olías Técnico/Admon Sistemas . Sevilla (España - Spain)

Thanks a lot Keith.
I was all wrong. The relation between perimeter and lan (in ISA2) is route. And as far as I have read, that is how it should be, when no external network is involved.
I have a question, I feel doubtful about: When ISA1 takes the DHCP request, does he make a broadcast petition to 255.255.255.255 or a unicast request directly to dhcp-server machine ? , because the ISA1 machine is a DHCP relay so, when I configured it I
was asked to write the ip of the dhcp server, then maybe it just knows where to send the dhcp requests from the client and does not perfom multicast 255.255.255.255 but unicast to the dhcp server ?
EDITION: In the statistics of dhcp-server, there is no dhcp requests, so the traffic is not reaching it.
I am still digging in. This is difficult for me.
Luis Olías Técnico/Admon Sistemas . Sevilla (España - Spain)

Similar Messages

  • Remote access vpn going through another firewall segment

    Hi,
    Can i know that when use remote access vpn connect to asa firewall inside interface, after that the remote access vpn is it can connect to another firewall segment , the firewall segment is behind the inside interface?

    Hello Sam,
    As long as you include that traffic into the crypto acl and also on the NO_NAT configuration  the answer would be yes. That is possible
    Regards,
    Julio

  • Setting up a DHCP relay agent

    Hello,
    I'm trying to setup a relay agent for an XP client to obtain configuration through 2 routers on a VM LAB
    I have 3 Segments/subnets 1,2 and 3
    the topology is the following:
    1- server 2008 R2 AD DS DC on subnet 1 (192.168.1.0) and a DHCP server with 2 scopes
    Internal 192.168.1.0 (subnet1)
    external 192.168.3.0 (subnet 3)
    2- server 2008 R2 with RRAS installed
    Interface 1 pointing to the internal subnet1 192.168.1.0
    Interface 2 pointing to subnet2 192.168.2.0
    3- server 2003 with RRAS installed
    Interface 1 pointing to subnet2 192.168.2.0
    Interface 2 pointing to subnet3 192.168.3.0
    relay agent installed on Interface 2
    (servers/Routers 2 and 3 running RIP v2)
    4-  XP client on subnet3 (192.168.3.0) and the client trying to obtain config.
    The XP client is unable to contact the DHCP to obtain config.
    server 2003 relay agent receiving requests with no replies.
    How do i get this to work?

    Hi,
    First, let’s see how DHCP relay agent works:
    1. The DHCP client broadcasts a DHCPDISCOVER packet.
    2. The DHCP relay agent on the client’s subnet forwards the DHCPDISCOVER message to the DHCP server by using unicast.
    3. The DHCP server uses unicast to send a DHCPOFFER message to the DHCP relay agent.
    4. The DHCP relay agent broadcasts the DHCPOFFER packet to the DHCP client’s subnet.
    5. The DHCP client broadcasts a DHCPREQUEST packet.
    6. The DHCP relay agent on the client’s subnet forwards the DHCPREQUEST message to the DHCP server by using unicast.
    7. The DHCP server uses unicast to send a DHCPACK message to the DHCP relay agent.
    8. The DHCP relay agent broadcasts the DHCPACK to the DHCP client’s subnet.
    We can see in the second step, DHCP relay agent send unicast to DHCP server after receiving DHCP request. So confirm unicast communication between DHCP server
    and DHCP relay agent works fine. At least ping should be working. You can use the following commend to add the route entry.
    Add a static IP route
    http://technet.microsoft.com/en-us/library/cc757323(v=ws.10).aspx
    The result should be based on your test. If it doesn’t work it just indicates that we cannot configure another DHCP relay agent behind a relay agent.
    Hope this helps.

  • Multiple DHCP Subnet through V lan

    Dear All,
    i like to request a help, i am not good in cisco anyone can explain me  it will help for me.
    i am trying to configure muliple dhcp subent through Valn
    1. i create a dhcp server and create 3 subetnet
    a. my network card ip 192.168.50.200 dhcp enabled
    b . configure DHCP scope for 192.168.20.0 and 192.168.30.0
    2. i have sonicwall firewall with router there i create 2 valn .
    3. cisco switch sg300-28p also create valn. ( valn 20 port 3-5) (Vlan 30 port 7-10) create a trunk port for both Vlan port number 2.
    i give conection from sonicwall to switch trunk port 2 and connect laptop to valn 20 port i am getting 192.168.20.0 range ip, if i connect to laptop to Vlan 30 also getting Vlan 30 range IP.( this time Sonicwall DHCP is enabled)
    now come to the point, i need to relase DHCP from my server, so i disable dhcp from Sonicwall. and enable dhcp from server.
    but i am not getting ip address from server to any valn.
    i create a trunk port for DHCP server and connect to there. then also same problem
    please help to configure the best way.

    what you have to do is configure ip helper addresses on your vlans to point to the new server, it was probably pointing to your sonicwall which is why it was working on the sonicwall, but once you changed over to your server, you have to convert it over to your new dhcp server.
    without port forwarding your switches/routers do not know where to send those requests, especially if they are on different vlans.  thats one ceveat to running vlans and switches, it doesnt like flooding out requests to every port.
    it appears to be under:
    ip config - udp relay/ip helper
    that section, add your new dhcp server to that and it should fix it so it sends your dhcp requests to your dhcp server.

  • DHCP requests through ASA

    Hi ,
    I have ASA5585 in routed mode (Check the attached diagram) , and my DHCP client on the inside , while the DHCP server is on the outside.
    I know that ASA can be configured as a DHCP relay , but there is a condition
    “DHCP clients must be directly connected to the ASA and cannot send requests through another relay agent or a router”
    Is this means that the setup in the attached diagram cannot work ?
    Is there any other way to make it work , without changing the ASA to transparent mode?

    Hi,
    I think the text above refers to a situation where you are actually using the ASA to Relay DHCP messages.
    You couldnt therefore use the ASA to relay DHCP messages that were relayed by another device behind the ASA. Though I dont know why the DHCP messages would need to be relayed twice.
    But as we can see in this case the L3 Switch is the device that handles the relay of DHCP messages to the actual DHCP server and the ASA doesnt have to do anything related to DHCP other than pass the unicast UDP traffic. Therefore you wouldnt be confiuring any DHCP related settings on the ASA and the above quote/limitation wouldnt apply to your setup
    So it seems to me that you can leave out all the DHCP/DHCP relay configurations from the ASA and just allow the traffic originating from the L3 Switch
    I might be able to lab this for you at some point at my home network if needed (Though naturally with different ASA model). Though I think we have several environments at work already that use an ASA5585-X (multiple context mode) where the customer Router uses "ip helper-address" to relay DHCP messages to a DHCP server located on a DMZ inteface of the ASA context.
    - Jouni

  • ASA Hub-and-spoke VPN dhcp-relay

    Hi!
    Have anyone implemented a solution with a hub-and-spoke IPSEC VPN (running ASA) with dhcp relay for the inside clients on the spoke. With the DHCP server on the hub site?
    Normal LAN-LAN IPSEC VPN is a bit cumbersome to configure something like below: 
    SPOKE
    <snip>
    access-list CRYPTO_ALLOWED extended permit ip INSIDE-NETWORKS any
    #ALL INTERNET ACCESS GOES THROUGH THE SPOKE SITE
    access-list CRYPTO_ALLOWED extended permit udp host OUTSIDE_IF_ADDR host HUB_DHCP_SERVER_ADDR eq bootps
    access-list CRYPTO_ALLOWED extended permit udp host OUTSIDE_IF_ADDR host HUB_DHCP_SERVER_ADDR eq bootpc
    nat (INSIDE,OUTSIDE) source static CRYPTO_ALLOWED CRYPTO_ALLOWED destination static OSKO-INTERNET OSKO-INTERNET route-lookup
    dhcprelay DHCP-SERVER outside
    dhcprelay enable INSIDE
    dhcprelay setroute INSIDE
    dhcprelay timeout 60
    HUB
    <snip>
    access-list CRYPTO_ALLOWED_TO_SPOKE extended permit ip 0.0.0.0 0.0.0.0 HUB_NETWORKS
    access-list CRYPTO_ALLOWED_TO_SPOKE extended permit udp host HUB_DHCP_SERVER_ADDR host SPOKE_OUTSIDE_ADDR eq 67
    access-list CRYPTO_ALLOWED_TO_SPOKE extended permit udp host HUB_DHCP_SERVER_ADDR host SPOKE_OUTSIDE_ADDR eq 68
    nat (INSIDE,OUTSIDE) source static ANY ANY destination static SPOKE_NETWORKS SPOKE_NETWORKS
    nat (INSIDE,OUTSIDE) source static HUB_DHCP_SERVER_ADDR HUB_DHCP_SERVER_ADDR destination static SPOKE_OUTSIDE_ADDR SPOKE_OUTSIDE_ADDR
    ### HUB INTERNET ACCESS ##
    nat (OUTSIDE,OUTSIDE) source dynamic SPOKE_NETWORKS interface
    I can't really apply this to a hub-and-spoke configuration.
    Any ideas?
    Regards
    Daniel

    Thanks. That's what I thought. I'm trying to configure this a my lab and having trouble though. Here's what I am trying to accomplish: HUB should communication with spoke1 and spoke2 via ipsec vpn using their own internal addresses HUB: 192.100.10.0/24, SPOKE1 10.142.0.0/24, SPOKE2 10.25.0.0/24) Communication between SPOKE1 and SPOKE2 should be nat'ed by the HUB so SPOKE2's addresses appear to be 172.16.128.0/24. SPOKE1's interesting traffic rule will allow the entire 172.16.128.0 255.255.128.0 subnet. Any new SPOKE's will use another subnet of that network. In my head I think I might need to let SPOKE2 NAT it's own traffic before it gets to HUB, but I'm dealing with multiple different devices as spokes so I want to handle everything on the HUB. Ideally the HUB would translate all traffic in both directions so both business partners and clients would only need one supernet in their interesting traffic rules.

  • Portal access through a firewall

    Hi there!
    Having the default installtion of R2 on a single W2K box, what's the minimal procedure to make this configuration available through a firewall?
    I've opened ports 7777-7778 but fail when trying to logon via SSO (host.domain.com:7777/pls/orasso)
    Have I missed out to open another port or am I forced to follow the steps of setting up a reversing proxy to have portal-access outside the firewall?
    Cheers
    /Staffan

    If they are on different servers, then both are listening on the 7777 port, and you will have to change one of them to use another port (assuming your firewall can only port forward a port to only one host).
    If you are running both instances on the same server, then your SSO is accessible via 7777 and your midtier would be on 7778, so your setup as described should be enough (I do the same thing).
    If they are running on the one machine, can you access the SSO/INF server directly? http://inf.domain.com:7777 and then http://inf.domain.com:7777/pls/orasso ?

  • Solaris 10 ssh through a firewall

    I have Solaris 10 up and running on an HP Vectra. Everything is fine until I attempt to ssh through my firewall from the outside world.
    I can ssh from my linux systems on the lan. But when I attempt to ssh from outside using either putty or ssh on another solaris 10 system the connection times out.
    Anyone else experience a similar problem? Many thanks in advance.
    John Wright
    Asst Professor
    CIT
    Bellevue University

    It's hard to tell what's going on without some more information. Here're a few things you can try:
    Run "ssh localhost" from the Solaris box and make sure that works.
    ssh to the Solaris box from another box on the same network segment.
    From the site that doesn't work, do "ssh -v solaris_box" and see if that gives you any clues.
    After trying to ssh from outside, do a "netstat -an |grep -i '*.22' and see the state of the TCP connection
    (or if the first packet never even makes it).
    Run sshd on the Solaris box with with the "-d" debug option.

  • ASA 5512-X - VPN & local clients DHCP relaying (DHCP Proxy vs. DHCP Relay conflict)

    Hey all,
    I have ASA-5512-X serving as general firewall/router. It also serves as AnyConnect SSL VPN gateway (webvpn).
    It has ~10 VLANs connected over 1 trunk port. One of the VLANs has DHCP server that shall serve all the VLANs (192.168.16.2).
    I'm trying to have the ASA relay DHCP requests from all VLANs to the DHCP server and to also serve VPN clients.
    However, according to bug https://tools.cisco.com/bugsearch/bug/CSCsd22469 both DHCP Proxy (webvpn) and DHCP Relay (local interfaces) can't be enabled at the same time.
    As VPN clients connect to the same VLANs as local users (eg. VLAN 2 - 192.168.2.0/24) I want to have the very same DHCP server serving both, otherwise it's gonna become a mess.
    Note: if I configure DHCP Relay functionality and disable DHCP Proxy - local clients are served fine. If I configure DHCP Proxy (webvpn) and disable DHCP Relay VPN clients are served fine. I therefore consider setup to be correct, just the ASA limitation won't allow me to make it serve both.
    Can DHCP Relay also serve VPN clients (no DHCP Proxy enabled)? did I miss something?
    Thanks!

    Hi,
    The only workaround for this issue is to configure the ASA itself to act as DHCP server for vpn clients. You also have the flexibility of using local pool and AAA server. Why exactly do you want to use the same DHCP server for both?
    AM

  • WRVS4400Nv2 DHCP Relay on 2nd VLAN

    Hi,
    Here's what I'm trying to figure out:
    My network is set up such that I have a Wireless Network in VLAN 1, which is the primary network that we use.  The subnet is 10.5.1.x.
    My goal is to set up a completely isolated Guest Wireless Network, however it would work best.  What I am trying to do now is I created a seperate VLAN (VLAN 2, IP range 10.5.2.x) and turned on DHCP on the WRVS4400N.  However, in the Guest Network, it is always picking up a 10.5.1.x IP which is handed out by the DHCP server (10.5.1.5, Win 2003) and still routing all of the traffic to/from our private network.
    Here's What I have set:
    Wireless>Security Settings>Guest Network (SSID 2)
    Wireless Isolation (between SSID w/o VLAN): Enabled
    Wireless Isolation (within SSID): Enabled
    Setup>LAN>VLAN 1
    Router IP 10.5.1.1, WLAN IP 10.5.1.3
    DHCP Relay for 10.5.1.5
    Setup>LAN>VLAN 2
    Router IP 10.5.2.1
    DHCP Enabled for 10.5.2.x subnet
    DHCP Relay option is grayed out (not sure why)
    Setup>Advanced Routing
    Inter-VLAN Routing: Disabled
    Any way to solve this would be fine.  I just do not want traffic routing through our internal network.  Ideally, if I could get the Windows server to hand out 10.5.2.x addresses, that would be perfect, but I'm not sure how to configure it for such. 
    If anyone has any ideas, that'd be great- thanks!
    Matt

    Yes...here's an answer I got from Cisco's Engineering support:
    The issue you reported is a know issue.
    Engineering and development are aware of this issue, and have provided  the following information:
    PROBLEM DESCRIPTION:
    If the WRVS4400N is configured with multiple VLANs, and these VLANs are  mapped to different SSID, the user cannot use an external DHCP server to  provide IP scopes for these VLANs.
    Hosts connected to both SSID will obtain IP address from native DHCP  server only.
    The workaround for this is to use the embedded DHCP server for all VLANs  defined on the WRVS4400N.
    Note: This is not considered a bug but rather a product limitation. The  developer has confirmed the WRVS4400N is functioning as designed.
    Regarding a fix:
    Due to wireless and trunk switch port using different chip set, it is  not possible to provide a fix for this issue.
    In future product, Engineering & Dev teams will strive to use the  same chip set (same vendor). 
    This functionality has been targeted for next new Product.  No fix will  be made on the current hardware. 
    Note: If this feature/function is mission critical to your deployment,  and you would like to recover the cost of the WRVS4400N, please forward  the serial number and a copy of the proof of purchase, and we will  gladly provide a refund.
    Best regards,
    Alex Delano

  • How to configure Dhcp relay agent

    How I can to configure the wrt54g like a dhcp relay agent? please i need help, tell me

    A DHCP relay agent is any host that forwards DHCP packets between clients and servers. Relay agents are used to forward requests and replies between clients and servers when they are not on the same physical subnet. Relay agent forwarding is distinct from the normal forwarding of an IP router, where IP datagrams are switched between networks somewhat transparently. By contrast, relay agents receive DHCP messages and then generate a new DHCP message to send out on another interface. The relay agent sets the gateway address (giaddr field of the DHCP packet) and, if configured, adds the relay agent information option in the packet and forwards it to the DHCP server. The reply from the server is forwarded back to the client after removing option .

  • DHCP request through accesspoint and router

    This is how our setup is like:
    Laptops => Cisco 1100 AP(static IP) => Wired LAN (Subnet 1) => Cisco Router => Wired LAN (Subnet 2) => DHCP server
    What i would like is that the DHCP-request from our laptops is forwarded/relayed through the AP and Router to the DHCP-server and back.
    We dont want to use the AP's internal DHCP server but centralise this.
    At the moment i'v configured the AP through CLI and added the following command: ip dhcp-server xx.xx.xx.xx
    Where xx is the IP of the DHCP server
    On the Router i'v added the command ip helper-address xx.xx.xx.xx
    Where xx is the IP of the DHCP server
    Don't know if this is the correct way, but i do know it isn't working.
    Some help is realy appreciated.
    Grx,
    Joris

    You need at least the following connectivity for DHCP relay to work.
    Between the DHCP relay agent and the DHCP server:
    - UDP Port 67 <-> UDP Port 67
    Between the DHCP server and the DHCP client:
    - UDP Port 67 <-> UDP Port 68 (renewing/releasing a lease)
    - ICMP echo (Most DHCP servers check if an IP is still free)
    On the Cisco router you can use some debugging commands
    to check that relaying works.
    (This might produce a lot of output, careful on a production system.)
    #term mon
    #debug ip dhcp server packet
    #debug ip dhcp server events
    For Subnet 1 with the router's IP 10.0.0.1 and two configured
    DHCP servers (192.168.0.1, 192.168.9.1) as "ip helper" a successfull
    exchange looks like this:
    DHCPD: DHCPREQUEST received from client 0100.aabb.bbcc.cc.
    DHCPD: setting giaddr to 10.0.0.1.
    DHCPD: BOOTREQUEST from 0100.aabb.bbcc.cc forwarded to 192.168.0.1.
    DHCPD: BOOTREQUEST from 0100.aabb.bbcc.cc forwarded to 192.168.9.1.
    DHCPD: forwarding BOOTREPLY to client 00aa.bbbb.cccc.
    DHCPD: Forwarding reply on numbered intf
    DHCPD: creating ARP entry (10.0.0.49, 00aa.bbbb.cccc).
    DHCPD: unicasting BOOTREPLY to client 00aa.bbbb.cccc (10.0.0.49).
    #undebug all
    I would also try to ping the router's IP in Subnet 1 and a client
    with a fixed IP in Subnet 1 from the server. (The DHCP server uses
    this to check if a lease is actually free before handing it out)
    Otherwise it's time for packet sniffing on the DHCP server
    and the client. (snoop, tcpdump, ethereal)

  • DHCP relay issues - WLC4400 series

    Hi all,
    I'm experiencing some strange problems with my WLC 4400 – and hope you guys can give me a hand.
    There is an issue while connecting a WLAN Client to the WLC for the first time. I pinpointed the source of the problem to the dhcp, but I wondering why this happens…
    As stated above – the issue occurs only during the first time registration of a WLAN client with the WLC. If I do another registration right after the failed connection attempt, the session is established and I can start working in my network environment.
    Because we use 802.1x authentication, my first idea was that there is an issue – but the authentication process completes successfully.
    Another debug for the dhcp process showed an issue during the initial registration process. I'll paste an extract of the NOT working connection attempt below (DHCP DISCOVER msg and DHCP OFFER msg passed successfully – I'll focus on the DHCP REQUEST msg):
    ###### Extract one ######
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcpProxy: Received packet: Client 00:21:6a:00:35:9c
                            DHCP Op: BOOTREQUEST(1), IP len: 303, switchport: 29, encap: 0xec03
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option len, including the magic cookie = 67
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: received DHCP REQUEST msg
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: skipping option 61, len 7
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: requested ip = 10.64.153.66
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: server id = 1.1.1.1
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: skipping option 12, len 12
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: vendor class id = MSFT 5.0 (len 8)
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcp option: skipping option 55, len 12
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcpParseOptions: options end, len 67, actual 67
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcpProxy: dhcp request, client: 00:21:6a:00:35:9c:
                            dhcp op: 1, port: 29, encap 0xec03, old mscb port number: 29
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c Determing relay for 00:21:6a:00:35:9c
                                                                                                            dhcpServer: 10.49.143.8, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 0.0.0.0  VLAN: 0
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c Relay settings for 00:21:6a:00:35:9c
                                                                                                            Local Address: 0.0.0.0, DHCP Server: 10.49.143.8,
                            Gateway Addr: 10.64.153.1, VLAN: 0, port: 29
    Tue Mar  9 09:51:31 2010: 00:21:6a:00:35:9c dhcpProcessPacket return an error,chaddr: 00:21:6a:00:35:9c
    The process stops working after the last line above. The client reports connection successfully, but no IP address was assigned to the client. A second connection attempt was successful (again – I'll focus on the dhcp REQUEST msg – ignoring DISCOVER, OFFER and ACK msg):
                            DHCP Op: BOOTREQUEST(1), IP len: 303, switchport: 29, encap: 0xec03
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option len, including the magic cookie = 67
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: received DHCP REQUEST msg
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: skipping option 61, len 7
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: requested ip = 10.64.153.66
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: server id = 1.1.1.1
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: skipping option 12, len 12
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: vendor class id = MSFT 5.0 (len 8)
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcp option: skipping option 55, len 12
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcpParseOptions: options end, len 67, actual 67
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c dhcpProxy: dhcp request, client: 00:21:6a:00:35:9c:
                            dhcp op: 1, port: 29, encap 0xec03, old mscb port number: 29
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c Determing relay for 00:21:6a:00:35:9c
                                                                                                            dhcpServer: 10.49.143.8, dhcpNetmask: 0.0.0.0,
                            dhcpGateway: 0.0.0.0, dhcpRelay: 10.64.153.6  VLAN: 300
    Tue Mar  9 09:53:02 2010: 00:21:6a:00:35:9c Relay settings for 00:21:6a:00:35:9c
                                                                                                            Local Address: 10.64.153.6, DHCP Server: 10.49.143.8,
    The major difference seems to be in line 16:
    Not Working:
                            dhcpGateway: 0.0.0.0, dhcpRelay: 0.0.0.0  VLAN: 0
    Working:
                            dhcpGateway: 0.0.0.0, dhcpRelay: 10.64.153.6  VLAN: 300
    For me it seems that the WLC is not able to forward this request to the appropriate dhcp server.
    Does anyone of you have an idea, why this happens? And why does this happen only during the first time login of every client? Or am I misinterpreting the debug output?!
    Thx a lot in advance!
    Cheers
    Martin

    Hi,
    thx for your comment so far.
    I did some additional troubleshooting yesterday and I guess I fixed the problem. The management interface was configured with two dhcp server IPs (0.0.0.0 and 1.1.1.1).
    Within the Cisco documentation it is stated that the dhcp relay proxy feature uses a virtual IP 1.1.1.1.
    0.0.0.0    seems to be used for the internal communication.
    When I changed the dhcp address (primary & secondary) to IP 1.1.1.1 the problem was solved. We tested it yesterday evening and this morning.
    My assumption is that the virtual 1.1.1.1 IP is mandatory to match the dhcp responses to the proxy relaying feature. Or the WLC uses the DHCP addresses on the management interface to forward the traffic to the appropriate feature (where 1.1.1.1 triggers the proxy feature and 0.0.0.0 is used to forward the traffic to the internal dhcp service). But this is just a guesswork – I do not know the Cisco WLAN good enough to provide a valuable explanation.
    Cheers
    Martin

  • Windows DHCP Server and Linux DHCP Relay Agent

    We are trying to organize a VLAN (say VLAN 1) for guests who must be assigned IP addresses from a DHCP server in a different VLAN (VLAN 2). This DHCP server is configured with two scopes - 172.16.0.0/24 (for VLAN 2) and 172.16.4.0/24 (for the Guests
    VLAN 1). The DHCP server successfully distributes addresses to clients in its VLAN (it has the IP address 172.16.0.2). For the clients in the other VLAN a DHCP Relay Agent has been setup on the router. It is DHCRELAY running on Linux (CentOS) which has
    been configured to accept the DHCPDISCOVER broadcasts coming on the VLAN1 interface of the router and forward these to the DHCP server. The IP address of the VLAN1 interface of the router is 172.16.4.254 and on the VLAN2 interface - 172.16.0.254
    The problem is that the DHCP server won't respond with a DHCPOFFER message to the relay agent. I have traced the frames on the router and on the DHCP server. They arrive on the DHCP server with the correct GIADDR of the relay agent. According to all documentation,
    if a scope has been configured on the DHCP server and it receives a unicast message with the GIADDR set by a relay agent that matches one of the configured scopes, the DHCP server must send a unicast DHCPOFFER to the relay agent. But it doesn't.
    Here is what Wireshark reports (ignore the Destination port unreachable messages, the DHCP service was stopped at the time Wireshark was running)
    When the service is running, there are just DHCPDISCOVERs - no OFFER. You can see that the server has the two scopes configured:
    The relay agent seems to work normally - it forwards the DHCPDISCOVERs to the server continuously (tried many times with ipconfig /renew on the client).
    I read many posts about this problem. Some users had other services running on the DHCP server that used the DHCP port, but I don't have such an issue (you see that when the service is stopped, an ICMP port unreachable is sent which is correct). Others however
    did not find a solution. Am I missing something? Is there something specific when using the DHCRELAY agent from DHCPD? Can I turn on some verbose logging to track this down? Thanks in advance.

    WIth DHCP, there is really nothing to configure. If the Relay Agent/IP Helper is pointing to it, and the VLAN subnet exactly matches the scope subnet, then it should just work.
    What I've seen in the VLAN config is either a static route back to the subnet the DHCP server itself is sitting on is not configured or incorrectly configured, or there are ports blocked (need UDP, too, since that's what DHCP uses to pass the OFFER), and
    other necessary ports are opened, then it should just work.
    Sometimes NIC teaming on the DHCP server will cause it. Not sure. Microsoft doesn't support teaming prior to Windwos 2012, but it doesn't mean that it doesn't work. Don't get me wrong, teaming works nicely, but they just don't support it because they never
    certified the drivers, that's all.
    The issues I've seen with DHCP relays and VLANs in the forums are usually based on misconfigs in the VLAN or ports blocked. Sometimes we'll refer to call Microsoft Support for specific, hands-on assistance. And searching the threads, from what
    I've found that if they did call support, they've never posted back what the problem was based on or the resolution. I can post a couple of them for you to read through, but there were never any response with the actual resolution.
    If you like, you also have the option to contact Microsoft Support. Here's a list of phone numbers if you choose this option:
    http://support.microsoft.com/contactus/
    Ace Fekay
    MVP, MCT, MCITP/EA, MCTS Windows 2008/R2 & Exchange 2007, Exchange 2010 EA, MCSE & MCSA 2003/2000, MCSA Messaging 2003
    Microsoft Certified Trainer
    Microsoft MVP - Directory Services
    Technical Blogs & Videos: http://www.delawarecountycomputerconsulting.com/
    This post is provided AS-IS with no warranties or guarantees and confers no rights.

  • HT204022 I have copied some photos to my I phone through the computer of my friend. I want to delete those photos but not able to do. My friend is not in my country. I tried through another computer but didn't know how to delete it

    I have copied some photos to my I phone through the computer of my friend. I want to delete those photos but not able to do. My friend is not in my country. I tried through another computer but didn't know how to delete it

    If they were synced to your phone, they can only be removed by syncing them off with iTunes.  Create an empty folder on the computer you normally sync your phone with.  Then connect your phone to your computer, open iTunes, click on the name of your phone in iTunes, go to the photos tab and select to sync the empty folder you created earler.  Then click Apply at the bottom to sync your phone.  This will remove any photos on your phone that were synced to it from a computer.

Maybe you are looking for

  • Problem in conversion of file into array of proper format

    how to do following  1) TO RETREIVE ALL THE SET OF STRING LOGGED  BETWEEN THE TIMINGS THAT IS GIVEN BY USER AS INPUT AND THE FORMAT TIMINGS OF IS BEING ATTACHED IN DEMO.DOCX  THIS IS ONE OF THE SET RQ_TM::11:28:41 68556885844D13E9516 RS_TM::11:28:42

  • Why does my volume not work

    A couple of days ago my phone volume stop working. When I call it works fine, everything doesn't work. I tried to restore my phone but it didn't work and then I disabled my restrictions but nothing changed. I do not know what to do.

  • Regarding Rework in production order

    Hi Everybody, I am having an issue regarding re-work concept in prod.order. Following is the scenario: The total prod. order quantity is 100 pcs, but 80 pcs are done correctly and 20 are bad quality. Our requirement is, client don't want to scrap the

  • Lion migration question

    from windows 7 to lion i want to migrate.. i tried once and i see that it makes a new user... is there anyway to merge users from windows to mac?

  • Photo Stream import directly into Library (consolidated)?

    I have just started using Photo Stream with Aperture and it's a wonderful feature, however something prompted me to look for the original photo and I couldn't see the usual "Open in Finder" option, which said to me it was Consolodated. Now, I don't m