Use DHCP relay with GlobalProtect

MarcelST — Mon, 18 May 2020 12:27:00 GMT

Hi,

I've been doing some research on the option of using DHCP relay on Palo Alto for all the GlobalProtect gateways, and i'ts not clear to me if it's possible or not.

The thing is, we want to enable Secure DNS records registration for the GlobalProtect IP network pools, but because currently the Palo Altos are the ones providing the IP, instead of doing DHCP relay to our internal DHCP servers, we can't enable it.

Re: Use DHCP relay with GlobalProtect

OwenFuller — Fri, 22 May 2020 14:21:06 GMT

I don't think GP supports giving addresses to clients via DHCP. When clients connect to the gateway, they're forming a point-to-point tunnel. This tunnel has an IP address and a subnet mask of 255.255.255.255 that the client uses to identify the tunnel, and the tunnel interface on the firewall may not even have an IP address to use as a default gateway. It's not quite the same as just handing the client an address, subnet mask, gateway, etc. from DHCP in a traditional layer 3 network.

These forum posts, while older, seem to support this, and I have never seen any documentation about using DHCP instead of IP pools on GP.

https://live.paloaltonetworks.com/t5/general-topics/dhcp-relay-for-globalprotect/td-p/205699
https://live.paloaltonetworks.com/t5/general-topics/global-protect-dhcp-config/td-p/228635

topic Re: Use DHCP relay with GlobalProtect in GlobalProtect Discussions

Use DHCP relay with GlobalProtect

Re: Use DHCP relay with GlobalProtect