topic Re: DHCP Relay for GlobalProtect in General Topics

DHCP Relay for GlobalProtect

david13holt — Thu, 15 Mar 2018 16:45:00 GMT

I'm trying to setup globalprotect where once a user successfully logs in, they pull an IP from our dedicated, internal DHCP server with all the DHCP options. So essentially, setup Palo Alto for a DHCP relay for the GlobalProtect clients. I was trying to do this, but the Tunnel Interface I'm using for the GlobalProtect network doesn't have an IP and doesn't show up when trying to configure a DHCP relay. Is there anyway to do this? Thank you.

Re: DHCP Relay for GlobalProtect

OtakarKlier — Thu, 15 Mar 2018 17:13:10 GMT

Hello,

The IP adress you need is for the actual DHCP server and not the tunnel interface.

In addition to this you will need the policies that allow the DHCP traffic to go betweenthe VPN zone and trust zone if you have them.

Hope that helps.

Re: DHCP Relay for GlobalProtect

Remo — Thu, 15 Mar 2018 17:30:50 GMT

@OtakarKlier

Does this really work for global protect clients? I thought this is not supported ... as you also have to configure an IP pool in the GP gateway configuration...

Re: DHCP Relay for GlobalProtect

OtakarKlier — Thu, 15 Mar 2018 17:50:59 GMT

Hello @Remo,

I honestly dont know. I was lookign at it from the perspective of the dhcp relay setup. It'll take me some time to set this up in a lab. Maybe @reaper, knows.

Regards,

Re: DHCP Relay for GlobalProtect

reaper — Fri, 16 Mar 2018 09:55:45 GMT

hi guys!

Ehm, as far as I know that's not possible at this time. If you have a RADIUS that supports framed-ip, you can pull an IP that way, but it will probably not include all the options you'd like:

There are currently 2 outstanding feature requests: FR 2924 and FR 4703 (so please reach out to your sales team and have them add your vote, i already added mine)

Re: DHCP Relay for GlobalProtect

david13holt — Fri, 16 Mar 2018 22:02:22 GMT

@reaper So you are saying that DHCP relay, to give a DCHP address to GlobalProtect clients, with the PA forwarding DHCP requests, is not possible at this time?

If that's the case, is there anyway to provide proxy information for clients who do connect? That's my main reason in trying to create a relay for GlobalProtect clients. We have DHCP option 252 in our scope and have that pushing to clients with AnyConnect and was hoping to do the same with GlobalProtect. Is there anyway to push a configs or dynamically assign proxy settings to GlobalProtect clients?

Thanks everyone for the help.

Re: DHCP Relay for GlobalProtect

Remo — Sat, 17 Mar 2018 09:09:36 GMT

@david13holt What about using DNS for distributing the proxy settings to the vpn clients or GPOs?

(In case your clients are windows based)

Re: DHCP Relay for GlobalProtect

reaper — Mon, 19 Mar 2018 09:58:29 GMT

Hi @david13holt

currently the dhcp for GP is not that advanced (make sure to vot e on that feature request)

you can have a wpad entry on your DNS that could help distribute the proxy settings, instead of dhcp option 252

Re: DHCP Relay for GlobalProtect

david13holt — Tue, 20 Mar 2018 00:42:20 GMT

@Remo @reaper Thanks guys. I'm gonna have to do this for now. I really appreciate the quick response and information provided.

Re: DHCP Relay for GlobalProtect

Shaun.Zielonka — Thu, 15 Oct 2020 17:12:24 GMT

Any fix for this?

Re: DHCP Relay for GlobalProtect

jmretting — Sun, 04 Apr 2021 03:10:09 GMT

No and that's kinda 😞

Re: DHCP Relay for GlobalProtect

michaelfriedman — Mon, 20 Mar 2023 12:53:44 GMT

OtakarKlier,

Were you able to integrate this with AD DHCP (In your Lab) or is Reaper Right, that this has not been fixed yet, because of FR 2924 and FR 4703 not being implemented? I do not see 4703 in the Feature Request now. Only 2924.

Thank You,

Re: DHCP Relay for GlobalProtect

OtakarKlier — Mon, 20 Mar 2023 12:59:39 GMT

Hello,

I have not set this up in a lab. For VPN clients, I would suggest using the Global Protect DHCP configuration.

Regards,

Re: DHCP Relay for GlobalProtect

RobertShawver — Fri, 16 Feb 2024 19:02:33 GMT

For anyone else that comes across this, it's now 2024, nearly a full six years after the original post, and Palo still simply does not have an answer. It's always the same, "Just put in a FR".

Well, do you know who does have this? Fortinet.

Re: DHCP Relay for GlobalProtect

TomYoung — Sat, 06 Sep 2025 13:58:47 GMT

Now supported in PAN-OS 11.2.

https://docs.paloaltonetworks.com/whats-new/new-features/may-2024/globalprotect-support-for-pan-os-11-2-dhcp-based-ip-address-assignments