topic Re: Site to Site vpn with Dhcp server at remote site in General Topics

Site to Site vpn with Dhcp server at remote site

strobins — Fri, 17 Nov 2017 02:50:50 GMT

Hi,

I have a site to site ipsec vpn between 2 PA devices. Lets call them Site A and Site B and at Site A I have a Cisco router acting as a dhcp server. I'm trying to have all the client at Site B get their dhcp address and scope options from the cisco router at Site A. I have the sites connected to each other and I setup a dhcp relay agent on Site B PA device. I can see the client making the request and the request hitting the dhcp server at the remote site, but I'm not receiving an IP address at the client. For simplicty, I created the vpn tunnel between the two sites to land in the same zone as the trusted.

I did see this thread https://live.paloaltonetworks.com/t5/General-Topics/DHCP-relay-through-a-VPN-tunnel/m-p/65406/highlight/true#M39062 only diffence is they're using an ASA.

I've done this in the past with an ASA and I know it works, but I'm not sure if it works with Palo Alto. Does anyone have a senerio like this configured?

Thanks,

Re: Site to Site vpn with Dhcp server at remote site

pulukas — Sat, 18 Nov 2017 11:54:40 GMT

It sounds like you need a security policy to permit the dhcp reply on the PA. This would be from the zone of the tunnel interface to the zone where the client is connected to the network.

Re: Site to Site vpn with Dhcp server at remote site

strobins — Sat, 18 Nov 2017 21:00:12 GMT

Hi Pulukas,

I have them both on the trusted zone for simplicity. Do I still need a rule?

Re: Site to Site vpn with Dhcp server at remote site

pulukas — Sun, 19 Nov 2017 11:46:36 GMT

The default intrazone policy is to permit so if that has not been overridden it should work. You can confirm the deployed rule.

https://live.paloaltonetworks.com/t5/Management-Articles/What-are-Universal-Intrazone-and-Interzone-Rules/ta-p/57491

Or just create an explict one for this traffic so you can see session init logs confirming the traffic arrives on the PA.

If the logs don't help we can try packet captures to confirm what is happening.

Re: Site to Site vpn with Dhcp server at remote site

MFayez — Sun, 19 Nov 2017 13:22:05 GMT

Please attachet some pic to your main PA configurtion for DHCP Server and DHCP Relay

Re: Site to Site vpn with Dhcp server at remote site

strobins — Fri, 24 Nov 2017 13:29:08 GMT

Will do. When I get back. Have to run to one of our remote sites for 2 weeks.