topic IPSec and DHCP relay in General Topics

IPSec and DHCP relay

jdprovine — Fri, 28 Sep 2018 14:43:36 GMT

Can a DHCP relay be configured on the PA to be used by and IPSec tunnel also configured on the PA?

Re: IPSec and DHCP relay

markus_w — Fri, 28 Sep 2018 15:17:37 GMT

What exactly do you mean with "be used by an IPSec tunnel" ??

Re: IPSec and DHCP relay

jdprovine — Fri, 28 Sep 2018 15:24:50 GMT

@markus_w

We are doing a virtual desktop trial with a vendor in the cloud, they are going to connect to us using a IPSec tunnel that we are going to set up on the palo alto firewall. So instead of putting DHCP server in the clouds to hand our IP addresses to the virutal desktop they are hosting for us we want them to connect and get IP addresses from our network DHCP servers. So.... I am trying to figure out if that is possible

Re: IPSec and DHCP relay

markus_w — Fri, 28 Sep 2018 15:43:04 GMT

Ok. As i know, it isn't possible because your setup is a Layer 3 VPN. DHCP works on layer 2 and even if your Cloud Provider offers a Layer 2 Tunnel like GRE, it isn't possible to terminate the Tunnel with a Palo Alto Networks Firewall.

my advice:

1. You need a DHCP relay agent in the local subnet of your clients (or a dhcp server). Maybe the Gateway of your Cloud Provider can do it? Ask him.

2. You could run a Palo Alto VM in the network of your Virtual Desktop Clients and use it as a DHCP Relay Agent or DHCP Server

3. static ip adress.... (depends on your setup and your pain...)

Re: IPSec and DHCP relay

jdprovine — Fri, 28 Sep 2018 15:47:55 GMT

@markus_w

The provider can do it, but those in charge opted not to let the provider host it.

Re: IPSec and DHCP relay

markus_w — Fri, 28 Sep 2018 15:56:52 GMT

There Are No Technical Solutions to Human Problems. Sorry.

Maybe the Cloud Provider support IPv6 and IPv6 Autoconfiguration on his Gateway in the local Network?

And what do you mean with "to let the provider host it." ??

The Provider should not Host a VM Palo Alto or a DHCP Service?

Re: IPSec and DHCP relay

jdprovine — Fri, 28 Sep 2018 16:34:34 GMT

@markus_w

I think that the vendor offers and option to host a DHCP server for the virtual desktops in the cloud. but for what ever reason we decided to try to use our own.