Configuring multiple DHCP scopes via single layer 3 interface

[gayansa.samarakoon]

Hi All,

I am running PanOS 10.1.0 vm image. Devices are connected as mentioned below.

Firewall E1/2 ---> L3 switch ---> Vlan 10, Vlan 20

I would really appreciate if some can tell me how to configure two DHCP scopes for Vlan 10 and Vlan 20 in PA firewall because once I configured one scope under E1/2 , for second scope E1/2 is not appearing.

I would really appreciate your help.

Thank You,

Gayan   

[PavelK · Accepted solution]

Thank you for posting question @gayansa.samarakoon

The DHCP server is bound to an interface. This is one of the pre-requisite: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/dhcp/configure-an-interface-as... Once you assign an interface to one pool, you will have to create a new interface for other pool.

If possible, could you configure on PA side sub-interfaces Eth1/2.10 and Eth 1/2.20 and assign an IP address to each interface, then configure E0/0 on R6 as dot1.q trunk and add Vlans 10 and 20 to the trunk? In this way you will be able to create a separate DHCP pool for Vlan 10 and 20. If you have configured an SVI interface as Gateway in R6 for Vlans 10 and 20, could you move it to PA sub-interfaces Eth1/2.10 and Eth 1/2.20 and assign them as Gateway DHCP option? After this, clients in Vlans 10 and 20 should be able to get an IP address from PA.

Kind Regards

Pavel

[gayansa.samarakoon]

Hi Pavel,

Thanks a lot for your prompt reply and valuable insight regarding this issue.

Regards,

Gayan

[jatin_2023]

Hello Gayansa,

I have just seen this and I am interested in your setup, I am also building multiple interfaces on my PA-415, I have managed to have one single interface working with a DHCP address. Then is set up ports 6 to 9 as a separate interface on vlan 100, when I configure 4 x ports into one vlan, I am presented with DHCP address but I cant route outbound traffic. 

[jatin_2023]

Hello Pavel,

I have read this reply with interest and I can see how to set a VLAN interface as dot1.q trunk on the PA-415. On the interfaces -> VLAN, i can't find an option for trunk?

Can you assist please.

From Jatin

[seb_rupik]

Hi there,

To set an interface as a trunk you need to set it as a Layer2 interface and create sub-interface under it. Each sub-interface would typically be configured with a unique ID and VLAN object pair.

Configure a Layer 2 Interface, Subinterface, and VLAN (paloaltonetworks.com)

cheers,

Seb.

[jatin_2023]

Hello Seb,

Thank you for the reply,

If I change my WAN interface from layer 3 to layer 2, and then add in sub interfaces to carry untagged traffic as default from Ethernet 1/4 and then VLAN 100 tagged traffic from ethernet 1/4 to ethernet 1/6. How do I specify the IP address of the interace on the interface.

Then wouldnt have to change the interface type in the Zones and Interface menus?

[seb_rupik]

Hi there,

if you are just trying switch the WAN frames through the firewall, then yes your WAN interface needs to be an untagged Layer2 interface, and Eth1/6 again needs to be an untagged Layer2 interface, both interfaces need to share the same VLAN object to ensure they are part of the same broadcast domain.

In this topology the firewall does not need an VLAN 100 SVI.

cheers,

Seb.

[jatin_2023]

Thank you Seb,

I shall modify my configuration and do a few tests.

From Jatin