Configuring multiple DHCP scopes via single layer 3 interface

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Configuring multiple DHCP scopes via single layer 3 interface

Hi All,

 

I am running PanOS 10.1.0 vm image. Devices are connected as mentioned below.

 

Firewall E1/2 ---> L3 switch ---> Vlan 10, Vlan 20

 

I would really appreciate if some can tell me how to configure two DHCP scopes for Vlan 10 and Vlan 20 in PA firewall because once I configured one scope under E1/2 , for second scope E1/2 is not appearing.

 

gayansasamarakoon_0-1634935691287.png

 

 

I would really appreciate your help.

 

Thank You,

Gayan   

1 accepted solution

Accepted Solutions

Cyber Elite
Cyber Elite

Thank you for posting question @gayansa.samarakoon

 

The DHCP server is bound to an interface. This is one of the pre-requisite: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/dhcp/configure-an-interface-as... Once you assign an interface to one pool, you will have to create a new interface for other pool.

 

If possible, could you configure on PA side sub-interfaces Eth1/2.10 and Eth 1/2.20 and assign an IP address to each interface, then configure E0/0 on R6 as dot1.q trunk and add Vlans 10 and 20 to the trunk? In this way you will be able to create a separate DHCP pool for Vlan 10 and 20. If you have configured an SVI interface as Gateway in R6 for Vlans 10 and 20, could you move it to PA sub-interfaces Eth1/2.10 and Eth 1/2.20 and assign them as Gateway DHCP option? After this, clients in Vlans 10 and 20 should be able to get an IP address from PA.

 

Kind Regards

Pavel

 

 

Help the community: Like helpful comments and mark solutions.

View solution in original post

8 REPLIES 8

Cyber Elite
Cyber Elite

Thank you for posting question @gayansa.samarakoon

 

The DHCP server is bound to an interface. This is one of the pre-requisite: https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/networking/dhcp/configure-an-interface-as... Once you assign an interface to one pool, you will have to create a new interface for other pool.

 

If possible, could you configure on PA side sub-interfaces Eth1/2.10 and Eth 1/2.20 and assign an IP address to each interface, then configure E0/0 on R6 as dot1.q trunk and add Vlans 10 and 20 to the trunk? In this way you will be able to create a separate DHCP pool for Vlan 10 and 20. If you have configured an SVI interface as Gateway in R6 for Vlans 10 and 20, could you move it to PA sub-interfaces Eth1/2.10 and Eth 1/2.20 and assign them as Gateway DHCP option? After this, clients in Vlans 10 and 20 should be able to get an IP address from PA.

 

Kind Regards

Pavel

 

 

Help the community: Like helpful comments and mark solutions.

Hi Pavel,

 

Thanks a lot for your prompt reply and valuable insight regarding this issue.

 

Regards,

Gayan

Hello Gayansa,

I have just seen this and I am interested in your setup, I am also building multiple interfaces on my PA-415, I have managed to have one single interface working with a DHCP address. Then is set up ports 6 to 9 as a separate interface on vlan 100, when I configure 4 x ports into one vlan, I am presented with DHCP address but I cant route outbound traffic. 

Hello Pavel,

I have read this reply with interest and I can see how to set a VLAN interface as dot1.q trunk on the PA-415. On the interfaces -> VLAN, i can't find an option for trunk?

Can you assist please.

From Jatin

Hi there,

To set an interface as a trunk you need to set it as a Layer2 interface and create sub-interface under it. Each sub-interface would typically be configured with a unique ID and VLAN object pair.

 

Configure a Layer 2 Interface, Subinterface, and VLAN (paloaltonetworks.com)

 

cheers,

Seb.

L2 Linker

Hello Seb,

Thank you for the reply,

If I change my WAN interface from layer 3 to layer 2, and then add in sub interfaces to carry untagged traffic as default from Ethernet 1/4 and then VLAN 100 tagged traffic from ethernet 1/4 to ethernet 1/6. How do I specify the IP address of the interace on the interface.

 

Then wouldnt have to change the interface type in the Zones and Interface menus?

L4 Transporter

Hi there,

if you are just trying switch the WAN frames through the firewall, then yes your WAN interface needs to be an untagged Layer2 interface, and Eth1/6 again needs to be an untagged Layer2 interface, both interfaces need to share the same VLAN object to ensure they are part of the same broadcast domain.

 

In this topology the firewall does not need an VLAN 100 SVI.

 

cheers,

Seb.

Thank you Seb,

I shall modify my configuration and do a few tests.

From Jatin

  • 1 accepted solution
  • 4827 Views
  • 8 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!