Different DHCP Subnets on same Interface

[rjdahav163]

Hello everyone,

one of my customer has the following specific requirement.

PA500 version 7.1.0

Inside Interface IP: 10.0.1.1/24

Firewall should act as DHCP Server and assign IP Addresses in the following Scopes only via inside interface.

Scope: LAN Devices

Range: 10.0.1.50-10.0.1.100 /24

Gateway: 10.0.1.254

Scope: WAN Devices

Range: 10.0.25.50-10.0.25.100/24

Gateway: 10.0.25.254

Scope: Voice Devices

Range: 10.0.30.50-10.0.30.100/24

Gateway: 10.0.30.254

So the questions are following:

1.  Is such a configuration at all possible? The inside interface IP Subnet is different from WAN and Voice Scope.

2. The inside interface on PA is connected to a trunk on a switch and all the traffic to PA is untagged. How can PA differentiate whether the incoming DHCP request is from LAN device, WLAN device or a Voice device?

Thanks and Regards,

R

[BPry]

I believe that the only way to do this properly would be to setup LAN,WAN, and VOICE interfaces on your PA500 and then setup the DHCP for the interface, I believe that you can only have one DHCP scope on any particular interface. 

PS. If they are running on 7.1.0 I would upgrade them to 7.1.5 and get the latest code; they have made a lot of bug fixes since 7.1.0. 

[TranceforLife]

Or you could create a subinterfaces and have a DHCP server configured there for each network

[rjdahav163]

Yeah subinterfaces was my initial thought, but they want that the inside interface has only one IP. For each subinterface I would need one IP from respective subnet each which is not possible 😞

[Ken_Cornetet]

How would the DHCP server possibly know which type of device was making the request in order to hand out the correct IP address?

Some DHCP servers have filters where you can use MAC address prefixes to do such things, but as far as I know, the Palo Alto DHCP server doesn't offer this.

[santonic]

You said: "The inside interface on PA is connected to a trunk on a switch and all the traffic to PA is untagged"

But trunk always has tagged traffic. Otherwise trunk can't work.

So DHCP requests should arrive with correct VLAN tag and you can use subinterfaces. Actually you must use subinterfaces in this scenario otherwise only untagged (or vlan 1) traffic will be receieved by PA.

[rjdahav163]

This was exactly my argument with the customer. However his typical response is - "Other Firewall manufacturers are able to do that easily why not Palo Alto". 😞