IPSec and DHCP relay

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

IPSec and DHCP relay

L4 Transporter

Can a DHCP relay be configured on the PA to be used by and IPSec tunnel also configured on the PA?

6 REPLIES 6

L2 Linker

What exactly do you mean with "be used by an IPSec tunnel" ??

@markus.wissgott 

We are doing a virtual desktop trial with a vendor in the cloud, they are going to connect to us using a IPSec tunnel that we are going to set up on the palo alto firewall. So instead of putting DHCP server in the clouds to hand our IP addresses to the virutal desktop they are hosting for us we want them to connect and get IP addresses from our network DHCP servers. So.... I am trying to figure out if that is possible

Ok. As i know, it isn't possible because your setup is a Layer 3 VPN. DHCP works on layer 2 and even if your Cloud Provider offers a Layer 2 Tunnel like GRE, it isn't possible to terminate the Tunnel with a Palo Alto Networks Firewall.

 

my advice:

1. You need a DHCP relay agent in the local subnet of your clients (or a dhcp server). Maybe the Gateway of your Cloud Provider can do it? Ask him.

 

OR

 

2. You could run a Palo Alto VM in the network of your Virtual Desktop Clients and use it as a DHCP Relay Agent or DHCP Server

 

OR

 

3. static ip adress.... (depends on your setup and your pain...)

@markus.wissgott

The provider can do it, but those in charge opted not to let the provider host it.

There Are No Technical Solutions to Human Problems. Sorry.

Maybe the Cloud Provider support IPv6 and IPv6 Autoconfiguration on his Gateway in the local Network?

 

And what do you mean with "to let the provider host it." ??

The Provider should not Host a VM Palo Alto or a DHCP Service?

@markus.wissgott

I think that the vendor offers and option to host a DHCP server for the virtual desktops in the cloud.  but for what ever reason we decided to try to use our own. 

  • 3241 Views
  • 6 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!