IPSec and DHCP relay

[jdprovine]

Can a DHCP relay be configured on the PA to be used by and IPSec tunnel also configured on the PA?

[markus.wissgott]

What exactly do you mean with "be used by an IPSec tunnel" ??

[jdprovine]

@markus.wissgott 

We are doing a virtual desktop trial with a vendor in the cloud, they are going to connect to us using a IPSec tunnel that we are going to set up on the palo alto firewall. So instead of putting DHCP server in the clouds to hand our IP addresses to the virutal desktop they are hosting for us we want them to connect and get IP addresses from our network DHCP servers. So.... I am trying to figure out if that is possible

[markus.wissgott]

Ok. As i know, it isn't possible because your setup is a Layer 3 VPN. DHCP works on layer 2 and even if your Cloud Provider offers a Layer 2 Tunnel like GRE, it isn't possible to terminate the Tunnel with a Palo Alto Networks Firewall.

my advice:

1. You need a DHCP relay agent in the local subnet of your clients (or a dhcp server). Maybe the Gateway of your Cloud Provider can do it? Ask him.

OR

2. You could run a Palo Alto VM in the network of your Virtual Desktop Clients and use it as a DHCP Relay Agent or DHCP Server

OR

3. static ip adress.... (depends on your setup and your pain...)

[jdprovine]

@markus.wissgott

The provider can do it, but those in charge opted not to let the provider host it.

[markus.wissgott]

There Are No Technical Solutions to Human Problems. Sorry.

Maybe the Cloud Provider support IPv6 and IPv6 Autoconfiguration on his Gateway in the local Network?

And what do you mean with "to let the provider host it." ??

The Provider should not Host a VM Palo Alto or a DHCP Service?

[jdprovine]

@markus.wissgott

I think that the vendor offers and option to host a DHCP server for the virtual desktops in the cloud.  but for what ever reason we decided to try to use our own.