Multiple DHCP Scope’s on 1 interface

[Sjoerd]

I have a router with 2 VLAN’s. The router is connected to a PaloAlto and behind this PaloAlto I have a server witch serves DHCP. The VLAN interfaces on the router are configured with a helper address to the DHCP server.

We would like to remove all servers (and go fully cloud based). I decided I want the PaloAlto to serve the DHCP function. So: I should define the 2 DHCP scope’s of the routed VLANs to the interface connected to this router. However: It seems I’m restricted to only 1 IP scope per interface. Can I work around this issue?

Side note: I’m not able to attach the routed VLANs directly to the PaloAlto cause off its maximum MAC entries.

[Mick_Ball]

Just a stab in the dark...

could you not add an unused interface, keep you VLAN current structure but pont one of the helper addresses to the new interface with a scope for that VLAN.

or just find some old hardware and use linux DHCP.

[Sjoerd]

I thought about that.

Not able to test at this moment, but does this interface needs an IP address to serve DHCP? At that moment the egress traffic for that VLAN will go directly to that interface since it’s directly connected.

And what about the MAC restrictions? Does the firewall keep those MAC entries in its table?

[Mick_Ball]

I can't really advise as never had to do this myself.

yes i would assume it needs an ip address so that you can add this as an "ip helper" for VLAN2.

so.... VLAN1 ip helper would point to your existing interface and VLAN2 helper tou your new (not directly connected but routed) interface.

life would have been easier if the DHCP server could be added per subnet or sub-interface on the PA.

you may be able to do something clever with VLan tagging, but not sure if your VLAN switch is capable... good luck anyhows...

Mick.

[rmfalconer]

You could create a new virtual router and add the interface to the new VR.  That way, traffic in the default VR destined for that subnet won't egress through the DHCP enabled port.

[Sjoerd]

Thanks for your reply

I just tested this with a dedicated virtual router, and this seems to work.

However: the leases show up in my ARP table. Is there a way to avoid that? The main reason for the router is the limitation in the ARP table of the Palo Alto

[rmfalconer]

As far as I know, there's no way to keep those entries from the arp table. They should time out on that interface after 30 minutes and probably not be present again until the hosts try to renew their leases.

What model are you using that can't handle the necessary arp entries?