Nextelco:ASA VPN DHCPrelay

DHCP through VPN

Is time to set up something really useful. In our general schema we have some site to site VPNs between ASA devices sitting on Africa and Norway. In order to have a centralized DHCP server it is necessary to configure ASAs in order to provide DHCP requests and replies through the VPN. In the following Figure we can see the configuration details.

In order to set the DHCP configuration, first we need to set up the initial configuration and the VPN between these two ASAs. In order to set up the initial configuration refer to the following configuration steps.

At this point, it is necessary to understand how DHCP and specially DHCP relay works in order to know how to set up everything. So, these are the necessary steps:

1. The client, user machine, broadcasts a DHCP DISCOVER packet.
   • IP source: 0.0.0.0
   • IP destination: 255.255.255.255
   • Port source: 68
   • Port destination: 67
   • Relay agent IP address: 0.0.0.0




2. ASA2 takes the packet and based on its DHCP relay configuration it sends the DHCP DISCOVER packet directly to the DCHP server.
   • IP source: 10.10.10.2
   • IP destination: 192.168.1.2
   • Port source: 67
   • Port destination: 67
   • Relay agent IP address: 192.168.2.1




3. The DCHP server takes the DHCP DISCOVER packet and it replies with a DHCP OFFER. It sends the offer to the RELAY AGENT (ASA2).
   • IP source: 192.168.1.2
   • IP destination: 192.168.2.1
   • Port source: 67
   • Port destination: 67
   • Relay agent IP address: 192.168.2.1
   • Your IP address: 192.168.2.2




4. ASA2 takes the DHCP OFFER and it sends to the client.
   • IP source: 192.168.2.1
   • IP destination: 192.168.2.2
   • Port source: 67
   • Port destination: 68
   • Relay agent IP address: 192.168.2.1
   • Your IP address: 192.168.2.2




5. The client starts with the DCHP REQUEST.
   • IP source: 0.0.0.0
   • IP destination: 255.255.255.255
   • Port source: 68
   • Port destination: 67
   • Relay agent IP address: 0.0.0.0
   • DHCP server: 192.168.1.2
   • Requested IP address: 192.168.2.2




6. ASA2 takes the REQUEST and it forwards to the DHCP server.
   • IP source: 10.10.10.2
   • IP destination: 192.168.1.2
   • Port source: 67
   • Port destination: 67
   • Relay agent IP address: 192.168.2.1
   • DHCP server: 192.168.1.2
   • Requested IP address: 192.168.2.2




7. The DHCP server takes the REQUEST and replies with a DHCP ACK.
   • IP source: 192.168.1.2
   • IP destination: 192.168.2.1
   • Port source: 67
   • Port destination: 67
   • Relay agent IP address: 192.168.2.1
   • DHCP server: 192.168.1.2
   • Your IP address: 192.168.2.2




8. Last step. ASA2 takes the ACK and it forwards to the client.
   • IP source: 192.168.2.1
   • IP destination: 192.168.2.2
   • Port source: 67
   • Port destination: 68
   • Relay agent IP address: 192.168.2.1
   • DHCP server: 192.168.1.2
   • Your IP address: 192.168.2.2

Return to Phase 1 page.