RE: [fw-wiz] Cisco PIX DHCP relay via IPSEC

From: Lagula, Cecil (clagula_at_taylorbean.com)
Date: 10/24/03

  • Next message: Lagula, Cecil: "RE: [fw-wiz] (no subject)" 
    To: "Scot Kreienkamp" <Scot@pc-sos.net>, <firewall-wizards@honor.icsalabs.com>
Date: Thu, 23 Oct 2003 19:15:37 -0400

    If you are talking about the PIX's doing DHCP on the outside interface
    the answer is yes. You can setup the PIX as a DHCP server for the
    inside interface and add "dhcpd option 150 ip [ip address of the TFTP
    server]" in your DHCP options.

    One of the PIX's will need to have a static IP address and the other
    would initiate the IPSec tunnel. The PIX with the static IP address
    will have to be setup with dynamic static maps.

    Hope that helps.

    Thanks,

    Cecil

    -----Original Message-----
    From: Wes Noonan [mailto:mailinglists@wjnconsulting.com]
    Sent: Wednesday, October 22, 2003 12:15 PM
    To: 'Scot Kreienkamp'; firewall-wizards@honor.icsalabs.com
    Subject: RE: [fw-wiz] Cisco PIX DHCP relay via IPSEC

    I don't believe that the PIX can pass DHCP/bootp, but don't hold me to
    that
    (never tried it). The remote PIX could be configured to be a DHCP server
    that you can manage however, and TFTP would easily pass through the VPN
    tunnel so that might be another option to address your needs.

    HTH and good luck.

    Wes

    > -----Original Message-----
    > From: firewall-wizards-admin@honor.icsalabs.com
    [mailto:firewall-wizards-
    > admin@honor.icsalabs.com] On Behalf Of Scot Kreienkamp
    > Sent: Wednesday, October 22, 2003 09:59
    > To: firewall-wizards@honor.icsalabs.com
    > Subject: [fw-wiz] Cisco PIX DHCP relay via IPSEC
    >
    > Hi all,
    >
    > I'm looking at using two PIX's to do site to site IPSEC via the
    > internet. Because I don't control all the devices at the remote end
    one
    > of my requirements is that I be able to do DHCP/Bootp and TFTP from
    the
    > remote end to the head end via the IPSEC VPN. Does anyone know if the
    > PIX will be able to do this?
    >
    > If anyone has a better product in mind that can accomplish this please
    > let me know, I'm not stuck on the PIX but I do need a workable
    solution
    > within the next few days. Please don't say linux, I've already been
    > turned down there. :)
    >
    > Thanks!
    >
    > Scot Kreienkamp
    > Scot@PC-SOS.net
    >
    >
    > _______________________________________________
    > firewall-wizards mailing list
    > firewall-wizards@honor.icsalabs.com
    > http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards
    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Lagula, Cecil: "RE: [fw-wiz] (no subject)"

    Relevant Pages

    • Re: WAN IP Address Help
      ... PIX Setup ... Interface IP Address) ... LinkSys Setup ... > However if I replace the PIX firewall with a Linksys Cable/DSL Router ...
      (comp.dcom.sys.cisco)
    • Two ISP - One Router - 1 PIX
      ... Presently I have a setup like this ... ... which is connected a switch1 and a PIX Firewall whose inside interface ...
      (comp.dcom.sys.cisco)
    • Re: need help with Cisoc vpn 3015
      ... > I placed an order for a new 4 port interface card. ... setup, which them needs a dedicated interface for statefull information sync ... setup a route statement on the pix to route all 10.1.100.x network ... > traffic to the vpn 3015 private int. ...
      (comp.dcom.sys.cisco)
    • Re: PIX 501 dhcpd and default gateway
      ... If the implementation was clean the pix would allow to set "private" dhcp option values and not try to be smart and interfere with it. ... The PIX is not intended to be a sophisticated DHCP server. ...
      (comp.dcom.sys.cisco)
    • RE: [Full-Disclosure] Unusual behaviour of PIX
      ... Proxy arp is on by default on the PIX. ... Your WAN clients could be getting the Mac Address of the PIX, instead of the DHCP server when trying to obtain an IP address via DHCP. ...
      (Full-Disclosure)