[SOLVED] PIX dhcprelay via IPSec.

Hi List,

thanks for all of the answers I got to this question.

I found the solution by accident yesterday - I was just checking which
sysopts were enabled and decided spontaneously to try this one - and
wanted to ask you all a couple of questions about it. 

When I enabled 'sysopt ipsec pl-compatible' on the center firewall DHCP
started working immediately.

According to
http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_62/config/
privlink.htm sysopt ipsec pl-compatible does the following:

'The PIX Firewall currently can simulate the Private Link inside
termination with the use of the sysopt ipsec pl-compatible command, but
the termination on the inside interface is not a true termination. The
use of the sysopt ipsec pl-compatible command allows IPSec packets to
bypass the NAT and ASA features, and enables incoming IPSec packets to
terminate on the inside interface only after initially terminating on
the outside interface.'

Have any of you used this system option before? Any idea whether it
might break something else?

Thanks for your input,

Chris

> -----Original Message-----
> From: Meidinger Chris [mailto:chris.meidinger@badenIT.de] 
> Sent: Thursday, March 16, 2006 12:22 AM
> To: firewalls@securityfocus.com
> Subject: PIX dhcprelay via IPSec.
>
> Hi List,
>
> I have a question about relaying DHCP over VPN with PIX.
>
> I have the following setup:
>
> Client
>  |
>  |
>  |
> Remote Site PIX running in network-extension mode
> |V| 
> |P| Internet
> |N|
> Central PIX acting as concentrator
>  |
>  |  Net 1
>  |
> Inside Pix providing access control
>  |
>  |  Net 2
>  |
> DHCP Server x.x.x.x
>
> The client needs to talk to the DHCP-Server in Net 2. It can ping the
> DHCP fine so routing and all is OK, but the relayed Unicasts on udp/67
> seem to die inside the remote PIX. No log messages, no debug messages
> (at least in any debug mode I though to try) and still no packet.
>
> I have the following config:
>
> hostname(config)# show dhcprelay
> dhcprelay server x.x.x.x outside
> dhcprelay enable inside
>
> I see statistics,
>
> hostname(config)# show dhcprelay stat
> Packets Relayed
> BOOTREQUEST          0
> DHCPDISCOVER         48
> DHCPREQUEST          0
> DHCPDECLINE          0
> DHCPRELEASE          0
> DHCPINFORM           0
>
> BOOTREPLY            0
> DHCPOFFER            0
> DHCPACK              0
> DHCPNAK              0
>
> but no packet in Net 1 and no packet in Net 2 (got inline sniffers in
> both trying to troubleshoot this)
>
> Can anyone point me in the right direction what the problem might be?
>
> Thanks in advance,
>
> Chris