Configuring DHCP over VPN Prepared by SonicWALL, Inc. 11/12/2002

Size: px

Start display at page:

Download "Configuring DHCP over VPN Prepared by SonicWALL, Inc. 11/12/2002"

Garey Wade
5 years ago
Views:

1 Configuring DHCP over VPN Prepared by SonicWALL, Inc. 11/12/2002 Introduction One of the major challenges when planning and deploying a VPN network is the allocation of address space. This has been made easier in firmware version , with the ability to tunnel DHCP over VPNs. This feature will allow network administrators to manage their entire IP address space from a central DHCP server. Also, by enabling this feature it will allow users who travel with their laptops between Work and a Home Office, configured with a SonicWALL VPN device, to have the same Network configuration (i.e. WINS Settings, DNS Settings, Network Mappings) at both locations without having to do any manual configuration. This document will describe how to configure both the DHCP server, using Microsoft Windows 2000 Advanced Server, and the SonicWALL firewalls to enable this feature. Further Considerations For Deployment There are two scenarios for making use of DHCP relay through the VPN tunnel. The first is the use of a single scope shared by both the corporate LAN as well as the remote sites and the other is the use of unique scopes created for each remote site. Each has distinct benefits and the configurations for each method differ. In both scenarios it is imperative to remove or exclude from the scope, all DHCP relay IP addresses and in the Unique scope scenario, the Static LAN IPs, to prevent the DHCP server from assigning these addresses elsewhere. Note that the relay IP address will be the managed address through the VPN tunnel from the corporate LAN. Before You Begin This TECHNote assumes the reader has enabled the DHCP server on the Windows 2000 Advanced Server, and is familiar with the configuration of the DHCP parameters, and is familiar with the configuration of SonicWALL devices. Network Configuration for Unique Scopes In this example given we will be creating a Hub and Spoke VPN between two remote sites, and a central location. The devices at each remote site are configured for DHCP and have a dedicated unique scope per site. The network is depicted below: Page 1 of 11

2 Figure 1 - Network Diagram DHCP Enabled Clients DHCP Enabled Clients RemoteSite01 Workstation Workstation Workstation Workstation Workstation Workstation RemoteSite02 Internet RemoteSite01: WAN IP /24 LAN IP /24 DHCP Relay IP RemoteSite02: WAN IP /24 LAN IP /24 DHCP Relay IP CentralSite: CentralSite WAN IP LAN /24 LAN IP /24 DHCP Server: DHCP Server Important Note: When MS Windows (95/98/ME/NT/XP) are unable to contact a DHCP server their IP address will default to an invalid MS default IP address (i.e /16), and users will not be able to access the Internet or any device via the VPN tunnel. Therefore, when users will either need to reboot their PCs or execute the IPCONFIG/renew command to obtain their IP addresses once VPN connectivity is reestablished. SonicWALL has the ability to use the local DHCP service for temporary Internet access in the event that the DHCP service through the VPN tunnel is unavailable. These steps will be outlined later. Configure DHCP Server We will configure each remote site with a 28-bit network mask. Allowing each remote network to have 14 IP addressable devices on their network. Therefore, we will need to create a DHCP scope for each remote network. Perform the following steps to create these unique scopes on a Windows 2000 Server: 1. Go to: Programs -> Administrative Tools -> DHCP 2. Select: Action-> New Scope 3. Create a Scope for the /28 by entering the following: Page 2 of 11

You can enter other IP addresses here, which will be configured manually by users, such as IP Phones or

3 4. Make sure to exclude addresses for the LAN IP address and the DHCP relay by entering the following: This will insure that the IP addresses used the LAN gateway and DHCP relay will not be given to any DHCP clients. You can enter other IP addresses here, which will be configured manually by users, such as IP Phones or Network Printers. 5. Configure the Default Gateway for this remote network by entering the following: Page 3 of 11

information such as NTP Servers, DNS Servers, etc. 7.

4 6. You can now configure other Network Options for these remote networks. The example below defines the steps necessary for configure the WINS server information, but this can include other information such as NTP Servers, DNS Servers, etc. 7. Make sure you activate this scope by selecting that option during configuration, or selecting: Action -> Activate. Configure the Central Gateway 1. Logon to the Central Gateway SonicWALL device. Select DHCP->DHCP over VPN. 2. Enter the following: Page 4 of 11

this SA. Repeat this step for each remote site. Configure Remote Site 1.

5 3. Configure the VPN to the Remote Sites by entering the following: Make sure to select the option: Destination network obtains IP addresses using DHCP through this SA. Repeat this step for each remote site. Configure Remote Site 1. Configure the VPN to the Central Site 2. Configure the VPN by entering the following: Page 5 of 11

6 3. Select DHCP -> DHCP over VPN 4. Enter the following: 4. Select the VPN you are going to use for obtaining a DHCP address. In this case, select the CentralSite SA. Page 6 of 11

7 5. Enter the DHCP Relay IP address. This should be an address that has been excluded from the DHCP scope. Also, if you want to use a 30-bit subnet mask for a network with 2 DHCP enabled hosts you can use the broadcast IP address as the DHCP relay IP address. 6. Duplicate these steps for each Remote Site. 7. Note that the status tab will provide useful information including the leased and the static relay addresses. Network Configuration for Same Scope In this example given we will be creating a Hub and Spoke VPN between two remote sites, and a central location. The devices at each remote site are configured for DHCP and will use the same scope as the central site. VPN Configuration of the SonicWALLs for passing DHCP through the tunnel using a single scope is the same as outlined in the Network configuration for Unique Scopes with the exception of the assigned LAN and DHCP relay IPs. The network is depicted below in figure 2. Note: it is critical to configure the static LAN IP outside of the DHCP scope and outside of the destination networks in the VPN policy. Failure to do so will result in the inability to create an SA to the hub. Additionally, it is not necessary to exclude the static LAN IPs of the remote SonicWALLs from the scope. Figure 2 - Network Diagram DHCP Enabled Clients DHCP Enabled Clients RemoteSite01 Workstation Workstation Workstation Workstation Workstation Workstation RemoteSite02 RemoteSite01: WAN IP /24 LAN IP DHCP Relay IP Internet RemoteSite02: WAN IP /24 LAN IP /24 DHCP Relay IP CentralSite CentralSite: WAN IP /24 LAN IP /24 DHCP Server: DHCP Server Configuring Same Scope DHCP Relay in a Hybrid Topology In this scenario, Site B, Site C and Site D need access to Site A and in addition Site B and Site C need access to each other as outlined on figure 3. It is important for this scenario to use Relay IPs for the remote sites from the upper end of the scope, as this is necessary for creating the remote site to remote site VPN. Note: Sites B and C will need to add a LAN subnet defining the DHCP scope as a local network as illustrated in figure 4. This is crucial to successfully completing phase two during the SA creation. Page 7 of 11

8 Figure 3 - Network Diagram Site B Site C SOHO3 Site D RemoteSite01: WAN IP /24 LAN IP DHCP Relay IP SOHO3 SOHO3 RemoteSite02: WAN IP /24 LAN IP /24 DHCP Relay IP CentralSite: WAN IP /24 LAN IP /24 PRO 300 DHCP Server: Central Site Page 8 of 11

Figure 4 - Network Diagram Obtaining Temporary Leases in the Event of DHCP over VPN Failure In the event that DHCP over VPN has failed as in the case of a VPN failure or DHCP server failure, it is

9 Figure 4 - Network Diagram Obtaining Temporary Leases in the Event of DHCP over VPN Failure In the event that DHCP over VPN has failed as in the case of a VPN failure or DHCP server failure, it is possible to obtain leases from the local SonicWALL therefore allowing Internet access until the VPN or DHCP server is restored. In this scenario, the local scopes will be created using the subnet of the static LAN IP address of the local SonicWALL as illustrated in figure 5 and 6. In the case of the TZ where two static LANs exist, you can configure two DHCP scopes including one for the workport and the second for the homeport again using the subnet of the static LAN IP address of the local SonicWALL. Page 9 of 11

10 Figure 5 - Network Diagram Page 10 of 11

Figure 6 - Network Diagram Conclusion Configuring Remote Sites to utilize the DHCP via VPNs is an effective way to centrally manage the IP address space for your entire VPN deployment, and will

11 Figure 6 - Network Diagram Conclusion Configuring Remote Sites to utilize the DHCP via VPNs is an effective way to centrally manage the IP address space for your entire VPN deployment, and will facilitate, if needed, a mechanism to re-ip address your VPN network from a central location as well as provide a mechanism for providing dynamic updates to the remote sites. Also, by utilizing this feature it will allow workers that travel between work and a home/office, which are configured with a hardware VPN tunnel the user will only need to have their laptop configured with DHCP and they will be able to get all their network information from the Central Site DHCP server. Figure 6 - Network Diagram Page 11 of 11

Manual Key Configuration for Two SonicWALLs

Manual Key Configuration for Two SonicWALLs VPN between two SonicWALLs allows users to securely access files and applications at remote locations. The first step to set up a VPN between two SonicWALLs