Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 5 replies
  • Answers 1 answer
  • Subscribers 3 subscribers
  • Views 2993 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Use of Remote DHCP Server for L2TP/IPsec

lendros

Hello,

we are trying to configure L2TP/IPSec with DHCP server for IP assigment instead of local ip pool (this works correctly). However, i only get it work if DHCP pool is the same subnet that "internal" interface. But i don't want this. 

DHCP server is located in 10.1.1.x network with 10.10.10.x scope configure for vpn users, and it is reachable via "Internal" UTM interface 10.2.2.x. So, i created a new "vpn" interface in UTM with IP 10.10.10.1 (default router) to get this ip as "relay ip address" for the correct association in the DHCP server. So, i get the log:

DHCPC: Using relay address of '10.10.10.1' DHCPC: Unicasting to server '10.1.1.x' only

But the UTM never gets the lease for the client.

DHCPC: No lease, failing.
DHCPC: Failed to obtain an IP address.  Terminating connection.

I guess because the query is sent from "VPN interface", although route table is poing to the gateway of Internal interface.

At this point, if we change the Vía Interfece from VPN to Internal, UTM relay address is 10.2.2.x and the vpn client gets an ip in that range. 

DHCPC: Using relay address of '10.2.2.1'
DHCPC: Unicasting to server '10.1.1.x' only
DHCPC: Received a packet
DHCPC: Lease of 10.2.2.xx obtained, lease time 86400

But this is not a solution for us. VPN client must be in a dedicated network.

 

Is this configuration supported for UTM? Can we accomplish this or the use of VPN local Pool is mandatory?

 

Thank you and regards.



This thread was automatically locked due to age.
Parents
  • 0

    Hola lendros - first time I've seen you, although you've been around since 2018 - welcome to the UTM Community!

    Please show us a diagram with IPs and subnets of what you want to have happen.   A picture of a hand-drawn diagram would be fine.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi there Bob, 

     

    thank your for the wellcoming.Here is a basic diagram:

     

     

     

    We would like to assign the vpn ip addresses via DHCP Server. But, if we configure "Vía Interface" as Internal (10.2.2.1), UTM reach the server with the wrong Relay address. If we create a new interface named "VPN" with IP address 10.10.10.1 and configure it in "Vía Interface"; the relay ip address is correct, but UTM cannot reach the server...

    At this point, i think if this configuration is possible with UTM or it is not supported.

     

    Thank you.

  • 0 in reply to lendros

    I see now what you want to do.  I haven't seen this done before, but I think it should be possible.

    Please show a picture of the 'Relay' tab in 'Network Services >> DHCP'.  You might also need a Static Route to the 10.1.1.0/24 subnet.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Hi Bobo, sorry for delay.

    We already have static route for server lan (and server IP). I had deactivated DHCP Relay because for Internal LAN it works. So, i've configured DHCP Relay and it is working now and the vpn client gets correct IP from scope A. 

    I'm going further tryng to create a subinferface instead of hw interface to not waste it. Thank you for your help.

Reply
  • 0 in reply to BAlfson

    Hi Bobo, sorry for delay.

    We already have static route for server lan (and server IP). I had deactivated DHCP Relay because for Internal LAN it works. So, i've configured DHCP Relay and it is working now and the vpn client gets correct IP from scope A. 

    I'm going further tryng to create a subinferface instead of hw interface to not waste it. Thank you for your help.

Children
No Data
Unfiltered HTML