This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

DHCP requests not routing over IPSEC

I have a DHCP server running at head office on 192.168.100.21 which is a Windows Server that has a Sophos as it's gateway

The branch office has a Sophos

There is an IPSEC tunnel between the two Sophos units

The branch office has a DHCP relay pointing to the head office server 192.168.100.21

I've setup SNAT and IPSEC routes

The DHCP server isn't responding to the requests across the IPSEC

What am I missing?

This thread was automatically locked due to age.

Top Replies

Stuart James 9 months ago in reply to sanket.shah +6 suggested

The Sophos is not the DHCP server, therefore the system dhcp lease-over-IPSEC command is irrelevant I've got the traffic flowing to the server now - I stupidly had made an error in the tunnelname in…

Parents

0 Hardik_R 9 months ago

Hello Stuart James

The configuration looks alright and as per the DHCP server behind HO firewall and BO firewall as relay agent

If DHCP server is not responding then you may check with server and validate whether DHCP requests are hitting on server or not. also verify if there is windows firewall dropping those request.

Hardik R
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up +2 Vote Down

Cancel
0 Stuart James 9 months ago in reply to Hardik_R

DHCP requests are not reaching the server that I can see. Windows firewall is definitely off.
Cancel
Vote Up 0 Vote Down

Cancel
0 Bharat J 9 months ago in reply to Stuart James

Hi Stuart James

Please check traffic flow might help to fix the issue

Do packet capture, tcpdump and drop packet capture from both the firewall GUI and CLI is request coming in and out ?

Did you check with route base VPN tunnel instead of site-to-site?

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Reply

0 Bharat J 9 months ago in reply to Stuart James

Hi Stuart James

Please check traffic flow might help to fix the issue

Do packet capture, tcpdump and drop packet capture from both the firewall GUI and CLI is request coming in and out ?

Did you check with route base VPN tunnel instead of site-to-site?

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel

Children

0 Sreenivasulu Naidu 9 months ago in reply to Bharat J

DHCP relay over RBVPN (xfrm) is not supported yet on SFOS - NC-54946; only Policy based IPec supports DHCP relay over tunnel.
Cancel
Vote Up 0 Vote Down

Cancel
0 Stuart James 9 months ago in reply to Bharat J

Route based tunnels don't support DHCP relay?
Cancel
Vote Up 0 Vote Down

Cancel
0 Bharat J 9 months ago in reply to Stuart James

my apologies as confirm by Sreenivasulu Naidu ,DHCP relay over RBVPN (xfrm) is not supported yet on SFOS - NC-54946

Please do packet capture, tcpdump and drop packet capture to check now traffic. Post the output here and firmware version you are working on.

Regards

"Sophos Partner: Networkkings Pvt Ltd".

If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Stuart James 9 months ago in reply to Bharat J

Latest firmware. Getting Local_ACL on the branch firewall. Packet capture on the head office firewall shows no activity on ports 67/68
Cancel
Vote Up 0 Vote Down

Cancel
0 sanket.shah 9 months ago in reply to Stuart James

Hello Stuart James ,

Could you please confirm this CLI is enabled on SFOS where DHCP server is running?

console> system dhcp lease-over-IPSec
enable Enable IP Lease over IPSec for all DHCP servers
disable Disable IP Lease over IPSec for all DHCP servers (Default Value)
show Show IP Lease over IPSec configuration

Also, please share DHCP server configuration created for branch network (if above CLI doesn't work).

Regards,

Sanket Shah

Director, Software Development, Sophos Firewall
Cancel
Vote Up 0 Vote Down

Cancel
+1 Stuart James 9 months ago in reply to sanket.shah

The Sophos is not the DHCP server, therefore the system dhcp lease-over-IPSEC command is irrelevant

I've got the traffic flowing to the server now - I stupidly had made an error in the tunnelname in the CLI for the ipsec_route

However DHCP still not working - but that's a Windows issue now.
Cancel
Vote Up +6 Vote Down

Cancel