Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm trying to configure our network to separate it through DMZ. Basically allowing full access from each network to the servers but blocking access from these networks communicating with each other’s.

The way I have it setup:

Servers - 192.168.10.x/24 Data - 192.168.30.x/24 Dev - 192.168.40.x/24

So data is blocked between Dev/Data but full access is given to servers. The DHCP is where i'm having the issue. I would like the server’s network to be able to assign data/dev their IP addresses.

Can you think of any way this is possible? I can enable DHCP on the asa5505 but its messy and not as easy to see who's using what. we are about to change everything to mac authentication on all wireless devices so using the asa5505 as the DHCP server will not work long term.

Any help would be greatly appreciated!

Thanks for your time.

share|improve this question

1 Answer 1

It is possible, yes.

You basically want to set up an IP helper relay to forward DHCP packets to another subnet, even if they're broadcast packets.

Support multiple subnets with one DHCP server by configuring DHCP relay agents: http://technet.microsoft.com/en-us/library/cc771390.aspx

share|improve this answer
1  
    
Thanks for the suggestions! I have enabled DHCP relay for the server Network and pointed it to the DHCP server. I have also added each address scheme in. 192.168.50.50-192.168.50.200 192.168.30.50-192.168.30.200 The issue i'm having now is that the DHCP server (server 2008R2) is not populating the list of leased addresses and its populating on the ASA. to setup DHCP server relay it requires you disable DHCP on all interfaces. Do you guys know if theres a fix for that? –  LbakerIT Mar 17 '12 at 19:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.