# DHCP Server or DHCP Relay Agent Configuration

## The Security Device as a DHCP Server

DHCP consists of two components: a protocol for delivering host-specific TCP/IP configuration settings and a mechanism for allocating IP addresses. Hence, when the security device acts as a DHCP server, it provides the following TCP/IP settings to each host when that host boots up:

· Default gateway IP address of the router—if there is one—that connects a subnet to the Trust zone interface.

· The IP addresses of the following servers:

WINS servers (2):[1] A Windows® Internet Naming Service (WINS) server maps a NetBIOS name used in a Windows NT network environment to an IP address used on an IP-based network.

NetInfo Server (2): NetInfo® is an Apple® network service used for the distribution of administrative data within a LAN.

NetInfo Tag (1): The identifying tag used by the Apple NetInfo database.

DNS servers (3): A Domain Name System (DNS) server maps a uniform resource locator (URL) to an IP address.

SMTP server (1): A Simple Mail Transfer Protocol (SMTP) server delivers SMTP messages to a mail server, such as a POP3 server, which stores the incoming mail.

POP3 server (1): A Post Office Protocol version 3 (POP3) server stores incoming mail. A POP3 server must work conjointly with an SMTP server.

News server (1): A news server receives and stores postings for news groups

Dom ain Name: Enter the registered domain name of the network.

Note: If a DHCP client to which the security device is passing the above parameters has a specified IP address, that address overrides all the dynamic information received from the DHCP server.

Also, the security device allocates IP addresses and subnet masks in two modes:

· In Dynamic mode, the security device, acting as a DHCP server, assigns (or “leases”) an IP address from an address pool[2] to a host, acting as a DHCP client. The IP address is leased for a determined period of time or until the client relinquishes the address. (To define an unlimited lease period, enter 0.)

· In Reserved mode, the security device assigns a designated IP address from an address pool exclusively to a specific client every time that client goes online

Note: The security device saves every IP address assigned through DHCP in flash memory. Consequently, rebooting the security device does not affect address assignments.

### To configure the security device as a DHCP server:

1. Select the DHCP Server option

2. Click Options to open the DHCP Server Option Configuration dialog box. For information on how to configure DHCP options, see the DHCP Server Option Configuration page.

3. Click New Address to open the DHCP IP Address Configuration dialog box. For information on how to add an address or an address range, see the DHCP IP Address Configuration page.

### To modify a DHCP IP address or address group entry:

1. Click Edit in the Configure column.

The DHCP Server Configuration dialog box appears.

2. Make your modifications, and then click OK to save your changes.

### To remove a DHCP IP address or address group entry:

1. Click Remove in the Configure column.

A system message prompts you to confirm the removal.

2. Click Yes to confirm the removal, or No to cancel it.

### To view DHCP Status Reports

The DHCP IP Address Binding Status report displays the IP address, MAC address, and lease time of all clients on the DHCP server. The maximum number of entries on each page of the report is 18.

1. Click Status Report.

The DHCP Status page appears.

2. Click Return to return to the previous page.

For more information, see the online help for the DHCP IP Address Binding Status page.

## The Security Device as a DHCP Relay Agent

When acting as a DHCP relay agent, the security device forwards DHCP requests and assignments between hosts in the Trust zone and a DHCP server in the Untrust zone. In other words, the security device receives DHCP information from a DHCP server and relays that information to hosts in security zones. The DHCP messages between the security device and the DHCP server can be transmitted in the open or through a VPN tunnel.

Note: When the security device functions as a DHCP relay agent, its interfaces must be in either Route mode or Transparent mode.

Note: When a security device acts as a DHCP relay agent, no status reports are generated because the remote DHCP server controls all the IP address allocations.

To configure the security device as a DHCP Relay Agent:

1. Select the DHCP Relay Agent option.

2. Enter the IP Address(es) of the DHCP Server(s).

3. Select the Use Trust Interface as Source IP for VPN option if you want to protect the relayed requests and responses between the security device and the DHCP server by encrypting and then transmitting them through a VPN tunnel.

### To configure the security device as a DHCP server

As part of configuring the security device as a DHCP server, once you have selected DHCP Server, you need to provide the appropriate information for the DHCP Configuration options.

1. Enter information in the appropriate fields:

· Lease, Unlimited or customize: An IP address supplied by the DHCP server is leased either indefinitely or for a limited period of time. If the lease is limited, you must specify the limitation in days, hours, and minutes.

days: Number of days before the IP address expires.

hours: Number of hours before the IP address expires.

minutes: Number of minutes before the IP address expires.

· Gateway: Enter the IP address of the default gateway used by clients.

· Netmask: Enter the netmask of the default gateway of the router, if there is one, that connects the protected network to the Trusted interface.

· WINS#1: Enter the IP address of a primary Windows Internet Naming Service (WINS) server.

· WINS#2: Enter the IP address of a secondary WINS server.

· DNS #1: Enter the IP address of a primary Domain Name System (DNS) server.

· DNS #2: Enter the address of a secondary DNS server.

· DNS#3: Enter the address of a tertiary DNS server.

· SMTP: Enter the IP address of a Simple Mail Transfer Protocol (SMTP) server for delivering SMTP messages to a mail server, such as a POP3 server.

· POP3: Enter the IP address of a Post-Office-Protocol version 3 (POP3) mail server for storing incoming e-mail.

· NEWS: Enter the IP address of a news server for receiving and storing postings for news groups.

· NetInfo Server#1: Enter the IP address of a primary NetInfo server. NetInfo® is an Apple® network service used for the distribution of administrative data within a LAN.

· NetInfo Server#2: Enter the IP address of a secondary NetInfo server.

· NetInfo Tag: Enter the identifying tag used by the Apple NetInfo database.

· Domain Name: Enter the registered domain name of the network.

2. Click OK to save your settings.

[1]The number in parentheses indicates the number of servers supported.

[2]An address pool is a defined range of IP addresses within the same subnet from which the security device can draw DHCP address assignments. You can group up to 255 IP addresses in up to 64 address pools.