obvious question, but is DHCP passed in the service policy? ie :
ip access-list extended al-dhcp remark Permit DHCP Clients to be allocated an address by the router permit udp any any eq bootpc permit udp any any eq bootps class-map type inspect match-all cm-dhcp match access-group name al-dhcp policy-map type inspect pm-dhcp class type inspect cm-dhcp pass zone-pair security zp-untrusted-self source zo-untrusted destination self service-policy type inspect pm-dhcp you may need to reverse the acl so that it allows DHCP both ways, as this is to allow the router to serve DHCP. ie permit udp any eq bootpc any Cheers, Andrew Jones -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of Scott Voll Sent: Wednesday, 14 September 2011 12:11 AM To: Hughes, Scott GRE-MG Cc: [email protected] Subject: Re: [c-nsp] ZBFW and DHCP I have Zones for both inside self and outside self Scott On Mon, Sep 12, 2011 at 1:38 PM, Hughes, Scott GRE-MG <[email protected]>wrote: > Did you setup any zone-pairs involving the 'self' zone? If you don't use > self zones, no additional configuration should be necessary for DHCP > packets. > > > > On Sep 12, 2011, at 9:43 AM, "Scott Voll" <[email protected]> wrote: > > > So I'm setting up a GRE IPSEC tunnel as my backup link with a 2821. I > have > > also setup ZBFW on the outside interface. So far so good. > > > > BUT now the outside interface will not get a DHCP address from the ISP. > How > > do I allow the Router to get a DHCP address? Did I miss something on the > > ZBFW config? Or can this not be done? > > > > TIA > > > > Scott > > _______________________________________________ > > cisco-nsp mailing list [email protected] > > https://puck.nether.net/mailman/listinfo/cisco-nsp > > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > > NOTICE TO RECIPIENT: The information contained in this message from > Great River Energy and any attachments are confidential and intended > only for the named recipient(s). If you have received this message in > error, you are prohibited from copying, distributing or using the > information. Please contact the sender immediately by return email and > delete the original message. > > > > > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
