?
Solved

Cisco VPN 3000 Concentrator & Windows DHCP Server

Posted on 2004-08-14
2
Medium Priority
?
711 Views
Last Modified: 2012-08-14
My company has two full class C IP address blocks.  The first is reserved exclusively for our primary corporate office.  The second block is split up amongst our several satellite offices.  There are several subnets unused in this second block.

We have a Cisco VPN 3000 Concentrator for providing remote access.  At the moment, the concentrator just relays DHCP requests to our DHCP server in our primary office and they get addresses that are in that first class C block for our primary office.  This is not desirable; I would much rather have the remote access clients get IP addresses from a leftover subnet within that second block of addresses.

I've tried doing this by just using the internally configurable IP Pool functionality in the Concentrator, but the problem with this is that I can't figure out how to give the clients an appropriate subnet mask for that little subnet that I'd use for only VPN clients.  They get the standard classful mask, which means that they won't be able to reach other clients within that second class C block of addresses.  --- If someone can tell me how to specify an appropriate subnet mask, that would work.

Otherwise, I'd like to just have the same setup with the Concentrator relaying DHCP requests to our DHCP server, but I'd like the DHCP server to give out addresses from a different scope as the "primary office" range of addresses.  Is it somehow possible to configure a Windows 2000 Server DHCP server to give out these subnet addresses only to requests originating at the VPN concentrator?

Thanks!
0
Comment
Question by:titan6400
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
2 Comments
 
LVL 79

Accepted Solution

by:
lrmoore earned 1600 total points
ID: 11802867
What version OS are you running on the VPN3000? The latest version 4.1.5 has an option to set a subnet mask on the IP address pool.
0
 

Expert Comment

by:troubleu2
ID: 11812915
Are you asking to have the 3005 provide DHCP to then entire office here: "won't be able to reach other clients within that second class C block of addresses?"
If not, why do remote clients require access to other remote clients?

For remote access, each group of users can receive different DHCP scopes. Under Group settings -> General -> The DHCP Network Scope.
Configuration | System | Servers | DHCP screen...Enter the IP sub-network
Enter 0.0.0.0 for the default; by default, the DHCP server assigns addresses to the IP sub-network of the VPN Concentrator's private interface.


If the Windows DHCP server is relaying IP's to these scopes, you filter for group (location).
IAS could also be used to provide DHCP groups - likely with greater ease then the 3005.

HTHs

0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this tutorial I will show you with short command examples how to obtain a packet footprint of all traffic flowing thru your Juniper device running ScreenOS. I do not know the exact firmware requirement, but I think the fprofile command is availab…
Hello , This is a short article on how would you go about enabling traceoptions on a Juniper router . Traceoptions are similar to Cisco debug commands but these traceoptions are implemented in Juniper networks router . The following demonstr…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question