- Products
- Network Security
Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
Security ServicesComprehensive security for your network security solution
Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
Capture ATPMulti-engine advanced threat detection
Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
Secure Mobile AccessRemote, best-in-class, secure access
Wireless Access PointsEasy to manage, fast and secure Wi-FI
SwitchesHigh-speed network switching for business connectivity
- Email Security
Email SecurityProtect against today’s advanced email threats
- Cloud Security
Cloud App SecurityVisibility and security for Cloud Apps
Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
Capture ClientStop advanced threats and rollback the damage caused by malware
Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
- Products
- Network Security
- Next Generation FirewallNext-generation firewall for SMB, Enterprise, and Government
- Security ServicesComprehensive security for your network security solution
- Network Security ManagerModern Security Management for today’s security landscape
- Advanced Threat Protection
- Capture ATPMulti-engine advanced threat detection
- Capture Security applianceAdvanced Threat Protection for modern threat landscape
- Access Security
- Cloud Edge Secure AccessDeploy Zero-Trust Security in minutes
- Secure Mobile AccessRemote, best-in-class, secure access
- Wireless Access PointsEasy to manage, fast and secure Wi-FI
- SwitchesHigh-speed network switching for business connectivity
- Email Security
- Email SecurityProtect against today’s advanced email threats
- Cloud Security
- Cloud App SecurityVisibility and security for Cloud Apps
- Cloud Firewall (NSv)Next-generation firewall capabilities in the cloud
- Endpoint Security
- Capture ClientStop advanced threats and rollback the damage caused by malware
- Content Filtering ClientControl access to unwanted and unsecure web content
- Product Widgets
- Product Menu Right Image
- Network Security
- Solutions
- Solutions Widgets
- Solutions Image Widgets
- Solutions Widgets
- Partners
- Partner Widgets
- Partners Image Widgets
- Partner Widgets
- Support
- Support Widget
- Support Image Widgets
- Support Widget
VPN: Using IP Helper to obtain DHCP over a Policy-based Site to Site VPN Tunnel
05/27/2021 
851 People found this article helpful
51,789 Views
Description
This article describes how to use the IP Helper feature to obtain dynamic IP addresses over a site to site VPN tunnel.
Site A SonicWall: X1 Interface: 192.168.170.51 X0 Subnet: 10.10.10.0/24 X0 Interface IP: 10.10.10.1 DHCP Server: 10.10.10.254 | Site B SonicWall: X1 Interface: 172.27.16.115 X0 Subnet: 192.168.100.0/24 X0 Interface IP: 192.168.100.1 |
In this scenario, the hosts behind Site B are set to obtain IP addresses dynamically. The goal is to forward the DHCP requests from hosts behind Site B through the tunnel to the DHCP server behind Site A SonicWall. This configuration is different from the DHCP over VPN configuration in that Site A and Site B are to be on different subnets.
Note: The IP addresses used in this article are examples. Change it to the IP addresses used in your network.
Procedure:
To configure a site to site VPN tunnel, follow this KB article: UTM - VPN: Configuring a Site to Site VPN Policy using Main Mode (Static IP address on both sites) in SonicOS Enhanced
Create an IP Helper DHCP policy in Site B SonicWall to forward DHCP requests to the server behind Site A SonicWall:
- Login to the Site B SonicWall management GUI
- Navigate to the Network > Address Objects page.
- Create the following address object for the DHCP Server
- Name: DHCP Server
- Zone Assignment: VPN
- Type: Host
- IP Address: 10.10.10.254
- Navigate to the Network > IP Helper page.
- Enable check box IP Helper and click on Accept to save the changes.
- Enable check box DHCP under Protocols.
- Click on Add under Policies to create the following policy.
- Protocol : DHCP
- From ZONE: LAN
- To: Select the address object of the DHCP server.
- Click on OK to save.
From a host behind the Site B SonicWall do ipconfig/release and ipconfig/renew. Assuming the VPN tunnel is up, the host will be leased an IP address by the remote DHCP server. The IP Helper page will display the information under DHCP Relay Leases:
Related Articles
- How to force an update of the Security Services Signatures from the Firewall GUI
- How to upload security services signatures manually on Closed Environments?
- How to Create Gen 7 Settings File by Using the Online Migration Tool
Categories
- Firewalls > TZ Series
- Firewalls > SonicWall SuperMassive 9000 Series
- Firewalls > SonicWall NSA Series
- Firewalls > NSa Series
- Firewalls > NSv Series
YES
NO