VPN: Using IP Helper to obtain DHCP over a Policy-based Site to Site VPN Tunnel

05/26/2020 839 19864

DESCRIPTION:

This article describes how to use the IP Helper feature to obtain dynamic IP addresses over a site to site VPN tunnel.


 

In this scenario, the hosts behind Site B are set to obtain IP addresses dynamically. The goal is to forward the DHCP requests from hosts behind Site B through the tunnel to the DHCP server behind Site A SonicWall.  This configuration is different from the DHCP over VPN configuration in that Site A and Site B are to be on different subnets.

Note: The IP addresses used in this article are examples. Change it to the IP addresses used in your network.

Procedure:

To configure a site to site VPN tunnel, follow this KB article: UTM - VPN: Configuring a Site to Site VPN Policy using Main Mode (Static IP address on both sites) in SonicOS Enhanced
 

Create an IP Helper DHCP policy in Site B SonicWall to forward DHCP requests to the server behind Site A SonicWall:

• Login to the Site B SonicWall management GUI
• Navigate to the Network > Address Objects page.
• Create the following address object for the DHCP Server
  • Name: DHCP Server
  • Zone Assignment: VPN
  • Type: Host
  • IP Address: 10.10.10.254

• Navigate to the Network > IP Helper page.
• Enable check box IP Helper and click on Accept to save the changes.
• Enable check box DHCP under Protocols.
• Click on Add under Policies to create the following policy.
  • Protocol : DHCP
  • From ZONE: LAN
  • To: Select the address object of the DHCP server.
  • Click on OK to save.

From a host behind the Site B SonicWall do ipconfig/release and ipconfig/renew. Assuming the VPN tunnel  is up, the host will be leased an IP address by the remote DHCP server. The IP Helper page will display the information under DHCP Relay Leases: