DHCP Server Configuration

In many small offices and home offices (SOHO) installations, no server exists to provide DHCP services, and, yet, the feature could make adding new users and machines to the LAN much easier. Think about the user who uses their laptop at work in a DHCP environment, and then wants to take the laptop home. Continually configuring and un-configuring static IP addresses would be a pain.

Connecting to a PIX Firewall supporting DHCP server features are PC clients and other network devices configured as DHCP clients. These connections can be nonsecure, not encrypted, for accessing the Internet or corporate resources. A growing market is creating secure, encrypted connections, using IPSec technology, to access corporate resources.

The following table lists the number of concurrent DHCP client connections supported by the PIX Firewall models by versions of the PIX Firewall OS. As with all product details, be sure to check the latest online documentation for maximum clients and the impact on memory requirements.

To be considered an active connection for the purpose of comparing to the maximum DHCP clients, a host must have done any one of the following:

• Passed traffic through the PIX device in the last 30 seconds

• Established NAT/PAT through the PIX device

• Established a TCP connection or a UDP session through the PIX device

• Established user authentication through the PIX device

While new versions of the PIX OS might change this, two features aren’t supported by the current PIX Firewall DHCP server feature:

• The PIX Firewall DHCP server doesn’t support BOOTP requests.

• The PIX Firewall DHCP server doesn’t support failover configurations.

  Note

  It isn’t possible to get 256 clients from a class C network or from a class A or B network subnetted with a 24-bit mask. While the 24-bit mask creates 256 addresses, the first is the network, the last is the broadcast, and one must be configured on the PIX Firewall interface. This leaves 253 DHCP clients.