In a new setup we have a site where

PC-->ACCSW-->FW-->VPNRT-->ISP........Other site DHCP server(

  1. We are able to ping DHCP server from ACCSW to DHCP server.
  2. PC is not getting IP from DHCP server, but by assigning stactic IP we are able to ping DHCP and remote site from PC. 3.ACCSW has VLAN 10.66.X.X/28
  3. DHCP has scope 10.66.X.21-40
  4. Do we need to open any specific port in ourl local FW in order to allow DHCP communication?
  5. What all things we need to check in order to get IP from DHCP server
  • 1
    It could be many things, but without more information, we're just guessing. Please include the type of firewall, VPN devices and their configurations. Did you try looking at the firewall log to see if it is blocking traffic? How does the PC set up the VPN without an IP address?
    – Ron Trunk
    Jun 7, 2016 at 11:21

3 Answers 3


You would need to enable DHCP forwarding/relay on the border devices and open the ports on the firewall. DHCP broadcast doesn't get past routers unless forwarding/relay is enabled and configured.

  • Thanks you are absolutely correct, Access switch is L3 device I guess this was blocking DHCP broadcast request. Now I have configured DHCP helper/relay on it now PC is getting IP address Jun 8, 2016 at 3:49

DHCP runs over UDP ports 67 & 68, so you will need to open those for this to work. Depending on your setup you might also be missing a DHCP relay configuration on your FW to forward DHCP requests to your server.


The DHCP protocol is being used by the PC to get an address. So, when it sends out the request it uses a dummy filler for it's own address, but the Mac Address (I.e. the hardware Ethernet address on Ethernet) is sent in the packet. The packet is also sent to a general (broadcast or multicast) address. Since broad/multi-cast packets are not forwarded, it won't make it (directly) to a server on another segment. And since there's no IP address (yet) for the original host, without help, a reply cannot be routed to the original querent.

To address this the DHCP protocol has the concept of a DHCP relay (sometimes called a DHCP helper). If there is a DHCP relay on the same Ethernet segment, it receives the original DHCP request and then updates it to have the unicast IP address for the server and it's own IP address for the reply. Then when the reply is received, it matches it to the original request and has a Mac address to send the reply to.

So what you need to do is configure either the access switch or firewall to act as a DHCP relay. Depending on the specific models either or both might be able to do this. Note that you also need to be sure the firewall allows the traffic, and remember that in DHCP you have relayed packets with modified addresses that may affect how you filter.

  • Good explanation MAP! Jun 8, 2016 at 0:28
  • Thank you very much, Access switch is L3 device I guess this was blocking DHCP broadcast request. Now I have configured DHCP helper/relay on it now PC is getting IP address. Jun 8, 2016 at 3:46
  • @shailendraharinkhede: You should click the little gray check mark that appears on the answer to let the system know...the computer doesn't realize that you said that in a comment...
    – MAP
    Jun 13, 2016 at 6:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.