DHCP through point to point

[jeffmoss26]

Ok guys-question time
We have a a point to point connecting our office to a branch office, which has its own DC and DHCP server.
Both locations are on the same subnet. Is there a way to make DHCP not go through the point to point? They are receiving addresses from our DHCP server.

Thanks,
Jeff

 

[Brak710]

If you have a firewall doing the point-to-point, you can block DHCP traffic pretty easily.

Usually though, DHCP leaking over a tunnel isn't an issue when done properly... The remote side is a different subnet and the tunnel is just seen as the route to get there. Is there any reason why they need to be the same subnet, but different DHCP?

 

[jeffmoss26]

The point to point is not going through our firewall. They are on the same subnet because they need to be able to access our ERP system over at the main building, and occasional access to the file server.

 

[schnell]

Personally I keep all remote sites on different subnets so I can easily keep track of server IP addresses and the like.

Example:
DHCP site A x.x.20.4
DHCP site B x.x.21.4
DHCP site C x.x.22.4
etc

You should be able to easily block DHCP traffic on your firewall however, DHCP uses UDP ports 67 and 68.

http://technet.microsoft.com/en-us/library/ee941126(v=ws.10).aspx

 

[schnell]

The point to point is not going through our firewall. They are on the same subnet because they need to be able to access our ERP system over at the main building, and occasional access to the file server.

I must have posted the above right as you posted this. With proper VLAN routing they should have no problem talking to the ERP server. I would put each office on its own VLAN, then set up a simple rule in the core switch and everything should be fine. I have about 50 VLAN's in my infrastructure and there are plenty of VLAN's that talk to each other just fine. I guess it just depends on how complicated your network is.

 

[TObject]

The point to point is not going through our firewall. They are on the same subnet because they need to be able to access our ERP system over at the main building, and occasional access to the file server.

Does your ERP server have Kaspersky or some other internet security software running? Those are usually configured to drop packets from other subnets. You can change these settings and you should be able to access your ERP from a different subnet with no issues.