D-Link Forums
D-Link VPN Router => DSR-250N => Topic started by: AD227529 on October 16, 2018, 05:32:51 PM
-
I'm hoping someone can help me solve a problem I'm having with a DSR-250N router. I'm a network tech working for a local city government. We have a headquarters at city hall, with several branch offices throughout the city. Our DHCP and DNS server is all on one server back at city hall, and connected to a layer 3 Cisco switch at city hall. The IP address of the DHCP server is 10.1.2.2, and our layer 3 switch can route between subnets at city hall and our remote offices. Our Internet connection is also through this layer 3 switch at city hall. Our remote offices all connect back to this layer 3 switch, so they get both their DHCP scopes and Internet through the layer 3 switch at city hall. Here is my problem. I am trying to set up this DSR-250N router at a remote office. I set the WAN address to 192.168.11.17 with a /24 subnet and default gateway address of 192.168.11.1 (which is the IP address of the VLAN on the layer 3 switch back at city hall that our remote offices all connect back to, and where the DHCP server is located, on a different VLAN). The inside or LAN of this remote office has a subnet of 10.1.17.0 with a /24 subnet and the default gateway of the LAN is 10.1.17.1 I set the routing mode to Classic Routing on the DSR-250N and set the DHCP Mode to DHCP relay, with the gateway address of 10.1.2.2, which is the IP address of the DHCP server back at city hall. When I plug in a PC to the switchports of the router and set the NIC to DHCP, nothing happens. It does not get an IP address in the 10.1.17.X subnet, which indicates to me that DHCP Relay on the DSR-250N isn't working. Here's the frustrating part. If I set the NIC to a static IP address in the 10.1.7.X subnet, such as 10.1.17.2, then everything is fine! I can ping the LAN side of the DSR-250N, the WAN side, can ping IP addresses back at city hall, can ping all the subnets of our other offices, and can get to the Internet just fine. When I switch the NIC back to DHCP, I get no IP address at all. From the DSR-250N, I can get to everything as well (I can PING the Internet, city hall, remote offices, DHCP server address). Not sure what I'm doing wrong. All the switchports on the DSR-250N are in the same VLAN (the default VLAN 1). The WAN configuration is correct. Everything works great, until I set the DSR-250N to DHCP Relay mode, then I get nothing. What am I doing wrong? What do I need to change or configure on the DSR-250N to get the DHCP Relay to work correctly? Does the DHCP server HAVE to be in the same subnet as the LAN on the DSR-250N? Our Cisco routers all work fine with DHCP Relay, but I can't get this D-Link router's DHCP Relay to work. Please Help!
-
Link>Welcome! (http://forums.dlink.com/index.php?topic=49573.0)
- What Hardware version is your router? Look at sticker under the router case.
- Link>What Firmware (http://forums.dlink.com/index.php?topic=47512.0) version is currently loaded? Found on the routers web page under status.
- What region are you located?
What happens if you don't use DHCP Relay or any relay on the DSR?
Try turning OFF DHCP server on the DSR?
What does the User manual say about setting the DSR up with L3 and other DHCP servers?
-
The hardware version is B1
The firmware version is the latest version, version 3.12_WW
I am located in the United States.
Can't figure this out. Static IP addresses of PCs attached to this router work fine, but those set to DHCP do not get an address. I can ping the IP address of the
DHCP server from the router itself, and from PCs that have a static IP address. For some reason, the DHCP relay on this router is not working.
-
Let me see if we can get some help on this. I'm not familiar with DSR models as they are business class routers. I handle the home class stuff. ::)
-
Hi,
at a first glance I can't see anything that might be obviously wrong, except the term "Gateway" in DHCP Relay mode is quite confusing (shouldn't it be called DHCP Server instead?) ...
Did you configure an additional Scope für 10.1.17.0/24 within your DHCP-Server (but as a network tech of course you did ...)?
Since Routing seems okay, maybe there are any firewall filtering rules (or Cisco ACLs at the L3 switch) active that cause dropping of 67/udp and/or 68/udp?
Any chance to do some packet sniffing at the uplink interface 192.168.11.1 in order to see if dhcp traffic arrives from branch router DSR-250N?
Any log informatiion available from within the DHCP server why a possibly arrived request for a DHCP lease was eventually refused?
PT
<EDIT>
From this (http://www.dlink.cc/d-link-router/d-link-dsr-series-router-default-ip-addressusernamepassword-and-network-settings.html) link you can find the following statment:
DHCP Relay: With this option enabled, DHCP clients on the LAN can receive IP address leases and corresponding information from a DHCP server on a different subnet. Specify the Relay Gateway, and when LAN clients make a DHCP request it will be passed along to the server accessible via the Relay Gateway IP address.
This sounds like you cannot configure a DHCP server directly but have to relay to an uplink DHCP relay (Relay Gateway) which in turn relays to the DHCP server. Hence if nothing other helps: Configure a Cisco bootp helper (this is the Cisco term for DHCP relay) that listens on interface 192.168.11.1 and specify 192.168.11.1 in the Gateway field for DSR's DHCP Relay mode.
</EDIT>
-
I got it to work at another of our remote locations. DHCP Relay works fine at another location, just not at the location where I was doing the initial testing of the router. I think it might be an issue with the AT&T router at the site where I was testing. Works fine now, but I still have a small issue. I cannot ping any computers on the LAN side of the router. I can ping the outside IP address (which is 192.168.11.16) but I cannot ping the inside IP address (10.1.16.1) or any computers that are on the LAN side of the router. What would be causing this? Anything I need to check on the router's configuration settings? Remote management is turned on on the router, and I can ping the WAN side from remote locations just fine, just not the LAN addresses (the 10.1.16.X subnet on the LAN doesn't respond to pings, and I cannot RDP to any of the computers on the LAN side of the router.
-
So what resolved this? You didn't mention how you got it working...
Not sure about pinging across two different sub nets...
-
Not sure what got the DHCP Relay to work, other than taking it to another one of our remote offices and testing it there. Didn't work at one location, but worked fine at another. The only thing I can figure is it was something to do with a setting in the AT&T router at the location. It is working fine at the current location, and DHCP Relay is allowing PCs on the LAN to get addresses from the DHCP server at our main office. Only problem now is that I can't ping the LAN side of the router, or Remote Desktop to any of the PCs on the LAN side. I can ping the WAN side of the router just fine, and can even remotely access the GUI of the router if I use the WAN address (192.168.11.16), but if I ping or remote to the LAN address of the router (10.1.16.1) I get nothing. Can't understand it. Routing mode is set to Classical Routing, and there are not firewall rules on the router. What would be blocking this?
-
Hi again,
here are the facts (partially copied from your statements), I've understood so far:
- We have a headquarters at city hall, with several branch offices throughout the city.
- Our layer 3 switch can route between subnets at city hall and our remote offices.
- Our Internet connection is also through this layer 3 switch at city hall.
- Our remote offices all connect back to this layer 3 switch.
- I think it might be an issue with the AT&T router at the site where I was testing.
- There is some backbone network 192.168.11.0/24 that connects all WAN interfaces of the DSRs (using 192.168.11.X where X is a branch office counter) with the SVI (having addess 192.168.11.1) at the central VRF within the central L3 switch.
- Any branch office X consists of a single LAN (using network 10.1.X.0/24) directly attached to the branch's DSR.
- The headquarter's LAN 10.1.2.0/24 is directly connected to the central VRF. It comtains the combined DHCP/DNS server (10.1.2.2).
Questions:
- How are branch offices and headquarter connected to each other? Do you have some MAN availabe (fiber across the town)? Or do you use IPsec site to site VPN connections across the Internet?
- What role does the AT&T router at branch 17 play and how does it interact with that site's DSR?
- If IPsec tunnels are in use, does any site's AT&T router (given the same hardware equipement at any branch office) terminate the VPN tunnel (forming the IPsec gatway)? And is any site's DSR connected (via its WAN interface) to the LAN side of the local AT&T router?. Or does any branch's DSR behind an AT&T router form the VPN gateway? Do you use a split tunnel configuration within IPsec VPN gateways? E.g. for branch office's clients to use the site's internet connection directly that way bypassing the VPN tunnel to the headquarter?
Many facts unclear, all of them might have an impact on the problems you encounter ...
PT