Contents

Related Topics

Configure DHCP in Drop-In Mode

When you use drop-in mode for network configuration, you can optionally configure the Firebox as a DHCP server for the networks it protects, or make the device act as a DHCP relay agent. If you already have a DHCP server, we recommend that you continue to use that server for DHCP.

The features available in WatchGuard System Manager (WSM) can be different for different versions of Fireware. If your Firebox does not run Fireware OS v11.10.x or higher, the content in this Help topic might not apply to your Firebox.

For instructions to complete the procedures in this topic for a Firebox that runs an older version of Fireware, see:

Configure IPv4 DHCP in Drop-In Mode in WatchGuard System Manager v11.9.4 Help

Use DHCP

By default, your Firebox device gives out the configured DNS/WINS server information when it is configured as a DHCP server. You can configure DNS/WINS information on this page to override the global configuration. For more information, see the instructions in Add WINS and DNS Server Addresses.

To configure DHCP server settings, from Fireware Web UI:Closed
  1. Select Network > Interfaces.
    The Network Interfaces page appears.
  2. If your device is not already configured in drop-in mode, from the Configure Interfaces in drop-down list select Drop-In Mode.
  3. Click Properties.
  4. Select the DHCP Settings tab.
  5. From the drop-down list, select DHCP Server.
    The DHCP configuration settings appear.

Screen shot of DHCP Settings in Drop-in Mode Properties

  1. To change the DHCP lease time, select a different option in the Lease Time drop-down list.
  2. To add an address pool from which your device can give out IP addresses, in the Address Pool section:
    • Click Add.
    • In the Starting IP and Ending IP text boxes, type a range of IP addresses that are on the same subnet as the drop-in IP address.
      You can configure a maximum of six address pools.
    • Click OK.
      Repeat this step to add more DHCP reservations.
  3. To reserve a specific IP address from an address pool for a device or client, in the Reserved Addresses section:
    • Click Add.
    • Type a Reservation Name to identify the reservation.
    • Type the Reserved IP address you want to reserve.
    • Type the MAC address for the device.
    • Click OK.
      Repeat this step to add more DHCP reservations.
  4. If necessary, Add WINS and DNS Server Addresses.
  5. At the top of the page, click Back.
  6. Click Save.
To configure DHCP server settings, from Policy Manager:Closed
  1. Select Network > Configuration.
    The Network Configuration dialog box appears.
  2. If your Firebox is not already configured in drop-in mode, from the Configure Interfaces in drop-down list select Drop-In Mode.

Network Configuration dialog box, showing drop-in mode with DHCP

  1. Select Use DHCP Server.
  2. To add an address pool from which your Firebox can give out IP addresses, click Add next to the Address Pool box and specify starting and ending IP addresses that are on the same subnet as the drop-in IP address.
    Do not include the drop-in IP address in the address pool. Click OK.
    You can configure a maximum of six address ranges.
  3. To reserve a specific IP address from an address pool for a device or client, adjacent to the Reserved Addresses field, click Add. Type a name to identify the reservation, the IP address you want to reserve, and the MAC address for the device. Click OK.
  4. In the Leasing Time drop-down list, select the maximum amount of time that a DHCP client can use an IP address.
  5. By default, your Firebox gives out the DNS/WINS server information configured on the Network Configuration > WINS/DNS tab when it is configured as a DHCP server. To send different DNS/WINS server information to DHCP clients, click the Configure DNS/WINS servers button.
  6. Click OK.
  7. Save the Configuration File.

Configure DHCP Options

DHCP options, also known as vendor extensions, enable you to specify DHCP configuration parameters and other control information, as described in RFC 2132. You can add predefined or custom DHCP options. Custom options are supported in Fireware v11.9.3 and higher.

The predefined DHCP options are:

DHCP Option Code Name Type Description
150 TFTP Server IP IP address(es)

The IP address of the TFTP server where the DHCP client can download the boot configuration.
66 TFTP Server Name Text The name of the TFTP server where the DHCP client can download the boot configuration.
67 TFTP Boot Filename Text The name of the boot file.
2 Time Offset 4 byte integer

Time offset in seconds from Coordinated Universal Time (UTC).
43 Vendor specific information Text This option is used by clients and servers to exchange vendor- specific information.
120 SIP Servers IP address(es)

IPv4 addresses of one or more Session Initiation Protocol (SIP) outbound proxy servers. This option is described in RFC 3361.
138 CAPWAP Access Controller IP address(es)

IPv4 addresses of one or more CAPWAP Access controllers. This option is described in RFC 5417.
156 DHCP State 1 byte integer (Unsigned) State of the IP address. This option is used by ShoreTel phones for an FTP boot option.

Some versions of Fireware OS do not support all the predefined options. If the option code you select requires a specific minimum version of Fireware, a notation appears to the right of the selected code in Policy Manager.

Add DHCP Options

In Fireware XTM v11.9.3 and higher, you can add predefined or custom DHCP options.

To add a predefined DHCP option, from Fireware Web UI:Closed
  1. In the DHCP Options list, click Add.
    The Add DHCP Option dialog box appears. Predefined Option is selected by default

Screen shot of the Add DHCP Option dialog box for a Predefined Option

  1. From the Code drop-down list, select the DHCP option code.
    The Name and Value associated with the code are selected automatically and you cannot edit these.
  2. In the Value text box, type the value to assign to this option. It must match the Type for this option.
  3. Click OK.
To add a predefined DHCP option, from Policy Manager:Closed
  1. Click DHCP Options.
  2. Click Add.
    The Add DHCP Option dialog box appears. Predefined Option is selected by default

Screen shot of the Add DHCP Option dialog box for a Predefined Option

  1. From the Code drop-down list, select the DHCP option code.
    The Name and Value associated with the code are selected automatically and you cannot edit these.
  2. In the Value text box, type the value to assign to this option. It must match the Type for this option.
  3. Click OK.

If the option required by your vendor is not in the list of predefined options, you can add it as a custom option.

To add a custom DHCP option, from Fireware Web UI:Closed
  1. In the DHCP Options list, click Add.
    The Add DHCP Option dialog box appears.

Screen shot of the Add DHCP Option dialog box for a Custom Option

  1. Select Custom Option.
  2. In the Code text box, type the DHCP option code.
  3. In the Name text box, type a name to describe this DHCP option.
  4. From the Type drop-down list, select the type of value required by this option.
  5. In the Value text box, type or select the value to assign to this option. It must match the Type you selected.
  6. Click OK.
To add a custom DHCP option, from Policy Manager:Closed
  1. Click Add.
    The Add DHCP Option dialog box appears.
  2. Select Custom Option.

Screen shot of the Add DHCP Option dialog box for a Custom Option

  1. In the Code text box, type the DHCP option code.
  2. In the Name text box, type a name to describe this DHCP option.
  3. From the Type drop-down list, select the type of value required by this option.
  4. In the Value text box, type or select the value to assign to this option. It must match the Type you selected.
  5. Click OK.

If you use the same DHCP option code for more than one interface, the Type must be the same on each interface.

Use DHCP Relay

One way to assign IP addresses to computers on the trusted or optional networks is to use a DHCP server on a separate network. With this feature, the Firebox sends DHCP requests to the IP address of up to three DHCP servers you specify.

Make sure to Add a Static Route to each DHCP server, if necessary.

To configure DHCP Relay, from Fireware Web UI:Closed
  1. Select Network > Interfaces.
    The Network Interfaces page appears.
  2. Click Properties.
  3. Select the DHCP Settings tab.
  4. From the drop-down list, select DHCP Relay.

Use DHCP Relay drop-down list

  1. In the DHCP Server text box, type the IP address of a DHCP server and click Add.
  2. Repeat the previous step to add the IP addresses of up to three DHCP servers.
  3. At the top of the page, click Back.
  4. Click Save.
To configure DHCP Relay, from Policy Manager:Closed
  1. Select Network > Configuration.
    The Network Configuration dialog box appears.
  2. If your device is not already configured in drop-in mode, from the Configure Interfaces in drop-down list select Drop-In Mode.
  3. Select Use DHCP Relay.

Network Configuration dialog box, showing drop-in mode with DHCP relay

  1. Type the IP address of a DHCP server in the related field and click Add.
  2. Repeat this step to add the IP addresses of up to three DHCP servers.
  3. Click OK.
  4. Save the Configuration File.

Specify DHCP Settings for a Single Interface 

You can specify different DHCP settings for each trusted or optional interface in your configuration.

To configure DHCP settings for an interface, from Fireware Web UI:Closed
  1. On the Network > Interfaces page, select an interface.
  2. Click Edit.
  3. To use the same DHCP settings that you configured for drop-in mode, select Use System DHCP Settings.

To disable DHCP for clients on that network interface, select Disable DHCP.

To enable a different DHCP server for clients on a secondary network, select Use DHCP Server for Secondary Network. Configure the DHCP server settings and options as described in the Use DHCP and Configure DHCP Options sections above.

To configure DHCP relay for clients on a secondary network, select Use DHCP Relay for Secondary Network. Specify up to three IP addresses of DHCP servers to use for the secondary network.

  1. Click OK.
To configure DHCP settings for an interface, from Policy Manager:Closed
  1. Select Network > Configuration.
    The Network Configuration dialog box appears.
  2. Scroll to the bottom of the Network Configuration dialog box and select an interface.
  3. Click Configure.
  4. Update the DHCP settings:
  • To use the same DHCP settings that you configured for drop-in mode, select Use System DHCP Setting.
  • To disable DHCP for clients on that network interface, select Disable DHCP.
  • To configure DHCP relay for clients on a secondary network, select Use DHCP Relay for Secondary Network. Specify the IP address of the DHCP server to use for the secondary network.
  • To configure different DHCP options for clients on a secondary network, select Use DHCP Server for Secondary Network. Complete Steps 3–6 of the Use DHCP procedure to add IP address pools, set the default lease time, and manage DNS/WINS servers.
  • To configure DHCP options for the secondary network, click DHCP Options.
  1. Click OK.

See Also

Drop-In Mode

Give Us Feedback  •   Get Support  •   All Product Documentation  •   Technical Search

© 2018 WatchGuard Technologies, Inc. All rights reserved. WatchGuard, the WatchGuard logo, WatchGuard Dimension, Firebox, Core, Fireware, and LiveSecurity are registered trademarks or trademarks of WatchGuard Technologies in the United States and/or other countries.