Help with DHCP / vLan's from AD

GrimmSh0t

Issue: Unable to get DHCP IP/Configuration from DC (DHCP)
Overarching Goal - Utilize the DC / DHCP
**NOTE: ** - PFSense is on physical hardware

What does work:

If I use the PFSense DHCP I get an IP and everything works
If I set a static IP everything works

What does not work:

Turning off PFSense DHCP and enabling DHCP Relay
(Don't get an IP from the DC/DHCP)

What is configured:

DHCP vLan IP ranges on DC (same as the PFSense's)

Hopefully someone can help!

bingo600

@grimmsh0t

Enabling DHCP forwarder & Select interfaces where it should be active

I have this setup , and it works excellent.
I'm still on 2.4.5-p1 though.

/Bingo

GrimmSh0t

@bingo600
I actually figured it out...FINALLY

For anyone else it wasn't Pfsense, it was the TL-SG2218 being miss configured.

I had to configure the:

L3 Features:
- Routing Config -> Enable IPv4 Routing -> add the interface Config

bingo600

@grimmsh0t
That does NOT sound right.
The pfSense DHCP forwarder should work excellent on a "pure" L2 lan , provided the pfSense is setup to allow DHCP (UDP 67 & 68) inbound to the pfSense Lan/Vlan interfaces. I have no idea what to enable for IPv6.

If you have enabled L3 routing on the switch , you have just "bypassed" the pfSense security for those Vlans you have enabled L3 routing on.
As they can now "speak to each other" without passing pfSense.

Did you remember in the DHCP forwarder to enable all interfaces that should forward DHCP requests.

/Bingo

GrimmSh0t

@bingo600
Yes I configured the DHCP Relay:
NOTE: You mentioned in your replied "DHCP Forwarder" - Is this the same as DHCP Relay?

Worth mentioning: Pfsense is on a physical (desktop) device so as an example I am missing (Interface / Switches). Not sure if that's an option I should have!

bingo600

@grimmsh0t
My bad - I meant DHCP Relay

Do you see any blocking in pfSense logs ?

I had to allow UDP 67 & 68 (DHCP) to the pfSense Vlan interface ip , in order for pfSense NOT to block the DHCP requests from clients to the pfSense IF.

You don't need to enable the Relay on VLAN60 , as that is the Vlan you have your DHCP server on.
That would just cause requests on that Vlan to be doubled , as the Relay would also send a request.

Try to enable the Circuit ID / AgentID tick box.
See: https://docs.netgate.com/pfsense/en/latest/services/dhcp/relay.html

I'm using ISC-DHCP server on Linux , but would expect a M$ DC to work much the same way.

/Bingo

GrimmSh0t

@bingo600
For the rules I have any/any for initial setup and will lock it down once I know its running:

VLAN30 and VLAN60 are the same

I'll try this next:

Enable the circuit Id Agent
Add UDP 67 & 68 on the vLan (main lan)
Remove the L3 interfaces from the managed switch.

Will let you know and thanks for the responses.

GrimmSh0t

@bingo600

SUCCESS!

Not sure if it was the Append Circuit ID /AgentID tick box
Allow UDP 67 & 68 (DHCP) to the pfSense Vlan interface ip
Modified relay only on LAN and vLan30

Thanks for all your help!

bingo600

@grimmsh0t

Nice to hear it works.

Unless you only tested DHCP on Lan interface

It has to be the AgentID tickbox that worked.
As you already had : allow ip any any on Vlan30

/Bingo

Ps: Did you notice the "Thank you" button in the bottom of each post