| 8.5 |  | PIX Dynamic Host Configuration Protocol (DHCP) |
| 8.5.1 |  | Server and client |

| Overview of DHCP Before discussing the PIX Security Appliance DHCP capabilities, this section will review what Dynamic Host Configuration Protocol (DHCP) is and how it works. DHCP provides automatic allocation of reusable network addresses on a TCP/IP network. In other words, upon login, DHCP gives hosts on a network an IP address from a pool of IP addresses that have been pre-established by the administrator. This provides ease of administration and dramatically reduces the margin of human error. Without DHCP, IP addresses must be manually entered at each computer or device that requires an IP address.

DHCP can also distribute other configuration parameters such as Domain Name System (DNS) and Windows Internet Name Service (WINS) server addresses and domain names. The host that distributes the addresses and configuration parameters to DHCP clients is called a DHCP server. A DHCP client is any host using DHCP to obtain configuration parameters.

Because DHCP traffic consists of broadcast packets and a significant goal of router configuration is to control unnecessary proliferation of broadcast packets, it may be necessary to enable forwarding of DHCP broadcast packets on routers that lie between the DHCP server and its clients. To have the Cisco IOS software forward these broadcast packets, use the ip helper-address interface configuration command. The address specified in the command should be that of the DHCP server.

PIX Security Appliance support for DHCP
Any PIX Security Appliance that runs version 5.2 or higher supports a DHCP server and client. In a network environment secured by a PIX Security Appliance, PC clients connect to the PIX Security Appliance and establish network connections to access an enterprise or corporate network. Instead of manually configuring an IP address on the PIX Security Appliance’s outside interface, the PIX Security Appliance’s Dynamic Host Configuration Protocol (DHCP) client feature can be enabled to have the PIX Security Appliance dynamically retrieve an IP address from a DHCP server . With the PIX Security Appliance configured as a DHCP client, a DHCP server can configure the PIX Security Appliance’s outside interface with an IP address, subnet mask, and optionally a default route. For further information, refer to the previous section on configuring interfaces.

As a DHCP server, the PIX Security Appliance provides these PCs, which are its DHCP clients, the networking parameters necessary for accessing the enterprise or corporate network. Once these PCs are joined to the network, the PIX Security Appliance provides the network services to use, such as the DNS server . The remaining topics in this section of the module will focus on configuring the PIX Security Appliance as a DHCP server. Currently, the PIX Security Appliance can distribute configuration parameters only to clients that are physically connected to the subnet of its inside interface. Also, in version 5.2 or higher, the PIX Security Appliance daemon can only be enabled on the inside interface.