DHCP Server With Multiple RED's and VLAN

Who is the DHCP Server? XG? 

In this Case, you would most likely use a Bridge and bridge all interfaces together. 

In case you have another DHCP server in Port8.20, you would use DHCP relay. 

But as far as i can see from your Config, you need a bridge, which gets really messy. 

Answered already another Thread with a similar requirement. 

https://community.sophos.com/products/xg-firewall/f/network-and-routing/104416/vlans-behind-red

Basic question is, why do you need VLAN in the other locations? 

I currently have one DHCP server on Port8 for the XG LAN (no VLAN).

VLAN 20 is the guest WiFi network which is isolated from the rest of the network and requires different web filtering rules. That's the reason for needing VLAN in the other locations.

If I were to create a new DHCP server on Port8.20, how would the relay need to be setup to function for the VLAN20 RED interfaces?

The point is, you cannot use the same subnet on different interfaces. This causes a huge issue in the network. And in this case, you try to do this. But as far as i can read, there is no requirement to use the same network on each red? 

So basically you could go with following approach: Use the DHCP Server on Port8.20 and create a DHCP relay for each RED.20. Then configure your DHCP Server to serve different pools to each RED, but use other subnets like 192.168.1.1 /24 192.168.2.1/24 etc. 

The point is, you cannot use the same subnet on different interfaces. This causes a huge issue in the network. And in this case, you try to do this. But as far as i can read, there is no requirement to use the same network on each red? 

So basically you could go with following approach: Use the DHCP Server on Port8.20 and create a DHCP relay for each RED.20. Then configure your DHCP Server to serve different pools to each RED, but use other subnets like 192.168.1.1 /24 192.168.2.1/24 etc. 

manbearpig said:

The point is, you cannot use the same subnet on different interfaces. This causes a huge issue in the network. And in this case, you try to do this. But as far as i can read, there is no requirement to use the same network on each red? 

So basically you could go with following approach: Use the DHCP Server on Port8.20 and create a DHCP relay for each RED.20. Then configure your DHCP Server to serve different pools to each RED, but use other subnets like 192.168.1.1 /24 192.168.2.1/24 etc. 

 

I see. I thought since they needed to share a DHCP server I could just put them all on the same subnet.
I have changed the VLAN interfaces as follows:

reds1.20 - 10.4.20.1 /24
reds2.20 - 10.6.20.1 /24
reds3.20 - 10.3.20.1 /24
reds4.20 - 10.7.20.1 /24
Port8.20 - 10.1.20.1 /24

Now, if I create DHCP on Port8.20, how do the relays need to be configured for each RED.20? When creating a relay, it seems it won't accept the IP of an interface that already has a DHCP server bound to it but I'm not sure how else would you point the relay to the correct DHCP server?

Do you have a DHCP Server on Port8.20 or do you mean the "onboard" DHCP Server of XG? 

If onboard, you cannot use 1 DHCP server and relay this to every other Interface. The DHCP Relay option is only for extern DHCP Server (like windows servers). 

So use the onboard XG dhcp server and create for each VLAN an own DHCP server on xg. 

manbearpig said:

If onboard, you cannot use 1 DHCP server and relay this to every other Interface. The DHCP Relay option is only for extern DHCP Server (like windows servers). 

Yes, I was trying to use onboard... that explains a lot of my trouble! So without an external server to relay to, there's no way to share a single onboard DHCP server with all of the VLAN.20 interfaces?

Basically it will use one DHCP module. 

If you create for every interface a new DHCP "Server", XG will create just a new Pool for you. 

That makes sense. It's using one server, just creating a separate pool for each interface. Still, there's no way to share a pool between interfaces?

There are two reason for wanting to share a pool:

1. The remote locations are actually in close proximity to each other, enough so that sometimes wireless clients will roam between two locations. It would be nice if they could roam without switching subnets.

2. Keeping configuration to a minimum in a network that is already more complicated that I'd like it to be.

If creating separate pools is as good as it gets, I can work with that.

As mentioned before, this will cause the worst case to share the pool. You would have to use a bridge and bridge everything together.

After bridging everything, you have to deal with the ARP / broadcast etc. 

This is most likely not the best solution and i would use different DHCP pools.

And please enable DHCP Global: https://community.sophos.com/kb/en-us/123952

Thank you very much. You've given me a much better understanding of how DHCP works on the XG.