Miscellaneous Security Features
DHCP option 82 is typically used in service-provider networks. It adds location information that can be used to differentiate services between customers. A filtering enhancement was also added to support HTTPS with SmartFilter.
Dynamic Host Configuration Protocol Option 82
Option 82 provides location information from the Dynamic Host Configuration Protocol (DHCP) relay agent—in this case, the FWSM to the DHCP server. This information can be used to differentiate DHCP clients, consequently offering distinctive services on a client basis.
You can use two commands to enable DHCP relay. The first command specifies the DHCP server IP address and the interface where it is located. Optionally, the dhcprelay server ip_address command can be configured under the outgoing interface. The second line enables clients on the inside interface to send and receive DHCP information.
FWSM/Context-A(config)# dhcprelay server 10.20.100.25 Outside FWSM/Context-A(config)# dhcprelay enable Inside
Option 82 can then be enabled on a specific interface, as shown by the following two commands:
FWSM/Context-A(config)# interface vlan vlan-number FWSM/Context-A(config-if)# dhcprelay information trusted
Option 82 can also be enabled on all interfaces using the global command that follows:
FWSM/Context-A(config)# dhcprelay information trust-all
If you are currently using the FWSM as a DHCP relay agent, the addition of option 82 will be a simple addition. Also, when enabling option 82 globally, all interfaces are trusted except the interface that is configured as the dhcprelay (outgoing) interface.
DHCP option 82 adds location information to clients, which can be used to differentiate services. Although used primarily in service provider networks, it could all be used in enterprise networks to differentiate client services.
Smartfilter HTTPS Support
For those of you looking for HTTPS support from SmartFilter on the FWSM, it has now arrived with the introduction of 4.01. See Chapter 14, "Filtering," for configuration details.