topic DHCP Address assignment by MAC on ASA5505 in Network Security

DHCP Address assignment by MAC on ASA5505

swharvey — Mon, 11 Mar 2019 09:21:36 GMT

I am setting up an ASA5505 for a pilot home office, defining a business vlan and a personal vlan. I have setup the dhcp scopes for both vlans, but I need to be able to only permit specific mac-addresses to receive a DHCP address from the business vlan. On a 871 router I can use the mac or "client-identifier" command. Is there a way to do this on the ASA's?

Re: DHCP Address assignment by MAC on ASA5505

Aaron S Mcquaid — Thu, 18 Jan 2007 23:18:42 GMT

You can use a combination of static arp entries and arp inspection to accomplish this. You will need to statically define every host with the arp command:

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/cmd_ref/a2_711.htm#wp1479532

You then need to enable arp inspection with the no-flood keyword. This will mean that all arp entries will be dropped unless they are statically configured. This will lock out all other hosts other than those that you have configured.

http://www.cisco.com/univercd/cc/td/doc/product/multisec/asa_sw/v_7_2/cmd_ref/a2_711.htm#wp1479789

Re: DHCP Address assignment by MAC on ASA5505

swharvey — Fri, 19 Jan 2007 00:39:41 GMT

Thanks that is a clever work around, however I don't think this will be a viable solution for us, as the mac addresses for the devices connecting to the personal vlan will be unknown and subject to frequent change.

To clarify, I need to setup the ASA so that:

1) It provides Business vlan DHCP assigned IP addresses only to specific static mac defined devices attached to ports in the Business vlan.

2) It provides Personal vlan DHCP assigned IP addresses to any devices attached to ports in the Personal vlan.

3) It prevents any non staic mac defined devices from obtaining a DHCP address on the business vlan.

I will read the url's you linked more closely and see what/if I am missing something.

Re: DHCP Address assignment by MAC on ASA5505

Aaron S Mcquaid — Fri, 19 Jan 2007 13:23:24 GMT

I think that it will work for you because you can enable ARP inspection on a per interface basis.

Re: DHCP Address assignment by MAC on ASA5505

Collin Clark — Fri, 19 Jan 2007 14:12:22 GMT

I just had this same requirement. I ended up creating a new VPN group for the users (there were only two).

Re: DHCP Address assignment by MAC on ASA5505

swharvey — Fri, 26 Jan 2007 01:17:56 GMT

Unfortunately the TAC engineer I spoke with said this will nto provide the solution I am after in so far as the ASA assigned DHCP addresses to specific MAC's. I would have to statically configure each IP address on the devices that I wisht to have access to the Business LAN and subject to the static arp/arp inspection.

If you can elaborate on your solution I can share it with the TAC engineer.

In parallel I have requested our account team submit a Feature Request for this capability in future ASA code releases.