topic Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time in Network Security

Cisco ASA - AnyConnect clients not getting correct DHCP lease time

samarthashetty — Wed, 29 Apr 2020 16:30:51 GMT

Hi,

Anyconnect VPN users are not getting correct DHCP lease time.

even though its configured for 5 days on windows server its gets expired in 45 mins.

Other scopes on the server are given the correct lease time. Only scope used by the ASA is having issues.

can anyone please shed some light on this issue.

regards

Sam

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

balaji.bandi — Wed, 29 Apr 2020 17:18:25 GMT

can you provide any connect configuraiton from ASA, also DHCP Scope config screen shot (is this from ASA or DHCP windows ?)

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

samarthashetty — Thu, 30 Apr 2020 12:49:42 GMT

i have attched AC config and DHCP scope screen,pls advise

regards

Sam

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

Sheraz.Salim — Thu, 30 Apr 2020 13:07:55 GMT

Does you both DHCP doing a replication. you configuration looks good.

here this link will provide you more control if you want the DHCP to hand out the ip address according to RFC

tunnel-group NETWORKOPS type remote-access
tunnel-group NETWORKOPS general-attributes
 dhcp-server subnet-selection (server ip)      (3011)
 dhcp-server link-selection (server ip)        (3527)
 authentication-server-group SecureID-SVRs
 authorization-server-group NETWORKOPS-LDAP
 authorization-server-group (INSIDE) NETWORKOPS-LDAP
 default-group-policy NOACCESS-GP
 dhcp-server 172.24.4.32
 dhcp-server 172.28.144.234
 authorization-required

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

samarthashetty — Thu, 30 Apr 2020 18:04:50 GMT

Hi Sheraz,

Thanks for the feedback. I will check on this..

Regards

Sam

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

Sheraz.Salim — Thu, 30 Apr 2020 22:09:45 GMT

can you try these command and show the output of them please.

!
tunnel-group DefaultWEBVPNGROUP_general-attributes
 dhcp-server 172.24.4.32
!
debug dhcprelay packet
!
show logging | i IPAA

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

samarthashetty — Fri, 01 May 2020 11:10:05 GMT

Hi Sheraz,

sure, i will check and share the log

Regards

Sam

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

Michael Mitchell — Mon, 22 Jun 2020 16:47:34 GMT

Hi,

We are having the same issue. Any fix on this?

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

Rene Mueller — Wed, 06 Jan 2021 17:46:36 GMT

Hi there,

is there a solution for this problem? We have the same problem and I know it is because of the Failover Configuration of the DHCP Server itself. It looks like RA clients get the the Failover Max Client Lead Time (MCLT) instead of the configured Lease duration time.

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

lvdabeach — Thu, 23 Sep 2021 18:34:29 GMT

Same issue here.

Are there any solutions?

Re: Cisco ASA - AnyConnect clients not getting correct DHCP lease time

Rene Mueller — Thu, 07 Oct 2021 16:02:50 GMT

TAC told me that there is no solution for this with ASA. Our had to disable failover for the VPN Scope in DHCP settings. We then splitted the scope on 2 DHCP server with upper and lower IP range.