topic Re: DHCP Relay problems in Network Security

DHCP Relay problems

cbkirwan1 — Fri, 21 Feb 2020 16:13:34 GMT

Hey guys, so last weekend I had a problem when implementing 2 Cisco 5508X ASA's. I had the routes correct, the VLANs being trunked, mac addresses on the interfaces and even thousands of hit counts on my rule sets. Only problem was that I was not getting an address. This firewall is used to segment our wireless traffic. My wireless network's were not getting addresses and in the packet capture I wasn't seeing any DHCP requests coming through. This firewall is identical to the old 5520's I'm pulling out. The only thing different is now with the 5508's I have this DHCP Relay Interface Servers option. Also there we're not hit's on my ACL rules for the DHCP either. Any suggestions? Places to look?

Re: DHCP Relay problems

Ajay Saini — Tue, 11 Sep 2018 13:19:44 GMT

So, the intention is to make the ASA act as a dhcp relay server for the clients to be able to get dhcp ip address from WLC. Do we have the dhcp relay configured?

Can you take following debugs:

debug dhcp event

debug dhcp packet

debug dhcp error

Also, share the relevant configuration from the ASA.

If you can take wireshark captures from a client facing issues, please do that as well.

Regards,

Ajay

Re: DHCP Relay problems

cbkirwan1 — Tue, 11 Sep 2018 13:26:28 GMT

dhcprelay server X.X.X.X inside
dhcprelay server X.X.X.X inside
dhcprelay enable New_Handhelds
dhcprelay enable Laptops
dhcprelay enable Voice
dhcprelay enable Guest
dhcprelay enable Imptob-Corp
dhcprelay enable PLTHVAC
dhcprelay timeout 60

This is straight off the active firewall. I had to back out so I don't have any captures. The WLC is not acting as the DHCP server, we have dhcp for wireless going to windows servers.

Re: DHCP Relay problems

balaji.bandi — Tue, 11 Sep 2018 13:37:52 GMT

Where is your DHCP Server located, inside or outside ASA ?

worth looking this document and understand DHCP relay with ASA

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-appliance-asa-software/116265-configure-product-00.html

Re: DHCP Relay problems

cbkirwan1 — Tue, 11 Sep 2018 13:40:03 GMT

It is on the inside. Thanks.

Re: DHCP Relay problems

balaji.bandi — Tue, 11 Sep 2018 15:47:32 GMT

when the request come in, check the trace logs is the DHCP request sent to DHCP Server ?