topic Re: DHCP From ASA in Network Security

DHCP From ASA

GRANT3779 — Tue, 12 Mar 2019 03:40:00 GMT

Hi All,

I did have this setup in a lab and was working fine, now suddenly I'm having issues.

I've basically configured ASA as below. I'm using it as a DHCP Server for VLAN 127 and 128.

I've plugged Gi0/0 into an access port on my Core (Vlan 127 just to test, don't care about vlan 128 just now). I have then connected a spare machine into an access port on my switch (Vlan 127). I would have expected the machine to look for a DHCP Server and for the ASA to reply?

Basically when I plug a machine into VLAN 127, the ASA is not dishing out addresses.

Am I missing something?

Thanks

interface GigabitEthernet0/0

no nameif

no security-level

no ip address

interface GigabitEthernet0/0.127

vlan 127

nameif Vlan127

security-level 50

ip address 192.168.127.1 255.255.255.0

interface GigabitEthernet0/0.128

vlan 128

nameif Vlan128

security-level 50

ip address 192.168.128.1 255.255.255.0

interface GigabitEthernet0/1

nameif inside

security-level 100

ip address 172.27.100.160 255.255.252.0

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/4

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/5

nameif outside

security-level 0

ip address Public IP 255.255.255.240

interface Management0/0

nameif management

security-level 100

ip address 10.44.240.190 255.255.255.0

management-only

dns domain-lookup inside

same-security-traffic permit inter-interface

object-group network DynamicNatInside

network-object 192.168.127.0 255.255.255.0

network-object 192.168.128.0 255.255.255.0

access-list Inside_To_Out extended permit ip object-group DynamicNatInside any

access-list VLAN-127-IN remark Allow Specific Traffic

access-list VLAN-127-IN extended permit ip 192.168.127.0 255.255.255.0 172.27.100.0 255.255.252.0

access-list VLAN-127-IN remark Deny traffic to rest of internal network

access-list VLAN-127-IN extended deny ip any 172.16.0.0 255.240.0.0

access-list VLAN-127-IN remark Allow all other traffic

access-list VLAN-127-IN extended permit ip 192.168.127.0 255.255.255.0 any

pager lines 24

logging asdm informational

mtu Vlan127 1500

mtu Vlan128 1500

mtu inside 1500

mtu outside 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

asdm image disk0:/asdm-66114.bin

no asdm history enable

arp timeout 14400

nat (any,outside) after-auto source dynamic DynamicNatInside interface

access-group Inside_To_Out out interface outside

route outside 0.0.0.0 0.0.0.0 Public ip

route inside 172.16.0.0 255.240.0.0 172.27.100.10 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication serial console LOCAL

aaa authentication telnet console LOCAL

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 management

http 172.27.10.0 255.255.255.0 inside

http 10.44.240.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

ssh timeout 5

ssh version 2

console timeout 0

dhcpd dns 8.8.8.8 8.8.4.4

dhcpd address 192.168.127.10-192.168.127.250 Vlan127

dhcpd enable Vlan127

dhcpd address 192.168.128.10-192.168.128.250 Vlan128

dhcpd enable Vlan128

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username admin password ZfmuEbY35LxeX.Eu encrypted

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect dns preset_dns_map

inspect icmp

DHCP From ASA

johnlloyd_13 — Tue, 04 Feb 2014 08:13:01 GMT

hi,

did you configure the adjacent switch for 802.1Q trunk port?

issue a debug dhcpd event to further check.

DHCP From ASA

GRANT3779 — Tue, 04 Feb 2014 08:17:02 GMT

Hi There,

I just configured it as an access layer port, vlan 127. I'm guessing I'd only need to configure it as a trunk if I want VLAN 128 to be working also (which I don't at the moment). I did run this debug, and tried a ipconfig /renew on the machine, but it didn't come up with anything.

I had this all working in a lab enviroment so a bit puzzled as to why it's no longer working. It must be something very simple, as that always seems to be the case...

Re: DHCP From ASA

johnlloyd_13 — Tue, 04 Feb 2014 08:47:38 GMT

hi,

just to cover basics, did you set the machine to obtain auto IP? switch port is enabled (no shut and status is connected).

if you set for manual IP, can it ping ASA GW 192.168.127.1?

Re: DHCP From ASA

GRANT3779 — Tue, 04 Feb 2014 11:37:29 GMT

Hi,

Have stuck on static IP within that DHCP range and plugged laptop into Access Port on VLAN 127. Still unable to ping the ASA Interface 192.168.127.1.

No output from any of the DHCP Debugs on the ASA either. Is it being blocked potentialy?.

Output of the state below.

Context Configured as DHCP Server

Interface Vlan127, Configured for DHCP SERVER

Interface Vlan128, Configured for DHCP SERVER

Interface inside, Not Configured for DHCP

Interface outside, Not Configured for DHCP

Interface management, Not Configured for DHCP

Address pools 2

Automatic bindings 0

Expired bindings 0

Malformed messages 0

Message Received

BOOTREQUEST 0

DHCPDISCOVER 0

DHCPREQUEST 0

DHCPDECLINE 0

DHCPRELEASE 0

DHCPINFORM 0

Message Sent

BOOTREPLY 0

DHCPOFFER 0

DHCPACK 0

DHCPNAK 0

Re: DHCP From ASA

Marius Gunnerud — Tue, 04 Feb 2014 12:43:48 GMT

How are you connecting your PC to the ASA? Are you connecting it directly to the ASA port? If so is your PC in a docking station? If it is in a docking station you need to connect the cable to the port on the docking station.

--
Please remember to rate and select a correct answer

Re: DHCP From ASA

GRANT3779 — Tue, 04 Feb 2014 12:56:48 GMT

The ASA Gig0/0 is plugged into my Switch (I've now made it a trunk Port).

The Switch has VLAN 127 and VLAN 128 configured on it.

My Laptop is plugged directly into the same switch for testing purposes, different port. The Port is an access port, vlan 127.

Now I would have expected the Laptop to boot up, it's in VLAN127, look for DHCP Server which it would find on the ASA serving addresses for VLAN127.

However I just receive 169.x.x..x address.

Re: DHCP From ASA

johnlloyd_13 — Tue, 04 Feb 2014 14:42:27 GMT

Hi,

The IP 169.x.x.x is a Windows auto generated address which means it can't get an IP via DHCP. Make sure your TCP/IP settings are correct and connected to right network/group (Win 7).

Edit: Could you post 'show version'? I suspect it has to do with VLANs. Try using VLAN 1 and 2 for 127 and 128 respectively.

Sent from Cisco Technical Support iPhone App

Re: DHCP From ASA

Marius Gunnerud — Tue, 04 Feb 2014 14:45:35 GMT

I have seen this only once before on a 5505. I had to remove the DHCP config, reload the ASA, shut down the inside interface, add the DHCP config back, bring up the inside interface. After doing that it started working. But I have no explanation as to why it happened.

--
Please remember to rate and select a correct answer

Re: DHCP From ASA

GRANT3779 — Tue, 04 Feb 2014 15:16:13 GMT

Hi Guys,

I found the issue, the trunk port on the switches were not allowing my vlan. I have added them to the allowed vlan list 🙂

Thanks