topic Re: asa with dhcp and failover in Network Security

asa with dhcp and failover

jvardhan29 — Mon, 11 Mar 2019 19:34:05 GMT

hi ,

In the below document under Failover Configuration Limitations it is mentioned that the DHCP and PPPOE cannot be configured , so is it true for only Active Active or Active / standby also ?

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080834058.shtml

You cannot configure failover with these types of IP addresses:

IP addresses obtained through DHCP

IP addresses obtained through PPPoE

If this is only for the Active-Active , so in the case of A/S does the dhcpbindings and lease gets failed over from active to the peer device ( i.e stateful sessions ) or the bindings are renegotiated ?

Re: asa with dhcp and failover

Jennifer Halim — Wed, 12 Jan 2011 11:45:16 GMT

The statement is true for both Active/Standby as well as Active/Active failover.

The reason why it's not working is because for failover to work, you would need to have ip address on each of the ASA firewall so it can check the state of the interface, and failover when it's faulty. When the ip address is dynamically assigned whether it's through DHCP or PPPoE, you will only be assigned 1 ip address, and the standby firewall will have no ip address, and hence failover will not work.

Re: asa with dhcp and failover

jvardhan29 — Fri, 14 Jan 2011 12:28:50 GMT

thanks for answer . i agree to the same

If we cannot assign DHCP then there is a link which i was going thru and found that failover is configured with inside interface as the DHCP server

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ref_examples.html#wp1065283

so does that mean that with failover only the dhcp cleint feature cannot be configured but the dhcp server and relay can be configured . if yes then whether the same session of dhcprelay and server is replicated to failover ?

Re: asa with dhcp and failover

jvardhan29 — Mon, 17 Jan 2011 08:55:48 GMT

hi experts

any comments or views on this ?

Re: asa with dhcp and failover

Jennifer Halim — Mon, 17 Jan 2011 09:01:31 GMT

No, DHCP ip address lease information will not be replicated from active to standby firewall.

Here is what is being replicated through stateful failover link:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ha_overview.html#wp1078953

Hope that answers your question.

Re: asa with dhcp and failover

jvardhan29 — Sat, 22 Jan 2011 13:38:10 GMT

jennifer ,

thanks for answring , so can we say that dhcp server & relay can be configured with failover though the dhcp information will not be replicated to standby ?

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/ref_examples.html#wp1065283

Re: asa with dhcp and failover

Kureli Sankar — Sun, 23 Jan 2011 14:45:24 GMT

Not at the same time.

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/dhcp.html#wp1116296

You cannot configure a DHCP client or DHCP Relay services on an interface on which the server is enabled.

-KS