topic Re: ASA DHCP relay in Network Security

ASA DHCP relay

gizbri — Mon, 11 Mar 2019 19:24:59 GMT

Need to configure DHCP relay Here is the setup:

inside 172.16.0.1/24 (clients are requesting DHCP) - ASA5505 OUTSIDE 10.1.0.1 <---VPN Tunnel--> outside 10.2.0.1 ASA5520 - inside 172.16.1.0/24 DHCP Server 172.16.1.1

Do I put the IP of the 5505 outside interface and the DHCP sever in the crypto maps?

Re: ASA DHCP relay

Yudong Wu — Mon, 20 Dec 2010 22:50:35 GMT

It should be ASA inside IP instead of outside IP.

Re: ASA DHCP relay

fadlouni — Mon, 20 Dec 2010 22:53:16 GMT

Hi.

Have a look here:

https://supportforums.cisco.com/thread/2054584

and here:

https://supportforums.cisco.com/thread/221243

they answer the same question.

Regards,

Fadi.

Re: ASA DHCP relay

gizbri — Tue, 21 Dec 2010 16:10:11 GMT

Thanks for the links. It is still throwing me an error from the VPN tunnel Group = 10.2.0.1, IP = 10.2.0.1, QM FSM error (P2 struct &0xc9259bf8, mess id 0xda84031e)! - I have the inside and outside interfaces to the dhcp in the crypto map on the 5505 and the DHCP sevrer to the 5505 inside is excluded from NAT as suggested in the 2nd link

I was hoping someone can construct the commands for each end , it would take me a while to scrub the configs

Re: ASA DHCP relay

Yudong Wu — Tue, 21 Dec 2010 16:31:31 GMT

Did you add "dhcp server to 5505 outside ip" and "dhcp server to 5505 inside ip" at the other side?

Re: ASA DHCP relay

gizbri — Tue, 21 Dec 2010 16:38:58 GMT

Thanks for the reply:

Going off the info from the link https://supportforums.cisco.com/thread/221243 , I only added the inside

"Also, at the ASA end, it has to be made sure that the traffic from the DHCP server to the client interface of the PIX is excluded from being natted by the ASA."

Re: ASA DHCP relay

gizbri — Wed, 22 Dec 2010 15:50:43 GMT

Got it working with the help of TAC

On ASA5520 in the crypto map to ASA5505 add entries for the DHCP Server IP to both ASA5505 inside and outside interface
On ASA5520 nat exempt the DHCP Server IP Address to both ASA5505 inside and outside interface

On ASA5505 in the crypto map to ASA5520 add entries for the inside and outside interface to the DHCP Server IP
On ASA5505 nat exempt the outside interface to the DHCP Server

Re: ASA DHCP relay

fadlouni — Wed, 22 Dec 2010 16:33:36 GMT

I'm glad you got it fixed.

if your issue is now solved can you please mark this thread as sovled?

Regards,

Fadi.