topic Re: Static DHCP IP to Mac-address reservation in ASA in Network Security

Static DHCP IP to Mac-address reservation in ASA

AGINetworkGroup — Mon, 11 Mar 2019 12:34:54 GMT

Hi,

I am finding it difficult to suggest my management for replacing the present Netscreen firewall which ASA as it does the static dhcp ip to mac-address mapping.

Is there any facility where ASA does static DHCP IP to Mac-address reservation in ASA.

I have seen some notes on cisco which states the utilisation of option 61 to specify the client identifier as we do in Cisco routers How can I use this in ASA with DHCPD option.

Can anyone help me doing this and send me a sample configuration if this can be done using ASA.

Regards,

Krissh

Re: Static DHCP IP to Mac-address reservation in ASA

hadbou — Fri, 25 Apr 2008 19:32:20 GMT

static dhcp ip to mac-address mapping is not supported in ASA.The listt of features supported by ASA is present in the URL given below:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/specs.html

The below Url gives the firewall mode guide for the ASA.

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/fwmode.html

Re: Static DHCP IP to Mac-address reservation in ASA

Dennis Leon — Tue, 10 May 2011 14:00:16 GMT

Actually, you can:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080a7afb2.shtml

The above configuration sample includes both ASDM and CLI config.

Regards,

DL......Please rate the post if it was useful.

Static DHCP IP to Mac-address reservation in ASA

EvaldasOu — Thu, 19 Jul 2012 11:38:14 GMT

Hello.

You can't. Your document is about " how to assign static IP address for user who uses VPN" , not how to bind specific IP address from DHCP pool, to the specific MAC address.

Static DHCP IP to Mac-address reservation in ASA

deyster94 — Thu, 19 Jul 2012 14:00:22 GMT

I was looking around for the same answer when I found what could be a work around. You can create a static arp entry that should allow the device to get the same IP address everytime.

You can do this in the ASDM under Device Management -> Advanced -> Arp -> Arp Static Table

Or from the CLI:

arp INSIDE 1.1.1.1 01ac.ac54.dc88

Static DHCP IP to Mac-address reservation in ASA

EvaldasOu — Thu, 19 Jul 2012 14:11:17 GMT

Hi!

Does it really works for you? Why ASA should look to the ARP table, when the client is sending DHCP request?

Static DHCP IP to Mac-address reservation in ASA

Jay Johnston — Mon, 24 Sep 2012 19:56:18 GMT

This functionality is currently not supported on the ASA. There is no known way to implement this functionality (The static ARP idea doesn't work, I just tried it in the lab).

An enhancement bug has been filed requesting this support:

CSCsw72963 ASA local address pools should support DHCP reservations/assignments

I know this post is 3 years

blakeweaver10 — Wed, 16 Sep 2015 20:37:00 GMT

I know this post is 3 years old but has this been included on a recent software version update for the ASA?

Nope, still not supported in

johnnylingo — Tue, 13 Oct 2015 00:18:28 GMT

Nope, still not supported in 9.2(4), 9.3(3) , 9.4(2), or 9.5(1). The best work-around IMO is use DHCP relay.

Considering it's already taken them this long, I have no problem betting $100 that it will never happen.

Cisco are you fking kidding

Lannar Dean — Fri, 24 Jun 2016 15:14:32 GMT

Cisco are you fking kidding me with this? Unable to create DHCP reservations? Come on......

@Cisco You should be

P_Tone ATG — Thu, 18 Aug 2016 17:34:55 GMT

@Cisco You should be embarrassed about this. How is this still not supported?

We absolutely have not

Jay Johnston — Fri, 19 Aug 2016 15:32:02 GMT

We absolutely have not forgotten about this feature. Stay tuned.

Configuring DHCP Reservations

tarner — Wed, 24 Aug 2016 20:47:28 GMT

Configuring DHCP Reservations for VPN users terminating on ASA 5540 | VPN | Cisco Support Community

We would like to know the solution to this MAC reservation issue? Federal Gov. and compliance network scenarios require this. This is related to this bug also. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsw72963/?referring_site=bugquickviewredir

My company has purchased 2 ASA 5525-x machines to run remote client vpn services. We should be able set this. We just asked are premier cisco partner if there will help us when implementing our ISE project, they have declined. Why is ASA so different then IOS/WLC ?

Posted by u Jay Johnston Cisco 4 years ago

This functionality is currently not supported on the ASA. There is no known way to implement this functionality (The static ARP idea doesn't work, I just tried it in the lab).

An enhancement bug has been filed requesting this support:

CSCsw72963 ASA local address pools should support DHCP reservations/assignments

Is there a remote DHCP workaround? What is the workaround to use IOS or a VPN concentrator ?

https://bst.cloudapps.cisco

administration — Mon, 12 Sep 2016 13:32:46 GMT

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsw72963/

does show an update:

Last Modified: Sep 7,2016

Status: Fixed

Severity: 6 Enhancement

will the feature become available in some future releases? - in which versions?

- Marcus

So what has happened in the

cequint_soksavik — Sun, 13 Nov 2016 10:54:07 GMT

So what has happened in the four years since this shortcoming was pointed out?

What about this? http://www

SamAndrew81 — Thu, 05 Jan 2017 04:29:59 GMT

What about this?
http://www.bigsoft.co.uk/blog/index.php/2013/02/02/configuring-a-permanant-dhcp-reservation-on-a-cisco-asa-pix

What about this?

itnovocure — Wed, 29 Mar 2017 19:35:14 GMT

What about this?

https://www.youtube.com/watch?v=GDwERO0e3zU

That shows adding a static

johnnylingo — Wed, 29 Mar 2017 20:07:44 GMT

That shows adding a static ARP entry. See the post from Jay Johnston below

The detail and config on

arnert — Wed, 29 Mar 2017 21:21:47 GMT

The detail and config on using a IPAM type name server using static reservations (and options) is still not crystal clear. My .org has over 400 mac reservations configured on the DNS ip server. Are we missing something?

Hi,

rchockeelopez — Thu, 06 Apr 2017 00:52:25 GMT

Hi,

This is the topology.

Users are connecting via AnyConnect VPN and are getting authorized with ISE and AD. Windows DHCP Server is giving dynamically IP addreses. The customer wants to assign static MAC-IP binding in the DHCP Server so they can use the firewall to filter based on the VPN IP addresses.

Internet ----- ASA ------ LAN --- ISE and Windows DHCP Server.

Can you provide more information how can I assign MAC-IP binding in a Windows DHCP Server through AnyConnect VPN and ISE.

Would it work by just configuring the DHCP relay on the ASA?

Thanks.