ASA DHCP relay

[gizbri]

Need to configure DHCP relay   Here is the setup:

inside 172.16.0.1/24 (clients are requesting DHCP) -  ASA5505 OUTSIDE 10.1.0.1  <---VPN Tunnel--> outside 10.2.0.1 ASA5520 - inside 172.16.1.0/24 DHCP Server 172.16.1.1

Do I put the IP of the 5505 outside interface and the DHCP sever in the crypto maps? 

[Yudong Wu]

It should be ASA inside IP instead of outside IP.

[fadlouni]

Hi.

Have a look here:

https://supportforums.cisco.com/thread/2054584

and here:

https://supportforums.cisco.com/thread/221243

they answer the same question.

Regards,

Fadi.

[gizbri]

Thanks for the links. It is still throwing me an error from the VPN tunnel Group = 10.2.0.1, IP = 10.2.0.1, QM FSM error (P2 struct &0xc9259bf8, mess id 0xda84031e)!  - I have the inside and outside interfaces to the dhcp in the crypto map on the 5505 and the DHCP sevrer to the 5505 inside is excluded from NAT as suggested in the 2nd link

I was hoping someone can construct the commands for each end , it would take me a while to scrub the configs

[Yudong Wu]

Did you add "dhcp server to 5505 outside ip" and "dhcp server to 5505 inside ip" at the other side?

[gizbri]

Thanks for the reply:

Going off the info from the link https://supportforums.cisco.com/thread/221243 , I only added the inside

"Also, at the ASA end, it has to be made sure that the traffic from the DHCP server to the client interface of the PIX is excluded from being natted by the ASA."

[gizbri]

Got it working with the help of TAC

On ASA5520 in the crypto map to ASA5505  add entries for the DHCP Server IP  to both ASA5505 inside and outside interface
On ASA5520 nat exempt the DHCP Server IP Address to both ASA5505 inside and outside interface

On ASA5505 in the crypto map to ASA5520  add entries for the inside and outside interface to the DHCP Server IP 
On ASA5505 nat exempt the outside interface to the DHCP Server

[fadlouni · Accepted solution]

I'm glad you got it fixed.

if your issue is now solved can you please mark this thread as sovled?

Regards,

Fadi.