Need to get a dhcp address from a internal DHCP server for my VPN users. 12 scopes

[joseph.williams@atos.net]

I have 12 scopes. I need to use ms dhcp server to dole out IP addresses who have entered the ISE via anyconnect.

[Muhammad Awais Khan]

Hi,

If you are referring to Anyconnect VPN terminating on the ASA then for 12 different scopes, you need 12 different tunnel group and group-policies each with different dhcp scope. Refer to below example for reference:

For ASA Software Code:

tunnel-group Group1 general-attributes
dhcp-server subnet-selection

default-group-policy-test test1

!

tunnel-group Group2 general-attributes
dhcp-server subnet-selection

default-group-policy-test test2

!

group-policy test1 attributes
dhcp-network-scope 192.168.1.0 (any IP from the dhcp pool)

!

group-policy test2 attributes
dhcp-network-scope 192.168.2.0 (any IP from the dhcp pool)

[andrewswanson · Accepted solution]

Hi

See below for ASA documentation on configuring VPN tunnel groups to use DHCP rather than local scopes:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_addresses.html#42265

I ran into an issue with using DHCP for AnyConnect clients a while back due to CSCsq84250  - the DHCP server I needed to use was on the ASA Inside interface (Inside was also used to terminate Anyconnect sessions using locally configured scopes)

hth
Andy