cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

This community is for technical, feature, configuration and deployment questions.
For production deployment issues, please contact the TAC! We will not comment or assist with your TAC case in these forums.
Please see How to Ask the Community for Help for other best practices.

1311
Views
5
Helpful
2
Replies

Need to get a dhcp address from a internal DHCP server for my VPN users. 12 scopes

I have 12 scopes. I need to use ms dhcp server to dole out IP addresses who have entered the ISE via anyconnect.

1 ACCEPTED SOLUTION

Accepted Solutions
andrewswanson
Rising star

Hi

 

See below for ASA documentation on configuring VPN tunnel groups to use DHCP rather than local scopes:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_addresses.html#42265

 

I ran into an issue with using DHCP for AnyConnect clients a while back due to CSCsq84250  - the DHCP server I needed to use was on the ASA Inside interface (Inside was also used to terminate Anyconnect sessions using locally configured scopes)

 

hth
Andy

View solution in original post

2 REPLIES 2
Muhammad Awais Khan
VIP Rising star

Hi,

 

If you are referring to Anyconnect VPN terminating on the ASA then for 12 different scopes, you need 12 different tunnel group and group-policies each with different dhcp scope. Refer to below example for reference:

 

For ASA Software Code:

 

tunnel-group Group1 general-attributes
dhcp-server subnet-selection

default-group-policy-test test1

!

tunnel-group Group2 general-attributes
dhcp-server subnet-selection

default-group-policy-test test2

!

group-policy test1 attributes
dhcp-network-scope 192.168.1.0 (any IP from the dhcp pool)

!

group-policy test2 attributes
dhcp-network-scope 192.168.2.0 (any IP from the dhcp pool)

andrewswanson
Rising star

Hi

 

See below for ASA documentation on configuring VPN tunnel groups to use DHCP rather than local scopes:

https://www.cisco.com/c/en/us/td/docs/security/asa/asa90/configuration/guide/asa_90_cli_config/vpn_addresses.html#42265

 

I ran into an issue with using DHCP for AnyConnect clients a while back due to CSCsq84250  - the DHCP server I needed to use was on the ASA Inside interface (Inside was also used to terminate Anyconnect sessions using locally configured scopes)

 

hth
Andy

View solution in original post

Create
Recognize Your Peers
Polls
Which of these topics should we host an event in the Community?

Top Choice: pxGrid (36%)

Content for Community-Ad

ISE Webinars



Did you miss a previous ISE webinar?

CiscoISE YouTube Channel