Not enough IP addresses per VLAN on ASA5505

[Rolitto]

Hi, I am configuring a DHCP pool on a Cisco ASA5505 to provide the internal network (VLAN 1) with IP addresses ranging from 192.168.1.50 to 192.168.1.200 on a subnet of 192.168.1.0/24. However, I am getting an error that I cannot get a range of more than 32 IP addresses. 

Has anyone encountered this issue? And what alternatives do I have?

Any advise is as always appreciated, thanks.

[Francesco Molino]

Hi

Can you share the config of your dhcp please?

[Rolitto]

Yes sure Francesco.

Here it is:

...
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
telnet timeout 5
ssh timeout 5
console timeout 0

dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.36 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
!
prompt hostname context
call-home reporting anonymous

Thanks,

[Richard Burts · Accepted solution]

You have not told us whether your ASA5505 has the base license or the plus license. Based on the symptoms I am guessing that you have the base license. I found this information which seems to describe your situation:

For a 10-user license, the max number of DHCP clients on the internal network is 32. For 50-user license, the max number of DHCP clients is 128.

Here is the link if you want to look for more detail

https://www.networkstraining.com/asa-5505-5510-base-vs-security-plus-license/

You ask what alternative you have and the answer is that if you can upgrade your ASA5505 license from base to plus that you would get additional IP addresses in your DHCP scope.

[Richard Burts]

I have looked a bit more at the aspect of whether you would be able to upgrade your base license to plus and it is not clear. The ASA5505 is past its End of Sales date. So I believe that you can not purchase the license upgrade from Cisco. But I found on the web site for CDW and for Amazon that they list a plus license for ASA5505. So maybe you could order the license upgrade? And if you order it would it work? I am not sure.

So let me amend what I said about your alternatives. Perhaps you might be able to upgrade the license to plus. Otherwise if it is important to increase the number of DHCP addresses then your alternative is that you need to get a more recent ASA that would support it.

[Rolitto]

I will try to use one Cisco switch for the end devices that aren't necessary to be behind the ASA. I know it is not an ideal solution, but at least it is temporary because upgrading from Base to Security Plus license will cost me around $500.00, and it is not that worth on an ASA5505.

[Richard Burts]

I agree that spending $500 to upgrade the license is probably not worth it (and I am not sure that it really would work if you did spend the money). So finding a work around is a very good idea. This was an interesting question to investigate. I am glad that my responses have been helpful. Thank you for marking this question as solved. This will help other participants in the community to identify discussions which have helpful information. This community is an excellent place to ask questions and to learn about networking. I hope to see you continue to be active in the community.

[Rolitto]

Yes Richard, I was not pretty aware of the capabilities of my ASA5505 and indeed it is a Base License, so thank you for the spot-on answer and solution.