Cisco ASA - Using Internal DHCP Server

[9sobey]

i,

I appreciate any help you can provide on this one. We have a Cisco ASA 5545 running 9.8(4)29 and have a client VPN configured using the local Client Address Pool to provide IPs to users. We are having some issues with one of our user identity pieces of software and believe some of the issues are being caused because every time a user reconnects to the VPN they get a new IP. 

Ideally we would setup a Windows or Linux server to handle the DHCP requests, but I've been asked to investigate whether we can use the Cisco ASA as a DHCP server. I've seen the below document for configuring a DHCP server, but not too sure if we could use the inbuilt one that the ASA has for these clients and what the config would be? Would the DHCP Server address be 127.0.0.1 for example?

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/118084-configure-anyconnect-00.html

Many thanks in advance!

[Aref Alsouqi]

As far as I know the ASA can't act as a real DHCP server, although you can configure the IP pools. One thing probably you can leverage would be the static IP addresses assignment to the interested users. For example, you can configure the ASA to always assign a specific IP address to each user:

no vpn-addr-assign dhcp

username aref attributes

  vpn-framed-ip-address 192.168.0.10 255.255.255.0

[9sobey]

Thanks for the reply and advice regarding the user to IP assignment. Unfortunately, I think as we have around 500 users with people coming and going then this could cause a bit too much management overhead.

I'm going to try and lab up using the internal DHCP server of the ASA (I'm pretty sure they have one built-in) to see if I can get it to work the way we would like. I'll let you know how I get on!

If anyone else does know if it is possible then please do let me know!

[MHM Cisco World]

Mr-Aref suggest to add IP for each Username If you use internal to auth each user, 
if you use AAA server then I think IP can add to Server auth.

[9sobey]

Thanks for the reply - I'm interested to learn more about using the AAA server to assign IPs. Are you able to elaborate on that at all?

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/217435-configure-static-ip-address-assignment-t.html

[Rob Ingram]

@9sobey your best option is to assign the DHCP scope from the ASA using your internal Windows DHCP server, this should register the IP address in your internal DNS. Here is a reference guide

https://integratingit.wordpress.com/2022/02/06/asa-anyconnect-vpn-dhcp-address-assignment/

If you want RADIUS to assign the same IP address to VPN users upon each connection, use this post for more information.

https://integratingit.wordpress.com/2017/01/01/cisco-asa-anyconnect-vpn-with-static-client-ip-address/

[Aref Alsouqi]

Yes the ASA does provide a DHCP server functionalities, but imo it won't really act as a normal or a complete DHCP server, it has some limitations and the reservation option that would be available in the recent releases would still be IP > MAC address not to the users, you might want to go down that route, but personally I wouldn't recommend it as it would make visibility and troubleshooting harder. However, preparing a text file with all the users attributes as suggested in my previous post and copy to the ASA CLI would really be a quick fix. I appreciate this won't be an easy task to be managed for the users coming in and out, but you would still need to that even if you go the IP > MAC reservation route. With regard using an external DHCP server, I think you still would go through the same admin overhead.

[9sobey]

Hi Aref, thanks for the reply. I think my description may not have accurately represented our requirements. So in terms of the user-id appliance having issues, it is mainly seen when a users' AnyConnect client is manually disconnected and re-connected in a short space of time. They then get a new IP address from the pool, which can cause a conflict on our user-id platform.

My thought is to provide DHCP addresses to the AnyConnect clients with a 1 or 2 day lease, which should mean that their IPs don't fluctuate so regularly. So wouldn't require reservations for each device. Do you think that would be possible with the inbuilt DHCP server?

We do use RADIUS for the users connections though, so if the IP reservation can be linked into that, so it is done on a user basis then that would be even better. Do you know if that is possible?

[Aref Alsouqi · Accepted solution]

Yes, the ASA DHCP server supports the lease, the command would be "dhcpd lease ...", the default lease is 3600 secs, and you can change that to be any value between 0 (never expires) to 1048575 secs.