02-03-2014 11:54 PM - edited 03-11-2019 08:40 PM
Hi All,
I did have this setup in a lab and was working fine, now suddenly I'm having issues.
I've basically configured ASA as below. I'm using it as a DHCP Server for VLAN 127 and 128.
I've plugged Gi0/0 into an access port on my Core (Vlan 127 just to test, don't care about vlan 128 just now). I have then connected a spare machine into an access port on my switch (Vlan 127). I would have expected the machine to look for a DHCP Server and for the ASA to reply?
Basically when I plug a machine into VLAN 127, the ASA is not dishing out addresses.
Am I missing something?
Thanks
!
interface GigabitEthernet0/0
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/0.127
vlan 127
nameif Vlan127
security-level 50
ip address 192.168.127.1 255.255.255.0
!
interface GigabitEthernet0/0.128
vlan 128
nameif Vlan128
security-level 50
ip address 192.168.128.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 172.27.100.160 255.255.252.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/5
nameif outside
security-level 0
ip address Public IP 255.255.255.240
!
interface Management0/0
nameif management
security-level 100
ip address 10.44.240.190 255.255.255.0
management-only
!
dns domain-lookup inside
same-security-traffic permit inter-interface
object-group network DynamicNatInside
network-object 192.168.127.0 255.255.255.0
network-object 192.168.128.0 255.255.255.0
access-list Inside_To_Out extended permit ip object-group DynamicNatInside any
access-list VLAN-127-IN remark Allow Specific Traffic
access-list VLAN-127-IN extended permit ip 192.168.127.0 255.255.255.0 172.27.100.0 255.255.252.0
access-list VLAN-127-IN remark Deny traffic to rest of internal network
access-list VLAN-127-IN extended deny ip any 172.16.0.0 255.240.0.0
access-list VLAN-127-IN remark Allow all other traffic
access-list VLAN-127-IN extended permit ip 192.168.127.0 255.255.255.0 any
pager lines 24
logging asdm informational
mtu Vlan127 1500
mtu Vlan128 1500
mtu inside 1500
mtu outside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
asdm image disk0:/asdm-66114.bin
no asdm history enable
arp timeout 14400
!
nat (any,outside) after-auto source dynamic DynamicNatInside interface
access-group Inside_To_Out out interface outside
route outside 0.0.0.0 0.0.0.0 Public ip
route inside 172.16.0.0 255.240.0.0 172.27.100.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication serial console LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 172.27.10.0 255.255.255.0 inside
http 10.44.240.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
<
ssh timeout 5
ssh version 2
console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
!
dhcpd address 192.168.127.10-192.168.127.250 Vlan127
dhcpd enable Vlan127
!
dhcpd address 192.168.128.10-192.168.128.250 Vlan128
dhcpd enable Vlan128
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password ZfmuEbY35LxeX.Eu encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect dns preset_dns_map
inspect icmp
02-04-2014 12:13 AM
hi,
did you configure the adjacent switch for 802.1Q trunk port?
issue a debug dhcpd event to further check.
02-04-2014 12:17 AM
Hi There,
I just configured it as an access layer port, vlan 127. I'm guessing I'd only need to configure it as a trunk if I want VLAN 128 to be working also (which I don't at the moment). I did run this debug, and tried a ipconfig /renew on the machine, but it didn't come up with anything.
I had this all working in a lab enviroment so a bit puzzled as to why it's no longer working. It must be something very simple, as that always seems to be the case...
02-04-2014 12:47 AM
hi,
just to cover basics, did you set the machine to obtain auto IP? switch port is enabled (no shut and status is connected).
if you set for manual IP, can it ping ASA GW 192.168.127.1?
02-04-2014 03:37 AM
Hi,
Have stuck on static IP within that DHCP range and plugged laptop into Access Port on VLAN 127. Still unable to ping the ASA Interface 192.168.127.1.
No output from any of the DHCP Debugs on the ASA either. Is it being blocked potentialy?.
Output of the state below.
Context Configured as DHCP Server
Interface Vlan127, Configured for DHCP SERVER
Interface Vlan128, Configured for DHCP SERVER
Interface inside, Not Configured for DHCP
Interface outside, Not Configured for DHCP
Interface management, Not Configured for DHCP
Address pools 2
Automatic bindings 0
Expired bindings 0
Malformed messages 0
Message Received
BOOTREQUEST 0
DHCPDISCOVER 0
DHCPREQUEST 0
DHCPDECLINE 0
DHCPRELEASE 0
DHCPINFORM 0
Message Sent
BOOTREPLY 0
DHCPOFFER 0
DHCPACK 0
DHCPNAK 0
02-04-2014 04:43 AM
How are you connecting your PC to the ASA? Are you connecting it directly to the ASA port? If so is your PC in a docking station? If it is in a docking station you need to connect the cable to the port on the docking station.
--
Please remember to rate and select a correct answer
02-04-2014 04:56 AM
The ASA Gig0/0 is plugged into my Switch (I've now made it a trunk Port).
The Switch has VLAN 127 and VLAN 128 configured on it.
My Laptop is plugged directly into the same switch for testing purposes, different port. The Port is an access port, vlan 127.
Now I would have expected the Laptop to boot up, it's in VLAN127, look for DHCP Server which it would find on the ASA serving addresses for VLAN127.
However I just receive 169.x.x..x address.
02-04-2014 06:42 AM
Hi,
The IP 169.x.x.x is a Windows auto generated address which means it can't get an IP via DHCP. Make sure your TCP/IP settings are correct and connected to right network/group (Win 7).
Edit: Could you post 'show version'? I suspect it has to do with VLANs. Try using VLAN 1 and 2 for 127 and 128 respectively.
Sent from Cisco Technical Support iPhone App
02-04-2014 07:16 AM
Hi Guys,
I found the issue, the trunk port on the switches were not allowing my vlan. I have added them to the allowed vlan list :-)
Thanks
02-04-2014 06:45 AM
I have seen this only once before on a 5505. I had to remove the DHCP config, reload the ASA, shut down the inside interface, add the DHCP config back, bring up the inside interface. After doing that it started working. But I have no explanation as to why it happened.
--
Please remember to rate and select a correct answer
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide