Static DHCP IP to Mac-address reservation in ASA

[AGINetworkGroup]

Hi,

I am finding it difficult to suggest my management for replacing the present Netscreen firewall which ASA as it does the static dhcp ip to mac-address mapping.

Is there any facility where ASA does static DHCP IP to Mac-address reservation in ASA.

I have seen some notes on cisco which states the utilisation of option 61 to specify the client identifier as we do in Cisco routers How can I use this in ASA with DHCPD option.

Can anyone help me doing this and send me a sample configuration if this can be done using ASA.

Regards,

Krissh

[tarner]

Configuring DHCP Reservations for VPN users terminating on ASA 5540 | VPN | Cisco Support Community

We would like to know the solution to this MAC reservation issue? Federal Gov. and compliance network scenarios require this. This is related to this bug also. https://bst.cloudapps.cisco.com/bugsearch/bug/CSCsw72963/?referring_site=bugquickviewredir

My company has purchased 2 ASA 5525-x machines to run remote client vpn services.  We should be able set this. We just asked are premier cisco partner  if there will help us when implementing our ISE project, they have declined. Why is ASA so different then IOS/WLC ?

Posted by u Jay Johnston Cisco 4 years ago

This functionality is currently not supported on the ASA. There is no known way to implement this functionality (The static ARP idea doesn't work, I just tried it in the lab).

An enhancement bug has been filed requesting this support:

CSCsw72963 ASA local address pools should support DHCP reservations/assignments

Is there a remote DHCP workaround? What is the workaround to use IOS or a VPN concentrator ? 

[cequint_soksavik]

So what has happened in the four years since this shortcoming was pointed out?

[Mike Fowler]

Staying tuned is all fine and good for those who aren't trying to operate a business.  I just had my business partner shell out for three ASAs thinking they'd be adequate, now I find out I can't reserve IPs.  Any update?

-m

[Chekol Retta]

Adding a static ARP entry actually creates an issue as the ASA will not be able to reserve the IP.  When the ASA assigns the supposedly reserved IP address to another device, you will end up with ARP collision. 

Received ARP request collision from 192.168.5.6/aaaa.aaaa.aaaa on interface Inside with existing ARP entry 192.168.5.6/xxxx.xxxx.xxxx

[PS99]

Another YEAR later - perhaps you can update the bugs report at least?  Very disappointed in Cisco, and will never recommend their products again.

[arnert]

Still looking for a solution to this problem.

[gmcatering]

So when? We have been staying tuned for years now. This is a really needed feature ASAP.

[mbilgrav]

any chance that this is done this day & age ?

[SamAndrew81]

What about this? 
http://www.bigsoft.co.uk/blog/index.php/2013/02/02/configuring-a-permanant-dhcp-reservation-on-a-cisco-asa-pix

[itnovocure]

What about this?

https://www.youtube.com/watch?v=GDwERO0e3zU

[johnnylingo]

That shows adding a static  ARP entry.  See the post from Jay Johnston below

[jasonmadruga84]

Hi all,

Static ARP didn't work on my ASA 5505 with asa924-20-k8.bin (9.2(4)20) even though the command was entered, shows in config, and reboot performed... No success.

This person said he did Static ARP on his 5505 with command alias at the end.

https://cyruslab.net/2014/07/09/adding-static-arp-to-asa5505/

I tried this, cleared ARP, rebooted... No success.

This does look like a bug/flaw on at least the 5505. Online documentations shows it as a feature and ASDM leads you to believe it works as well.

http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/bridgarp.html

http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/about.html

I guess one way to implement the Static ARP / DHCP Reservation on a device where it does work and configure DHCP Relay (if that works!) on the ASA. The feature is available even on old Linksys Wirless G routers that came out in 2003... this does not make you look good Cisco!

-Jason

[Sheraz_35]

Hi Cisco,

Any update on this feature? It is really needed.

[George Mason]

The fact that this has not yet been addressed by Cisco, or even replied to, is truly pathetic.

DHCP reservation is a simple feature and something that should have been supported out of the box.

Can someone from Cisco please update as to why this is not included? I can only assume that some internal decision has been made not to support this feature, and customers are not being told.

[aaron.ekinaka]

Agreed. It is disheartening that this issue has been ignored for so long. The smaller ASA 5505/5506 line is great for small remote offices (that might not even have other DHCP services available) so to not have this feature available when other garbage soho gateways you can get at Best Buy are able to do this is beyond me.

With ASA on the chopping block for FTD code now, it's doubtful we'll ever get this functionality, which is a huge bummer because I still see 5505/06 boxes all over the place and this would be extremely useful when setting a static IP is sometimes a dangerous (from a remote support perspective) thing to do in a branch office location.