Beginner DHCP-ASA-Internal Network issues

[LPFJoao]

Hi everyone i'm starting to learn CPT and i got this exercise where i have to create a firewall in btw my internal network; outside network and DMZ zone, which has a DHCP server. And i'm having issue configuring my ASA to allow the pc on the internal network to be able to get this DHCP ips.

Pls be gentle its been ' days since i start learning cisco and my overall experience on this sector is kinda new
Thanks in advance

[marce1000]

   - FYI : Community group for Packet Tracer project questions

  M.

[Flavio Miranda]

@LPFJoao 

 I took a look on your project and I would like to suggest one change. But, keep in mind that ASA in PacketTracer is very buggy. I saw that you are connecting your layer2 switches to the firewall interface, which means that when the PC send broadcast on the network asking for DHCP, this broadcast should get to the ASA inside interface and then be forwarded to the DHCP server on DMZ. 

 This will not work. My suggestion is for you to use a layer3 switch before the ASA, create interface vlan on the layer3 switch and add the command "ip helper-address" on the interface vlan. This way the DHCP request from your local network to DHCP server will cross the firewall as unicast and not broadcast. 

 Between the ASA and the Layer3 switch you can create a transit network. Make sure you can ping the ASA from the layer3 switch because otherwise you are dealing with a buggy ASA and you will be wasting time trying to troubleshooting. If necessary, replace the ASA for another ASA. 

 Hope this can help you.

[LPFJoao]

Thank you very much for your swift response, i will try to put this to work. i'm still quite novice on this matter.

but really appreciate the pointers. NOw just need to learn how to put it in place

[Flavio Miranda]

@LPFJoao 

 Here is a simple project that use ASA and DHCP. You can use as basis to continue your learning.

[vishalbhandari]

@LPFJoao To allow the internal PC to get an IP from the DHCP server in the DMZ on your ASA, you need to permit DHCP traffic between the internal network and the DMZ. On the ASA, enable DHCP relay by configuring the internal interface with dhcprelay server <DHCP Server IP> <interface> (replace <DHCP Server IP> with your DHCP server's IP and <interface> with the DMZ interface). Also, ensure the access control list (ACL) allows UDP traffic on ports 67 and 68 between the internal network and the DMZ. Finally, verify your NAT and security-level configurations to ensure traffic can flow correctly.

[LPFJoao]

I tried to use the CLI with the dhcprelay commands to configure the ASA but it always comes back with an error...