DHCP issue On Cisco 3650

[nishantagrawal0322]

Hello,

We have a weird issue here with a 3650 switch. We have it configured to give out dhcp addresses below are the details:- 

Network:- 10.106.148.0 255.255.254.0 (/23)

default router: -10.106.148.2

Vlan 148:- ip:- 10.106.148.2 255.255.254.0

The issue is :- client who gets address assigned in the range of 148, works perfectly fine and can browse internet, but the clients who get's address assigned in the range of 10.106.149.0 cannot browse internet. Can you help?. 

[nishantagrawal0322]

no. That's connection to ASA..

[Flavio Miranda]

Maybe is a long shot,  but this Access List is /24.  I dont know, this could be breaking something for /23

Can you change this to /23 ?

access-list 176 permit icmp host 10.0.76.5 10.0.76.0 0.0.0.255
access-list 176 permit icmp 10.0.76.0 0.0.0.255 host 10.0.76.5

[MHM Cisco World]

No need this' you use transit vlan between asa and Core SW

[nishantagrawal0322]

how do I fix this issue then?

[MHM Cisco World]

I ask for packet-tracer, share the result 

[nishantagrawal0322]

can you reply again with the steps?

[nishantagrawal0322]

sorry, there you go..

AQUA-ASA# Packet-tracer input INside tcp 10.106.149.5 1234 1.1.1.1 433 detail

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f6d8b539f00, priority=1, domain=permit, deny=false
hits=1670821459, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=inside, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 50.220.188.2 using egress ifc outside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside-acl in interface inside
access-list inside-acl extended permit ip any4 any4
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f6d8b7deb90, priority=13, domain=permit, deny=false
hits=8680722, user_data=0x7f6d83264a00, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
object network OBJ-NAT-ALL
nat (inside,outside) dynamic interface
Additional Information:
Dynamic translate 10.106.149.5/1234 to 50.220.188.1/1234
Forward Flow based lookup yields rule:
in id=0x7f6d8b7c8cf0, priority=6, domain=nat, deny=false
hits=8686147, user_data=0x7f6d8b55c7f0, cs_id=0x0, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=outside

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f6d8a298140, priority=0, domain=nat-per-session, deny=false
hits=25741165, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f6d8b542260, priority=0, domain=inspect-ip-options, deny=true
hits=18770594, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x7f6d8a298140, priority=0, domain=nat-per-session, deny=false
hits=25741167, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any

Phase: 8
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x7f6d8b49f8b0, priority=0, domain=inspect-ip-options, deny=true
hits=20548973, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=outside, output_ifc=any

Phase: 9
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 21095085, packet dispatched to next module
Module information for forward flow ...
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_fp_tracer_drop
snp_ifc_stat

Module information for reverse flow ...
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_fp_tracer_drop
snp_ifc_stat

Phase: 10
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 50.220.188.2 using egress ifc outside

Phase: 11
Type: ADJACENCY-LOOKUP
Subtype: next-hop and adjacency
Result: ALLOW
Config:
Additional Information:
adjacency Active
next-hop mac address 7070.8b61.3664 hits 19621995 reference 820

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

AQUA-ASA#

[nishantagrawal0322]

anything?

[Flavio Miranda]

From my end, I have nothgin more. I would suggest to remove that ACL just to make sure. You can try it in a Maitenance window for security.

[nishantagrawal0322]

from core of ASA>?

[Flavio Miranda]

Core.

 interface Vlan76
ip address 10.0.76.5 255.255.255.0
ip access-group 176 in
!

[nishantagrawal0322]

remove the ACL from core or ASA?

[Flavio Miranda]

Core.

[MHM Cisco World]

ip access-group 148 in
!

You this acl under vlan but you not config it!!!

For asa every thing is OK

[nishantagrawal0322]

This is what I have configured. 

access-list 148 permit icmp host 10.106.148.2 10.106.148.0 0.0.1.255
access-list 148 permit icmp 10.106.148.0 0.0.1.255 host 10.106.148.2

acc-list 148 permit ip any any