I am still confused. Perhaps a drawing showing how devices are connected would be helpful?   HTH   Rick ... View more

I agree with @balaji.bandi that I do not see the point of the pair of routers. It seems to me that Louey is not understanding the way that active/standby failover works on ASA. There is an IP on the active ASA (251) and an IP on the standby (252). If there is some event that triggers failover on the ASA then the standby ASA becomes active and it takes on the address of 251. When the other ASA comes back in service it will use the address of 252. So the gateway for the Lan devices moves from one ASA to the other without needing the HSRP on the routers.   HTH   Rick ... View more

I am a bit not clear what you are trying to do. But I am sure that having wan1 and wan2 in the same subnet will not work. Can you provide some clarification about what you are trying to accomplish?   HTH   Rick ... View more

There are still some significant things that we do not know about your situation and therefore we need to be careful in our responses. If the discussion about needing a router at each site was in terms of the switched Ethernet operating as a single broadcast domain and functioning as a routed transit link (with each remote site having its own unique subnets and routing over the transit link then the "router" needed at each site is some layer 3 forwarding device and a 3850 should be fine. If the discussion about needing a router at each site was in terms of functions such as address translation, then a 3850 might not be sufficient. My guess at this point is that they are thinking of it as a transit link and a 3850 should be adequate.   HTH   Rick ... View more

Can you get the network team to provide the output of these commands on both switches and post it for us to evaluate: show cdp neighbor show interface status   HTH   Rick ... View more

There are some things in your post that I still do not understand. - If the original packet has destination address of 172.16.255.255 then why is the helper-address also pointing to 172.16.255.255? - If the helper address points to 172.16.255.255 is there an entry in the routing table for that subnet? Where do you expect the broadcast to be forwarded? - You say that you still do not see the broadcasts packets. Where are you looking for them? - What role does vlan 100 play in this? I do not see anything that relates vlan 100 with the broadcast packets. - If you want broadcast packets forwarded to vlan 100 then you need a helper address that points to that subnet.   HTH   Rick ... View more

The original post asks this question: " I am not sure if I need some routing to achieve this ". The answer is that yes you need some routing. Site C must have routing logic for the network and must allow access to the network for traffic coming through the vpn. Site B must have routing logic that knows that the network is reached by its vpn to Site C. Site A must have routing logic that knows that the network is reached by its vpn to Site B.   HTH   Rick        ... View more

PBR is supported on ASA beginning in release 9.4. So your version of code does not have this support.   HTH   Rick ... View more

Having thought a bit more about this post I realize that there is something that we do not know about this environment and it could be quite significant. We do not know whether this 3750 has ip routing enabled and is providing the layer 3 routing for these vlans or whether this 3750 is operating as a layer 2 switch and the layer 3 gateway is on some other device. Georg, Deepak, and I had assumed that the 3750 was routing for these subnets. If that is not the case then our advice needs to be revised. The helper-address needs to be configured on the device that is providing the layer 3 routing for 192.168.60.0 and 192.168.80.0.   HTH   Rick ... View more

Georg and Deepak have provided correct explanations about using helper-address. I would like to address another aspect of the original post. I note that the address of the DHCP server is different from the 2 vlans described on the switch. So the switch must have a route to subnet 192.168.75.0. And the router/switch where that subnet is must have routes to reach 192.168.60.0 and 192.168.80.0.   HTH   Rick ... View more

There are several things in the verbal description of this post that confuse me. It describes the network that sources the broadcast packets as 172.16.1.1 with destination of 172.16.255.255 which certainly suggests a net mask of 255.255.0.0. And it is not clear whether this network is on the same router or a different router from the network that is the destination.    The post then describes an ISR with this address on its WAN 172.16.1.26, 255.255.255.0.  That certainly overlaps with the network address given as the original source.   The partial config given is more consistent and easier to understand. So my response will focus on that part of the post. One thing thing that we need to bear in mind is that by default IP broadcast packets are intended to be local (the source and the destination are in the same subnet). So by default routers do not forward broadcasts from one subnet to a different subnet. But sometimes we want the broadcast to be forwarded to a different subnet. And the ip helper-address command is used to enable this. ip helper-address identifies a remote network/subnet to which a broadcast will be forwarded. So ip helper-address is configured on the router interface where the broadcasts are originated. This config does this on Gig0/0/0. If the helper address specifies the destination address as a broadcast address then on the router interface where the destination is located it must configure ip directed-broadcast to enable the receipt and forwarding of a directed broadcast. This config does this on vlan 100.   Those parts of the config are correct. But it is not working because of one factor which must be addressed. By default helper-address forwards broadcasts for certain protocols but not for all protocols. And udp 4002 is not one of those protocols that is helpered by default. So the configuration must include the ip forward-protocol udp 4002 command. See this link for additional details https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipapp/command/iap-cr-book/iap-i1.html#wp1776761080   HTH   Rick ... View more