Thanks for you reply Pieterh,   I got to the bottom of this. It appeared to be an issue with the CheckPoint sub-interface configuration (topology).   I have corrected it and everything is working as expected. I can now see unicast DHCP requests sourced from the dynamic WLC interface (as expected) and the the clients are getting IP addresses.   Thank you for your help.   ... View more

Thanks Pieterh,   The CheckPoint firewall is NOT my DHCP server.   The DHCP server is behind the firewall in completely different VLAN/subnet.   I have configured the DHCP server IP addresses in the dynamic interface configuration (WLC) from very begging.   The WLC should convert the boradcast DHCP request into the unicast DHCP requests using the DHCP servers (dynamic interface) as the destination and send the packet to the default gateway address (CheckPoint sub-interface) configured on the dynamic interface, unfortunately I can not see any packets hitting the CheckPoint sourced from the WLC dynamic interface.   I have tried to disable the DHCP proxy on WLC, unfortunately no luck.   How can I confirm if the WLC creates the unicast DHCP requests and sends it to the firewall?         ... View more

Thanks Pieterh,   I have seen that document and the diagram (Proxy Packet flow) already hence saying the DHCP requests must be sent from the L3 dynamic interface associated with my SSID.   10.32.25.126 is the CheckPoint VLAN sub-interface and it is stretched from CheckPoint across 2x Cisco switches (L2 VLAN) to the WLC.   The DHCP ip addresses are mentioned as Relay1 & Relay2 in debug.   Even though everything seems to be configured correctly, I can not see anything hitting the CheckPoint interface.   Can I source ping from the WLC?   I may need to fire-up WireShark to see exactly what is happening because if the DHCP requests are sourced from the Management WLC interface, the traffic won't be routed via the CheckPoint - it goes directly from the switch the DHCP server.          ... View more

I have enabled dhcp debugging on the WLC and I can see the controller is sending the DHCP requests to the CheckPoint L3 interface, unfortunately when I check the firewall's logs, I can't see anything getting there.   *DHCP Socket Task: Sep 09 14:11:47.365: 38:ca:da:d9:e4:bb DHCP sending REQUEST to 10.32.25.126 (len 350, port 13, vlan 165)   I believe since there is a point-to-point between the WLC and CheckPoint, the DHCP request will be send from WLC dynamic interface (not management).   What am I missing here?  ... View more

Thank you both for you suggestions.   The VLAN L3 interface only exist on the CheckPoint firewall and WLC, the VLAN is stretched between them across the Cisco switches as L2.   There is no L3 interface on the switch hence no need for "ip helper address".   My understanding is that when DHCP proxy is enabled, the WLC should convert my broadcast DHCP request sent by the client into unicast DHCP request (DHCP server IP address configured in WLC-L3 interface configuration).   The DHCP server doesn't live in the same VLAN, it is actually behind the firewall.   The DHCP proxy is enabled globally on WLC, within the dynamic interface configuration the options for ' DHCP Proxy Mode' are Global/Enable/Disable - are you saying I should completely disable the DHCP proxy per interface?   If the DHCP request is sourced from the management IP address of the WLC (not the L3 interface associated with the SSID), how will DHCP server know which pool should it assign a new IP address from? ... View more

Hi Ganesh,   Thanks for your reply.   Each arm in my deployment is made of 2x10GB logical channels so I believe that should be more that required.  I will leave it as it is then - in trunk mode.   Thanks for your help ... View more

Thanks for your answers all,   The reason I'm asking we have a F5 deployed in 2-arm mode.   There is external VLAN in DMZ via 1st-arm and internal VLAN in LAN via 2nd-arm. Interfaces are connected to Cisco 3750Xes switches. Currently interfaces on both ends are configured in trunk mode (VLAN tagging). I have recently been told those interfaces should be actually configured in access mode as only one VLAN travels via each link. I have configured it as a trunk for a future expansion so additional VLAN can be added without taking the current services down.   What is the good practice then? ... View more

Looks like it... Well it looks like my telnet should work as the ping works which confirms that there is no issues with NAT or routing. The only place I could be blocked is ACL but I can see ip any any is permited which inlcludes tcp telnet so it has to be the router which doesn't accept the connection. Anyway Jouni thatnk a lot for your help. May need to get one ASA to play with it so I can understand it better ... View more

Hi Jouni, The firewall is not being used for Internet connectivity at all. It just sits bitween two our LANs (10.0.0.0/8 and 172.16.0.0/16). I think it has been configured in that way for extra security. If you have placed the ACL entry by mistake the host wont be able to access the network because the is no default route nor static route for the subnet where the host sits nor static route for the host itself. Also because there is not default NAT/PAT in place you will have to remember to configure it every single time you allowing new host through the firewall. Don't ask me why it has been configured in tha way... is the packet-tracer a command build in into the ASA IOS?? I can see it... ... View more

Hi Jouni, The firewall has bee configured by 3rd company and it works without any issues. I'm just trying to enable telnet to one of the devices which sits behind the firewall and that is not working, 1. Yes - all my "route" configuration are with mask /32 and we have to add new route command every time when whe would like to allow new host thru the firewall 2. The device in front of ASA is not doing any Dynamic PAT. We have everything done on the ASA itself so I believe we will need double NAT static(inside,outside) and static (outside,inside). Is that mean my firewall is configured with statuc NAT rather thatn NAT control? ... View more

Jouni, I have removed the sensitive info by replacing it with XXX where XXX in one command is not the same address/name on the other. XXX# sh run : Saved : ASA Version 7.1(2) ! hostname XXX domain-name XXX enable password XXX encrypted names name... . . . name... ! interface Ethernet0/0 nameif inside security-level 100 ip address 10.25.32.225 255.255.255.252 ! interface Ethernet0/1 speed 100 duplex full nameif outside security-level 0 ip address 172.16.227.5 255.255.255.252 ! interface Management0/0 nameif management security-level 100 ip address 192.168.1.1 255.255.255.0 management-only ! passwd XXX encrypted ftp mode passive dns server-group DefaultDNS domain-name XXX access-list outisde_access_in ... . . . access-list outisde_access_in ... access-list inside_access_in extended permit ip any any log access-list inside_access_in extended permit icmp any any log pager lines 24 logging enable logging buffered alerts logging asdm informational mtu inside 1500 mtu outisde 1500 mtu management 1500 icmp permit any outside icmp permit any echo-reply outside icmp permit any traceroute outside asdm image disk0:/asdm512-k8.bin no asdm history enable arp timeout 14400 static (inside,outisde) XXX-NAT XXX netmask 255.255.255.255 . . . static (inside,outisde) XXX-NAT XXX netmask 255.255.255.255 static (outisde,inside) XXX-NAT XXX netmask 255.255.255.255 . . . static (outisde,inside) XXX-NAT XXX netmask 255.255.255.255 access-group inside_access_in in interface inside access-group outside_access_in in interface outside route inside XXX 255.255.255.255 XXX 1 . . . route inside XXX 255.255.255.255 XXX 1 route outisde XXX 255.255.255.255 XXX 1 . . . route outisde XXX 255.255.255.255 XXX 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00 timeout uauth 0:05:00 absolute username XXX password XXX encrypted aaa authentication telnet console LOCAL http server enable http XXX 255.255.255.255 inside http XXX 255.255.255.255 inside http XXX 255.255.255.255 inside http XXX 255.255.255.0 management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart telnet XXX 255.255.255.255 inside telnet XXX 255.255.255.255 inside telnet XXX 255.255.255.255 inside telnet XXX 255.255.255.255 inside telnet XXX 255.255.255.255 inside telnet timeout 5 ssh timeout 5 console timeout 0 dhcpd address 192.168.1.2-192.168.1.254 management dhcpd lease 3600 dhcpd ping_timeout 50 dhcpd enable management ! class-map inspection_default match default-inspection-traffic ! ! policy-map global_policy class inspection_default   inspect dns maximum-length 512   inspect ftp   inspect h323 h225   inspect h323 ras   inspect netbios   inspect rsh   inspect rtsp   inspect skinny   inspect esmtp   inspect sqlnet   inspect sunrpc   inspect tftp   inspect sip   inspect xdmcp   inspect icmp ! service-policy global_policy global tftp-server inside XXX XXX Cryptochecksum:XXX : end Is there sominht like dual NAT on the ASA firewalls? For example when I send ping from inside to outside I need static (inside,outisde) command. Fot the ping reply to come back to me do I need another NAT static(outside,inside)?? ... View more