Cisco FTD Anyconnect DHCP

[Irakli Gvishiani]

Hello,

I would like to configure for Cisco Anyconnect DHCP Address Assignment from Windows DHCP Server. I Use this Manuals (https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/215854-configure-anyconnect-vpn-client-on-ftd.pdf), but nothing works. 

Are there any additional steps? 

[Irakli Gvishiani]

Version is 6.6.4

Do I need to disable this diagnostic feature after use (As it done on routers undebug all)?

[Rob Ingram]

@Irakli Gvishiani yes, run no capture CAPI

[Irakli Gvishiani]

Nothing matches

 

[Rob Ingram]

@Irakli Gvishiani perhaps this is not a DHCP issue, does the VPN actually connect if you used an IP pool? Check that first to confirm the user can connect, then go back to using DHCP.

[Irakli Gvishiani]

I Use 2 VPN Profile, first profile is configured with IP Pool and works fine. Second Profile is configured with DHCP, but ... 

[Rob Ingram]

@Irakli Gvishiani ok but that doesnt prove there isn't another issue with that second profile, can you test just to confirm it does work with an IP pool.

From the CLI of the FTD, can you also provide the output of "show tunnel-group <NAME" and "show group-policy <NAME>"

[Irakli Gvishiani]

Yes, I confirm that with IP Pool Second Profile also works fine. 

 

Show commands output:

 

 

[Rob Ingram]

@Irakli Gvishiani what is the configuration of your split tunnel ACL? I assume the DHCP server is being tunneled?

[Irakli Gvishiani]

Yes, of course 

[Rob Ingram]

@Irakli Gvishiani I haven't been able replicate your issue, it just works.

If you run "debug webvpn 255" under "system support diagnostic-cli", this may provide a clue.

The apparent only difference is I am running version 7, I also do not have the helper-address configured on my VLAN connecting the core to the FTD. Perhaps raise a TAC call?

[sadist001]

Yes, I think it's time for TAC.

Thanks for your time! 

[MHM Cisco World]

Friend last point, 

check by Wireshark the DHCP request "if it send as unicast" use IP source as Inside ip or management ip address.

[Irakli Gvishiani]

DHCP Server don't receive any DHCP-Packets from FTD

[MHM Cisco World]

Hi Friend, sorry for late reply,
do you solve this issue?

[Irakli Gvishiani]

Hello,

Not yet