Hello,
On this case there are various ways to troubleshoot this, firstly the configuration you have applied it's correctly configured, and I could notice you are using LDAP attribute mapping therefore the NoAccessGrpPolicy, go ahead and do the following:
* Make sure you can reach the DHCP server from the ASA with no issues (ICMP works fine for it)
* Once that is confirmed, you can go ahead and set up a local pool to make sure that the connectivity is fine, if the users connect with an Ip address given by the ASA, we will need to run debugs, to make sure what is going on:
DHCP debugs: This will show us error when negotiating with the DHCP server
debug dhcprelay error
debug dhcprelay event
debug dhcprelay packe
IPSec Debugs: This will show us any IPSec issue
debug crypto isakmp 7
debug crypto ipsec 7
on the clients side:
1) Client makes a UDP Broadcast to the server with a DHCPDiscover, or Discover packet.
The interface which is closer to the dhcp server(outside in our case) will intercept the request.
2) DHCP offers to the client. The server sends a DHCPOffer including other configuration parameters (DHCP Options) for the client per the servers configuration file
3) In response to the offer Client requests the server. The client replies DHCPRequest requesting the offered address. The DHCPRequest is a broadcast message not a unicast one, see packet #4 in the above captures. According to RFC2131 for DHCP, the reason why the request is broadcast is to implicitly decline offers from all other servers while requesting the IP assigned by one of the servers.
4) The server sends DHCPAck acknowledging the request which is the clients final permission to take the address as offered. Before sending the ack the server double checks that the offered address is still available, that the parameters match the clients request and (if so) marks the address taken.
* If you know and apply all of these we will be able to determine what the issue is.
* Take a look to these 2 links:
- https://supportforums.cisco.com/blog/149511
- http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/109493-asa-vpn-dhcp-asdm-config.html#configurationRAVPN
Please don't forget to rate and mark as correct the helpful Post!
Let me know how it works out
David Castro!
Regards,
