Connecting to local LAN with internal DHCP server (ASA 5505, anyconnect)

[kevinhuntly]

Hi Everyone,

I recently configured my ASA to use my internal DHCP server to hand out addresses instead of the local DHCP pool that I had originally created. The issue is that when I'm using the DHCP server to hand out the address I can't access any internal resources. If I use the pre-configured VPN DHCP pool on the ASA, everything works fine. Note that the same NAT rules apply (I'm using the same address space)

[balaji.bandi]

Please post the configuration before and after the change( Local DHCP config and remote DHCP Server configs)

here is the configuration example with highlighted information :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/109493-asa-vpn-dhcp-asdm-config.html

[kevinhuntly]

before: https://pastebin.com/3BeiTcW7 

after: https://pastebin.com/vVidumEy

[balaji.bandi]

Thank you for the information, did the VPN users get IP addresses from the DHCP pool? after changing?

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/118084-configure-anyconnect-00.html

how come this configuration changed from Trunk to only vlan 1  ? is this intent of your case ?

interface Ethernet0/1
switchport access vlan 1

[Sheraz.Salim]

I noted you trying to do a DHCP proxy  RFC 3011 and RFC 3527. please have sure your ASA can reach the DHCP server. also i belive you have define your DHCP external server ip address in your tunnel group policy. cisco already release a document with this problem.

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/118084-configure-anyconnect-00.html

[kevinhuntly]

Users are able to get addresses from the internal DHCP server, they just can't access any LAN resources. Internet access is fine.

The DHCP scope the users are in is part of VLAN40 on the router/switch, not sure if that makes a difference.