Using msft dhcp server for anyconnect dhcpools "pro/con, don't do it?"

[tryingtofixit]

What is the consensus here about using msft dhcp server to assign out IP's for anyconnect? Read several threads here that don't paint it in a super positive light and several issues.  I have the need for 1 group of AD users to get their own subnet as I outlined in an earlier post.  using radius vendor codes and dhcp pool create on the Asa was a simple solution for that. 

Now that I shift over to "possible" use of msft dhcp. How would this compilate things?  I don't have 10 different AD groups that need 10 different subnets.   Just two groups our main group and our "special" group. special group might expand to a max of maybe 3.   

When moving to msft for dhcp anyconnect pools am I now inviting having multiple anyconnect local XML profile on the client side and on the ASA?  Can dhcp with msft dhcp server be done using radius, I really don't want to go down the LDAP road. 

Thanks 

[MHM Cisco World]

but I think I answer you, did you try use cert.-map ?

and for external DHCP it OK there is no problem.

MHM

[tryingtofixit]

Thanks for the reply.

I can't give out certs to only specific users, that over complicates things. We already use AA and machine certs for auth now. 

But as i have read, you can't reserve anyconnect IP's in msft dhcp due to their extremely long mac address. below is a tread on that.

Re: assign dhcp pools for anyconnect based on AD group via radius - Cisco Community

Thanks

[tryingtofixit]

Is using external dhcp server limited to only physical interfaces?  so if my anyconnect is on the "outside" interface, I would have to configure dhcp relay on the "outside" interface?  sounds like a security risk to me if this is true. 

[stayd]

No, do not use any dhcp relay. DHCP relay is needed in case some phisical interface is connected to ethernet and you need to use vlans on ASA, so than you might need dhcp relay.

This is not rule for RA.

[Aref Alsouqi]

That's right, it's been my experience that you can't reserve IP addresses for AnyConnect clients, and the reason behind that is that the clients don't show their MAC addresses, instead what you get in the DHCP pool is combination of the MAC addresses with the clients identifiers which makes it unachievable. However, if you don't care about reserving the IP addresses then using MS DHCP server is absolutely a viable solution.

What you would need to do in that case is removing the local pool from the tunnel group config and replace it with the "dhcp-server" command, and then you would need to go into the interested group policy and define the DHCP scope, this applies only if you have multiple DHCP scopes but it is a best practice anyway.

tunnel-group < the tunnel group name > general-attributes
   no address-pool < the local pool name >
   dhcp-server < your MS DHCP server IP >

group-policy < the group policy name > attributes
   dhcp-network-scope < the scope subnet ID >

[tryingtofixit]

so I would have multiple group policies and tunne.-groups to match the pools.  

tunnel-group corpvpnusers

dhcp-server 1.1.1.1

group-policy corpvpnusers

dhcp-network-scope 192.168.200.0

Doing this would not require multiple anyconnect profile xml files on the workstation would it? guess I am missing how each tunnel group IP's are assigned to the users based on their Active Directory group. would this be done by radius?  tks

[Rob Ingram]

@tryingtofixit if you now want to use DHCP pools, then it is similar logic as per your other post that I responded to the other day. Use RADIUS, create the NPS policy to match on the AD group, then return the GP/dhcp scope unique to that AD group. You'd create multiple NPS policies matching on the different AD groups and returning a different value. If nothing is explicitly sent from the RADIUS server then the user would receive an IP address from the default settings (scope or pool) as configured under the tunnel-group or group-policy.

In NPS you'd have to configure the vendor specific attributes, Cisco's DHCP network scope attribute number is 61 https://www.cisco.com/c/en/us/td/docs/security/asa/asa92/asdm72/general/asa-general-asdm/aaa-radius.html using the link I provided in the other post as a starting point - https://integratingit.wordpress.com/2022/01/30/asa-vpn-ip-pool-assignment-using-radius/ set you set the "vendor assigned attribute number" to 61 instead of 217 (in that example).

I see no reason why you'd need unique anyconnect XML profiles, you can just match on conditions on the RADIUS server.

[stayd]

Use authorization profiles in ISE properly with radius attribute in advanced attributes settings:
CVPN3000/ASA/PIX7x-DHCP-Network-Scope =

BTW you can still use also CVPN3000/ASA/PIX7x-Address-Pools = attribute also in case of backup for situation when your ms dhcp ha is not available.

[Aref Alsouqi]

AnyConnect profiles wouldn't be required if the users have the drop down menu selection enabled, so they can select their right tunnel group, or, if the tunnel group attribute gets returned by the RADIUS server automatically based on the matched conditions such as an AD group as already mentioned by the others.

[tryingtofixit]

yes, trying 100% to avoid a user having to select their tunnel group. Multiple choices for users= multiple support problems!

[MHM Cisco World]

""Observe that, once certificate mapping is enabled, you do not need to choose tunnel-group anymore:""

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/116111-11611-config-double-authen-00.html#toc-hId--824429414

MHM

[Aref Alsouqi]

Then you can configure the RADIUS server to return the tunnel group attribute, in that case the users will be transparently landing into their tunnel group without any interaction from their side. Also, the tunnel group selection in this case can be disabled.

[stayd]

This is wrong, in such way ASA will generate wrong dhcp relay agent ip, instead of asa ip, it will put there ip dhcp-network-scope ip.

As result you will have problems with DORA process, O and A packets will be returned by MS DHCP back tu ip defined in dhcp-network-scope.

BTW it does not mather if it defined localy in ASA or get from radius attribute from ISE CVPN3000/ASA/PIX7x-DHCP-Network-Scope = X.Y.Z.0

X.Y.Z.0 is scope in MS DHCP network range = network id with .0

Use DHCP link-selection RFC 3527, beware DHCP subnet-selection RFC 3011 is not working with MS DHCP.

https://www.cisco.com/c/en/us/support/docs/security/anyconnect-secure-mobility-client/118084-configure-anyconnect-00.html

Simply said, your goal is getting your dhcp network scope to option 82, suoption 5 link selection work subnet 1.1.2.0, so RA clients will have ips like 1.1.2.1 and so on and you need in Relay agent IP address: IP your ASA facing to dhcp server (propably inside iface).

[Aref Alsouqi]

Thanks for pointing that out. Are you saying that the network scope address shouldn't be the subnet ID of the interested pool, but defined as an IP from within that subnet? For instance, if the pool we would like to get an IP from is 172.16.1.1-172.16.1.10 subnet mask 255.255.255.0, the network scope command should be configured with an IP from within that subnet rather than 0? From what I remember it would work with the subnet ID as well but I could be wrong so please keep me honest here.