0

As the title already states, I have a problem getting DHCPd working on the Cisco ASA5505 version 7.2 with ADSM 5.2 with the basic license. Its an older one I know, and every time I tend to forget how this machine works.

Anyway, I have 3 VLAN's outside/inside/dmz. inside to outside and vice versa is working and I have setup all necessary NAT and ACL entries 6 months ago and it works like a charm. However, for some reason I can't get the DMZ to work. I have used the packed tracer to figure out if I could access anything on the outside from the DMZ network, and that just seems to be working. But DHCP broadcast packets are dropped!

I'm using the DHCP server on the ASA and what I don't get is that when I enable this server, it doesn't work right away, but instead I need to open ACL entries (i think) allowing the DMZ interface to receive bootpc and bootps packets. The question is how?

The problem is that a broadcast doesn't have a destination per se, except of course the subnet its broadcasting on; lets say 192.168.50.0/24. But doing so, doesn't change a thing and packets are still dropped....

2 Answers 2

1

Few (unrelated) points:
- Look closely at the license - with most basic license you will see 'DMZ interface' in output of show ver , it means DMZ interface will be able to communicate ONLY with 'outside' destinations, not with other internal networks
- Have you looked at inspection ? It greatly depends on ASA OS version , but under default class-map where all the "inspection" statements reside, try to enter something like 'inspect bootp' or 'inspect dhcp' ...
HTH

2
  • Hey HTH, thnx for your quick reply :)
    – Johannes
    May 8, 2013 at 11:22
  • woeps... 5 minutes is short... I'm aware of the restrictions of the basic license. And as I said, when using the packet tracer no packets are dropped communicating with the outside world. However, when tracing bootps and bootpc message, it clearly shows these type of packets are (dropped by acl). No I did not check inspection, but I just did. First of all "Configuration->Global Objects->Inspect Maps" doesn't allow me to add other maps then the onces predefined. Also, there is no leaf for DHCP, so how to continue from here... btw. I'm not sure how class-maps and inspect truly work :(
    – Johannes
    May 8, 2013 at 11:29
1

It's not clear to me if your DMZ DHCP clients are getting addresses from the DHCP server. If they are not, have you confirmed with the Packet Capture Wizard, not sure if you have it in ASDM 5.2, that the DHCP discovery is arriving to the ASA? It will look something like 0.0.0.0.68 -> 255.255.255.255.67. I believe you will need at least UDP port 67 (BOOTPS) open on each of the ASA interfaces running the DHCP server. If the server is working it should then transceive the offer, request and acknowledgement.

Here is the link to a DHCP configuration from Cisco.

If your DHCP clients work, but you are not able to get outside, then you should check your NAT / PAT rules. Try this link for an example of how that is done.

3
  • Hi, thnx for your reply! No, the clients are not getting the dhcp lease addresses from the buildin dhcp server on the asa appliance. I've checked the packed tracer which states that they are dropped by an implicit ACL rule.. which is obvious. But then again, I remember that I got it to work without adding a ACL rule a few months ago. I am able to get to the outside, by using the packet tracer again. So NAT is working. I do not need to go to the inside interface from the DMZ. I did comfigure the DHCP server as stated in the cisco documentation though. Thus the problem here is the ACL rule. why?
    – Johannes
    May 8, 2013 at 11:59
  • Since there is not much response I thought to post a little of the dhcpd configuration: dhcp-client update dns server none dhcpd address 192.168.50.64-192.168.50.127 DMZ dhcpd dns 8.8.8.8 8.8.4.4 interface DMZ dhcpd lease 84600 interface DMZ dhcpd domain rigowifi.DMZ interface DMZ dhcpd option 3 ip 192.168.50.3 interface DMZ dhcpd enable DMZ
    – Johannes
    May 14, 2013 at 11:47
  • and the policymap configuration: policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect icmp inspect icmp error ! service-policy global_policy global
    – Johannes
    May 14, 2013 at 11:48

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .