Ip address assignment via DHCP for an anyconnect client

Unanswered Question
Jun 11th, 2008

Hi,


On my Asa(with asdm)i configured the DHCP server in the managment tab to allow dynamic Ip assignment for my lan devices (on the inside interface). I tried to allow Ip assignement via my Lan DHCP server for my VPN SSL client located on a remote site but it didn't work (they mount the tunnel on the outside interface of the Asa). I would have liked to know if someone could advise me to do so. When i checked the DHCP box in the different connection profiles my client still didn't receive any address. Are there anything i need to allow to perform this action. I hope someone can help.

PS: Here is the message i get when i start the Cisco anyconnect client:

"An error was received from the secure gateway in response to the vpn negociation request. Please contact your network administrator. The following message was received from the remote VPN device: No assigned Address"


Best regards.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
owillins Tue, 06/17/2008 - 12:03

The error message indicates that the ASA returned an HTTP error to the client when the client attempted to establish an SSL connection.

jeyriku Tue, 06/17/2008 - 13:14

I understand this To. But deeper, it means that my Lan DHCP server can't deliver IP address to my VPN SSL client. I don't understand why!! As long as you check the "DHCP" box it should work, but at the moment it doesn't. Can you help me?


Best Regards,



jeyriku Wed, 06/18/2008 - 06:27

Here is a copy of syslog entries which best describe what is happening:


"Device completed SSL handshake with client outside: X.X.X.X:XXXX"


"TunnelGroup GroupPolicy User IP No address available for SVC connection"


The SSL connection starts without problems, but as soon as i need to be assigned an ip address, it doesn't work. The odd thing is that in both profile the DHCP box is checked.


Can someone help?


Best regards

jeyriku Wed, 06/18/2008 - 06:45

Hi, here is what you asked me for:


"

webvpn

enable inside

enable outside

csd image disk0:/securedesktop-asa-3.2.1.103-k9.pkg

svc image disk0:/anyconnect-win-2.2.0128-k9.pkg 3

svc enable

cache

max-object-size 5000

group-policy DfltGrpPolicy attributes

dns-server value X.X.X.X

dhcp-network-scope X.X.X.X

vpn-tunnel-protocol IPSec l2tp-ipsec svc webvpn

default-domain value XXXXXX

intercept-dhcp 255.255.255.XXX enable

nac-settings value DfltGrpPolicy-nac-framework-create

webvpn

url-list value Lan_Applications

svc keepalive none

svc dpd-interval client none

svc dpd-interval gateway none

svc ask enable default webvpn

customization value DfltCustomization


tunnel-group DefaultRAGroup general-attributes

authentication-server-group (outside) LOCAL

authorization-server-group LOCAL

authorization-server-group (outside) LOCAL

dhcp-server XXX.XXX.XXX.XXX

tunnel-group DefaultWEBVPNGroup general-attributes

authentication-server-group (outside) LOCAL

authorization-server-group LOCAL

authorization-server-group (outside) LOCAL

dhcp-server XXX.XXX.XXX.XXX

authorization-required


Best Regards,


Jeyriku

Farrukh Haroon Wed, 06/18/2008 - 11:29

Do you have the following in your configuration:


"vpn-addr-assign dhcp"


Note: DHCP assignment is disabled by default


Regards


Farrukh

jeyriku Wed, 06/18/2008 - 12:41

Hi,


Many thanks for your response


No it doesn't appear but it should as i already typed it before

But the following appear:

"no vpn-addr-assign aaa

no vpn-addr-assign local"


Do you have an idea why it doesn't appear?


Best regards,

Farrukh Haroon Wed, 06/18/2008 - 17:49

No that is ok, it means AAA and LOCAL are now disabled, and DHCP is enabled.


Can you post more aggressive debugs?


Regads


Farrukh

jeyriku Wed, 06/18/2008 - 23:55

Hi,


Can you tell me what i need to do? What do you mean by "more agressive"?


kind Regards,

Farrukh Haroon Thu, 06/19/2008 - 00:03

I meant more detailed/verbose debugs, please attach the output of the following:


debug dhcpd event

debug dhcprelay event

debug webvpn tunnel

debug webvpn svc

debug webvpn html


Regards


Farrukh

jeyriku Thu, 06/19/2008 - 00:08

Ok,


I do that for you and will keep you updated.

Many thanks for your help.


Regards,

Farrukh Haroon Thu, 06/19/2008 - 01:50

The issue seems to be your DHCP server, check the DHCP server IP /scope once again. Also any logs on the DHCP server end.


7|Jun 19 2008 10:00:10|711001: Validating address: 0.0.0.0

7|Jun 19 2008 10:00:10|711001: CSTP state = WAIT_FOR_ADDRESS

7|Jun 19 2008 10:00:10|711001: webvpn_cstp_accept_address: 0.0.0.0/0.0.0.0

7|Jun 19 2008 10:00:10|711001: webvpn_cstp_accept_address: no address?!?

7|Jun 19 2008 10:00:10|711001: CSTP state = HAVE_AD


Regards


Farrukh

david.barroso Thu, 07/17/2008 - 06:51

Who is the DHCP server? If the DHCP server is the firewall itself it's not possible. The DHCP server must be another server directly attached to the firewall.

jeyriku Thu, 08/28/2008 - 01:07

Hi,


Many thanks for your answer and sorry for my delay.

In my configuration, The DHCP server is the FW itself. Do you konw why it can't Work?

Regards,

jeyriku Thu, 08/28/2008 - 03:50

Hi,


Do you mean by this that in theory it could be possible but this feature has not been implemented?

So what i did, i created a specific pool on my asa which has nothing to do with my LAN DHCP Range but i noticed that i could not assign a gateway to this pool. Can you confirm that i can't provide a gateway to this static pool. Imagine now that i begin to use this pool, how would i route the packet from this pool to my LAN scope or Internet, for example, without a default-route?


Regards,

Farrukh Haroon Thu, 08/28/2008 - 05:28

Yes its 'possible' for sure but not implemented.


Makes no sense (to me) actually, if you need to give IP from the ASA, why use the 'DHCP' option, just make a POOL on the ASA! You can assign the other common DHCP pushed options like dns server, domain etc. from the VPN group-policy anyway.


Regards


Farrukh

jeyriku Thu, 08/28/2008 - 06:06

Hi,


Many thanks for your answer. I understand what you mean. But if i create a pool, how can i manage to make the host, which has been assigned an ip from this pool, communicate with my lan devices as it will be in a different subnet. I didn't find a way to provide my new pool with a default gateway.


Best Regards

Farrukh Haroon Thu, 08/28/2008 - 06:22

You don't have to worry about that. If the LAN users don't know how to reach the VPN client pool you can add a route manually for the whole pool or you can use reverse route injection for that.


Regards


Farrukh

jeyriku Thu, 08/28/2008 - 23:35

Hi,


My lan subnet starts from 192.168.0.1 TO 192.168.0.14 255.255.255.240.

My dhcp scope in this subnet starts from .1 to .9; the last adresses are for manual assignment (.10 up to .14).

if i create a pool for my vpn ssl clients, does it have to be in a different subnet (for example (192.168.0.16 to 192.168.0.31 /28) or in the same LAN subnet?

I tried to create a pool of two addresses picked up from my current lan subnet (192.168.0.10 and 192.168.0.11), the original error message disappeared, and the vpn ssl connection was established. But if i do a ipconfig /all i realise that the default gateway for this pool is 192.168.0.9. Moreover, i can not access any application in my LAN. Can you tell me why? During the creation of this pool, asdm never asks me for a gateway to provide?

Otherwise if i need to create a static route i need to attach it to one of my interfaces outside, inside, dmz. Which one should i use?


Many thanks


Regards,

Farrukh Haroon Fri, 08/29/2008 - 11:06

You can make a pool from the same subnet as your inside interface, no issues with that. The default gateway you see is normal. The IP is used as the default gateway because all traffic has to come back to the ASA (VPN server). You don't need a default gateway in the pool.


How is your split tunneling policy?


Is the inside interface of the firewall reachable to your whole network? (The subnet which the pool is part of).


Regards


Farrukh

Actions

This Discussion