Thanks for replying.

I've never managed to get DHCP relay working through a site-to-site VPN when the PIX/ASA does the relay (it works fine if the clients are plugged into a layer3 switch which does it).  Like I said, other people have posted "solutions" which add the inside and outside addresses into the cryptomap ACL but they have obviously never tested that it works (because of the ARP issue).  So, when I saw your article I got two brand new ASAs and set up a lab to prove that your solution does in fact work.

Since we have a mixture of PIX 515e and ASA, I chose to use 8.0(4) in the lab as it is a common version.  The only difference is that originally it wouldn't work, and it was only after reading the comment about whether your NATs were backwards that I realised I had setup my firewalls as outside-to-outside (so DHCP server on inside interface of the remote firewall).  I flipped the NATs so they became:

static (outside,inside) 10.150.1.6 10.252.17.6 netmask 255.255.255.255

static (outside,inside) 10.150.1.0 10.150.1.0 netmask 255.255.255.0

and this works perfectly...the ARP and dhcprelay debugs match your article exactly.

However, if you upgrade the ASA to 8.3(2) and let it upgrade the startup-config to the new NAT types, it does not work as you get UDP /67 drops (in red on ASDM, so are not ACL drops).

All I want is to get this working using 8.3(2) as it is inevitable that we will have to replace our PIXs with ASA and use versions above 8.3 for security patches, new features etc.

Thanks,

Stuart

PS the firewalls are all covered by a service contract, so I *can* open a TAC case, but I just thought you might have this solution to hand.