Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

DHCP Relay via Site to Site VPN between a ASA5505 and Fortigate

Hello,

       Here is my setup: I have a ASA5505 at a client's site with 2 vlans and a Fortigate 310B at the corporate office. I have created a Site to Site IPSec tunnel between both sites. I want the PC's in the VLAN 3 named villong to be able to use the DHCP server at the corporate office through the VPN tunnel. For some reason it is not working properly. When I do a debug dhcprelay I get the following:

DHCPRA: relay binding created for client 001c.238c.5712.

DHCPD: setting giaddr to 10.8.35.1.

dhcpd_forward_request: request from 001c.238c.5712 forwarded to 10.20.0.77.

DHCPRA: Received a BOOTREPLY from interface 2

DHCPRA: relay binding found for client 001c.238c.5712.

DHCPRA: Adding rule to allow client to respond using offered address 10.8.35.33

DHCPRA: forwarding reply to client 001c.238c.5712.

I can see that the DHCP server is offering 10.8.35.33, which is good, but the PC does not seem to be able to respond. Here is my ASA config at the client site:

ASA Version 8.2(2)
!
hostname ASAClient

domain-name default.domain.invalid
enable password XXXXX encrypted
passwd XXXXX encrypted
!
interface Vlan1
nameif inside
security-level 100
ip address 172.20.0.59 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 1.1.1.1 255.255.255.240
!
interface Vlan3
description Reseau villong
no forward interface Vlan1
nameif villong
security-level 100
ip address 10.8.35.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
switchport access vlan 3
!
interface Ethernet0/7
switchport access vlan 3
!
boot system disk0:/asa822-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns server-group DefaultDNS
domain-name default.domain.invalid
access-list inside_access_in extended permit ip any any
access-list inside_1_cryptomap extended permit ip 172.20.0.0 255.255.255.0 any
access-list inside_1_cryptomap extended permit ip 10.8.35.0 255.255.255.0 any
access-list inside_1_cryptomap extended permit ip host 1.1.1.1 host 10.20.0.77
access-list inside_nat0_outbound extended permit ip 172.20.0.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 10.8.35.0 255.255.255.0 any
access-list outside_access_in extended permit ip any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu villong 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
icmp permit any outside
icmp permit any villong
asdm image disk0:/asdm-625.bin
no asdm history enable
arp timeout 14400
nat (inside) 0 access-list inside_access_in
nat (villong) 0 access-list inside_access_in
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
access-group inside_access_in in interface villong
route outside 0.0.0.0 0.0.0.0 1.1.1.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication enable console LOCAL
aaa authentication ssh console LOCAL
aaa authorization command LOCAL
http server enable
http 172.20.0.0 255.255.255.0 inside
http 10.0.0.0 255.0.0.0 villong
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set 3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 86400
crypto ipsec security-association lifetime kilobytes 4608000
crypto map inside_map 1 match address inside_1_cryptomap
crypto map inside_map 1 set pfs
crypto map inside_map 1 set peer 199.1.1.1
crypto map inside_map 1 set transform-set 3DES-SHA
crypto map inside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 172.20.0.0 255.255.255.0 inside
ssh 10.8.35.0 255.255.255.0 villong
ssh timeout 30
ssh version 2
console timeout 0
dhcpd auto_config outside
!
dhcprelay server 10.20.0.77 outside
dhcprelay enable villong
dhcprelay setroute villong
dhcprelay timeout 60

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password XXXXXXX encrypted privilege 15
tunnel-group 199.1.1.1 type ipsec-l2l
tunnel-group 199.1.1.1 ipsec-attributes
pre-shared-key

!

            

I have also put the Fortigate configuration if it can help but the problem seems to be on the ASA side.

Fortigate Configuration:

config vpn ipsec phase1
    edit "VPN_GLX_IPSEC"
       set interface "port8"
       set dhgrp 2
       set keylife 86400
       set proposal 3des-sha1
       set remote-gw 1.1.1.1
       set psksecret ENC XXXXXXX
    next

config vpn ipsec phase2
    edit "VPN_GLX_P2"
        set keepalive enable
        set phase1name "VPN_GLX_IPSEC"
        set proposal 3des-sha1
        set dhgrp 2
        set dst-subnet 172.20.0.0 255.255.255.0
        set keylifeseconds 86400
    next
    edit "VPN_GLX_P22"
        set keepalive enable
        set phase1name "VPN_GLX_IPSEC"
        set proposal 3des-sha1
        set dhgrp 2
        set dst-subnet 10.8.35.0 255.255.255.0
        set keylifeseconds 86400
    next
    edit "VPN_GLX_P23"
        set dst-addr-type ip
        set keepalive enable
        set phase1name "VPN_GLX_IPSEC"
        set proposal 3des-sha1
        set src-addr-type ip
        set dhgrp 2
        set dst-start-ip 1.1.1.1
        set keylifeseconds 86400
        set src-start-ip 10.20.0.77
    next

config firewall policy
    edit 427
        set srcintf "port1"
        set dstintf "port8"
            set srcaddr "10.20.0.77/32"            
            set dstaddr "NAT_VPN_Groupe_Leroux"            
        set action ipsec
        set schedule "always"
            set service "ANY"            
        set logtraffic enable
        set label "Clients"
        set inbound enable
        set outbound enable
        set natinbound enable
        set vpntunnel "VPN_GLX_IPSEC"
    next
    edit 428
        set srcintf "port1"
        set dstintf "port8"
            set srcaddr "10.0.0.0/8"            
            set dstaddr "VPN_Leroux_Ville_IPSec"            
        set action ipsec
        set schedule "always"
            set service "ANY"            
        set logtraffic enable
        set label "Clients"
        set inbound enable
        set outbound enable
        set vpntunnel "VPN_GLX_IPSEC"
    next
    edit 429
        set srcintf "port1"
        set dstintf "port8"
            set srcaddr "SecureGateway"            
            set dstaddr "VPN_VIP_Leroux"            
        set action ipsec
        set schedule "always"
            set service "Citrix_ICA" "PING" "HTTP_HTTPS"            
        set logtraffic enable
        set label "Clients"
        set inbound enable
        set outbound enable
        set natinbound enable
        set vpntunnel "VPN_GLX_IPSEC"
    next
    edit 436
        set srcintf "port1"
        set dstintf "port8"
            set srcaddr "SVMGOWEBP"            
            set dstaddr "VPN_VIP_Leroux"            
        set action ipsec
        set schedule "always"
            set service "PING" "HTTP"            
        set logtraffic enable
        set label "Clients"
        set inbound enable
        set outbound enable
        set natinbound enable
        set vpntunnel "VPN_GLX_IPSEC"
    next

config firewall vip
    edit "VPN_VIP_Leroux"
        set extip 10.8.18.1-10.8.18.254
        set extintf "port1"
        set mappedip 172.20.0.1-172.20.0.254
    next

config firewall address
    edit "VPN_Leroux_Ville_IPSec"
        set subnet 10.8.35.0 255.255.255.0
    next

Any ideas ?

Daniel

1877
Views
0
Helpful
0
Replies
CreatePlease to create content