5

I've got a pool of IP's tied to an SSLVPN connection profile that I need to expand. Currently this is:

ip local pool LDAPTESTPOOL 192.168.245.101-192.168.245.110 mask 255.255.255.0

Could I just overwrite this command with:

ip local pool LDAPTESTPOOL 192.168.245.101-192.168.245.150 mask 255.255.255.0

Without impacting users already connected to the connection profile that uses this pool? Thanks in advance!

Improve this question
5
  • if by overwrite you mean delete and re-add, maybe. the system will lose any state it had for the pool in the process. the next person to login could (read: most likely will) step on an existing connection.
    – Ricky
    Oct 1, 2013 at 20:39
  • I don't mean delete and re-add, I intended to go into conf T and paste the second line. Wouldn't that work? Are you 100% positive I'd have to 'no' the current pool to input the second line?
    – A L
    Oct 1, 2013 at 21:37
  • ASA: overwrite works (at least with 8.2.5) IOS: pool must not exist
    – Ricky
    Oct 2, 2013 at 0:41
  • Do you have a specific need to expand the pool? Can you create a new pool with a different subnet and make it the default pool? This way, any new clients will be given IPs from the new pool.
    – AdnanG
    Oct 2, 2013 at 4:24
  • Ricky thanks for the differences to note between ASA and IOS, I did what I proposed on an ASA running 8.2 and it worked fine, no loss of connectivity at all. I would mark your answer correct but I don't seem do be able to!
    – A L
    Oct 3, 2013 at 15:50

2 Answers 2

Reset to default
3

Since you're not changing the netmask or default gateway I'd expect this not to be a problem at all, but I don't have the means to test this right now.

Improve this answer
1
  • Yup, you were right, and what I was suggesting was correct.
    – A L
    Oct 3, 2013 at 15:49
0

There is an option to resolve IP conflicts between clients on Cisco IOS. It needs to be configured carefully. from this source:

Configuring a DHCP Database Agent or Disabling Conflict Logging

Perform this task to configure a DHCP database agent.

Database Agents

A DHCP database agent is any host (for example, an FTP, TFTP, or rcp server) or storage media on the DHCP server (for example, disk0) that stores the DHCP bindings database. You can configure multiple DHCP database agents, and you can configure the interval between database updates and transfers for each agent. Automatic bindings are IP addresses that have been automatically mapped to the MAC addresses of hosts that are found in the DHCP database. Automatic binding information (such as lease expiration date and time, interface index, and VPN routing and forwarding [VRF] name) is stored on a database agent. The bindings are saved as text records for easy maintenance.
Address Conflicts

An address conflict occurs when two hosts use the same IP address. During address assignment, DHCP checks for conflicts using ping and gratuitous Address Resolution Protocol (ARP). If a conflict is detected, the address is removed from the pool. The address will not be assigned until the administrator resolves the conflict.
Restrictions

We strongly recommend using database agents. However, the Cisco IOS server can run without them. If you choose not to configure a DHCP database agent, disable the recording of DHCP address conflicts on the DHCP server by using the no ip dhcp conflict logging command in global configuration mode. If there is conflict logging but no database agent configured, bindings are lost across router reboots. Possible false conflicts can occur causing the address to be removed from the address pool until the network administrator intervenes.

If you have the conflict resolution configuration in place, the device will chack if the IP address is already assigned to another client or not. Also, If the clients are already assigned an IP and the DHCP for some reason stops, the client will continue to communicate normally before the renew period expires. So in case you reconfiguration affects the DHCP, you clients that already have an IP will not be affected. The new ones will get the IP from the new pool after the conflict test is passed.

However, if your setup is critical, I strongly advise you to do a test of this scenarion on a spare router before implementing it on a live system. Also try to find a low traffic period for your change.

Improve this answer
1
  • This is good info, but not related to my Q (for reference to anyone reading through this later).
    – A L
    Oct 3, 2013 at 15:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.