can a cisco ASA be configured as a DHCP server for a VLAN on a subinterface? and route packets between VLANs?

Question

We are in the process of planning to phase out a Sonicwall tz205 in our office. i am hoping to replace it with a CISCO ASA 5516 specifically. We have three networks in house the main production network (LAN and Wireless) on one interface, a public wifi VLAN on a sub-interface on the same interface as the main network. and VOIP phones on a second interface.

My first question is if the ASA is capable of being a DHCP server for a sub interface (public WIFI), and the Phone networks? I have been unable to find any documentation answering this.

Second is the ASA 5516 capable of routing traffic between the phone network and the production network?

Answer 1

Yes, your ASA can act as a DHCP server, but the thing to remember is that this is not the primary purpose of the ASA and as such it doesn't perform it as well as a dedicated DHCP server. It can perform it well enough for your clients though. I am uncertain about the VOIPs as the documentation deals specifically with Cisco VOIPs.

This link is Cisco's guide to configuring DHCP on the 5500 ASA.

Personally speaking, I am not overly fond of how you are describing your new network. Typically I like to recommend that all of your devices connect to a switch and then that switch connect to your router (which I imagine is your edge router.)

Answer 2

You can do DHCP and Routing from vlan to vlan with an ASA5516. It's a little more complex with the rules and it doesn't do sub-interfaces like router on a stick. It's more like an SVI (switched virtual interface) of a layer 3 switch. An SVI is a fancy way of saying create a vlan, set the ip address of that vlan interface on the ASA or switch and use it as the gateway. Traffic is seperated on each port by vlan tags similar to the sub-interface idea (on a router the encapsulation dot1q command on a sub-interface is identifying the vlan tag to look for).

This below is beyond answering your question and I apologize if I'm butting in. Just trying to offer some advice.

If you plan to get an ASA5516 with firepower do your research. Its a complex venture. I just installed one for a school with 1500 people. Each feature requires a license/subscription. You'll need anyconnect vpn licenses if you want more than the 2 it comes with. If you want historical data you MUST have a VMWARE esxi server to load the Cisco created VM. No other virtual environment works. (Some have manipulated virtual box but I don't trust that in production personally). You use seperate rules to direct traffic to the firepower module. It's a VERY expensive and complex device for a 75 person business.

If i may make a suggestion, I personally suggest put some money into a router or a decent layer 3 switch to take the load off the sonic wall to start. An HP2930 (labeled Aruba now) may even do the job (no cisco routing protocols but most small business are static routes anyway). It extremely easy to program. I think the Cisco 2960x switch is now offering similar routing as well (you could check) Let the sonic wall manage in and out traffic only. For the money of that ASA you could put a layer 3 switch and route at each closet (and then buy a used car...lol) but it sounds like that's not necessary with 75 users and under 250 devices (I'm guessing). One layer 3 device should suffice. It would be your mixed core and distribution layer. You would plug your servers, wifi controller, phone system, etc... in it if you can. Your backbone devices basically. It would be a good start.

I'm not always brand partial but for non-network engineer types or I.T. folks that don't have the opportunity to get good with cmd line because they are so busy now days, the HPs enterprise grade procurve switches have a Web gui that's hard to beat. The 2920s now called 2930s have proven themselves in my opinion very well especially for the price.

Edit... I also agree with the comment above. If you can move dhcp to a windows server that will give you more control and more insight. If your AD server isn't a dedicated AD server you may run it from there. If you have an inside DNS server that could be a good place as well since your network ip helpers go there already.

Good luck

Fixitrod

HP Switch Selector

HP Aruba 2930f switch Datasheet

Answer 3

Yes cisco ASA firewall is feasible and compatible to configure as DHCP server for allocating ip address to Client dynamically . Here is the Configuration below ..

ASA(config)# dhcpd address 192.168.10.1-192.168.10.240 inside

ASA(config)# dhcpd dns 8.8 8.8

ASA(config)# dhcpd wins 8.8.8.8

ASA(config)# dhcpd lease 3000

ASA(config)# dhcpd domain example.com

ASA(config)# dhcpd enable inside