1

Equipment and soft:

  • Two Cisco ASA 5540, ASA ver. 9.1(7)32, active/standby failover
  • DHCP server: Windows server 2016

Anyconnect VPN clients get IP addresses from DHCP servers. Everything works properly until change active/standby ASA. Current VPN-connections still work, but new clients cannot get IP addresses. DHCP server logs:

IP address range of scope TEST_VPN is out of IP addresses.
There are no IP addresses available for lease in the scope or superscope "TEST_VPN".

Although there are a lot of unassigned IP addresses. After command Reconcile All Scopes on DHCP server it starts giving IP addresses again.

I would like failover to operate without any problems. What should I do?

closed as off-topic by Zac67, user36472, Ron Maupin Mar 28 at 13:25

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Zac67, Community, Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • You need to add your sanitized ASA configuration for us to help you. Servers are off topic on Network Engineering. – user36472 Mar 28 at 10:20
  • If Reconcile Scope helps you did run out of IP addresses - this is badly managed on Windows. Troubleshoot the issue on the server, off-topic here. – Zac67 Mar 28 at 10:23