Equipment and soft:

  • Two Cisco ASA 5540, ASA ver. 9.1(7)32, active/standby failover
  • DHCP server: Windows server 2016

Anyconnect VPN clients get IP addresses from DHCP servers. Everything works properly until change active/standby ASA. Current VPN-connections still work, but new clients cannot get IP addresses. DHCP server logs:

IP address range of scope TEST_VPN is out of IP addresses.
There are no IP addresses available for lease in the scope or superscope "TEST_VPN".

Although there are a lot of unassigned IP addresses. After command Reconcile All Scopes on DHCP server it starts giving IP addresses again.

I would like failover to operate without any problems. What should I do?

  • You need to add your sanitized ASA configuration for us to help you. Servers are off topic on Network Engineering.
    – user36472
    Mar 28 '19 at 10:20
  • If Reconcile Scope helps you did run out of IP addresses - this is badly managed on Windows. Troubleshoot the issue on the server, off-topic here.
    – Zac67
    Mar 28 '19 at 10:23