I'm having a weird problem with my ASA. Every few days the internet connectivity fails (f.e. cannot ping wan ip addresses from the ASA). Problem resolves by forcibly rebinding the DHCP by no ip address dhcp setroute and enabling again with ip address dhcp setroute or as an alternative by reloading the ASA. After this the ip that ISP DHCP allocates to the ASA usually does not change but it seems the traffic is blocked if lease is not rebinded or renewed properly. How would I troubleshoot this issue? Are there any specific option for the DHCP client in ASA which I could try to change. This issue is getting annoying.

How would I start troubleshooting this. Is there some detailed logging option for logging the DHCP client events on the ASA?

1 Answer 1


A dhcp client will start renewal after half the lease time has expired, and it will repeat renewal attempts at decreasing intervals. If renewal eventually fails (for whatever reason), the DHCP client will take down the ip address and all it learned from the previous DHCP transaction, and start over.

What output do you get from show ip address dhcp as in the command reference ?

Check for dates/times of the beginning of the current lease, then around the half of the lease time, start looking at the outputs of the debug dhcpc ... commands to see if renewal is struggling.

The initial DHCP transaction (DISCOVER, OFFER, REQUEST, ACK) is partially broadcast based, and can/must be helped with DHCP relay features on the first upstream hop routing device, if the DHCP server is not actually on the given subnet/broadcast domain.

On the other hand, lease renewal happens with a direct unicast request to the DHCP server of the given lease, bypassing any relay. Any routing or traffic filtering features between DHCP client and server have to account for unicast DHCP transactions, too, not just broadcast based ones.

  • Hi! I get the following output from the sh ip address wan dhcp lease: Temp IP addr: x.x.x.x for peer on Interface: wan Temp subnet mask: DHCP Lease server: y.y.y.y, state: 3 Bound DHCP transaction id: 0x2461BFBE Lease: 43200 secs, Renewal: 21600 secs, Rebind: 37800 secs Temp default-gateway addr: z.z.z.z Next timer fires after: 3422 seconds Retry count: 0 Client-ID: cisco-00a3.8e58.f5c3-wan-asa Proxy: FALSE Hostname: asa Commented Nov 14, 2023 at 16:09
  • I'll watch the dhcp debug log out to try to see what could be the problem, I'll be back after the problem re-occurs. Is it possible to make the ASA log those debug messages to file instead of just the serial console? Commented Nov 14, 2023 at 16:12
  • please add output of sh ip address wan dhcp lease to your original question, using the {} brackets formatting. It will be a lot more readable. ASA's don't usually log to a file directly - a syslog server might help - even very simple/small one will do. Commented Nov 15, 2023 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.