Cisco PIX501 DHCP Problems

Posted on 2008-11-19
Last Modified: 2012-05-05
We are using a Cisco PIX501 in a 30+ user environment with SBS2003.

SBS2003 is the DNS server and the PIX is the DHCP server.

Problem we're having, which started about a week ago, is that when a client computer gets their address through DHCP they cannot ping the internal IP of the PIX and therefore cannot access the internet. The settings they get via the DHCP server are all set ok.

What I've noticed:
If I manually assign the IP address to the comp using the same address I've gotten via DHCP the problem is still there. If I assign a static address that's not the same and quite a bit higher (but still within the DHCP Pool) then I can ping the PIX and get WAN connection fine.

I.E. won't work but will work and the DHCP Pool is -

Any ideas?  Nothing inside the PIX looked unusual (logs, firewall settings, etc.)... I did unplug the PIX to reboot as well as refreshed config settings.
Question by:Tercestisi
    LVL 2

    Accepted Solution

    Can you post the running config for the pix501. I've got the same pix device and never had any problems. I believe though that the pix can only issue 50 DHCP addresses. (maybe that was an earlier version of the fireware but i think mine would only give out 50 DHCP addresses.

    Heres a couple of things to check:
    Are they any access points or wireless routers that could be handing out DHCP and screwing up your DHCP from the pix? I've had this happen before especially when using cheap linksys wireless routers, a power outage has reset some of them before and they would end up giving out DHCP

    Also might want to look into allowing SBS'03 to give out DHCP instead of the Pix. Sometimes thats easier to configure, especially if you don't have Cisco config experience. Really depends on your skill level.

    Also could be a subnetting problem. Unlikely but make sure the IP addresses are in the correct subnet and there isnt some werid subnetting going on.
    LVL 14

    Assisted Solution

    I would move your DHCP to the server and remove it from the PiX.  SBS DHCP options offer you more options for DHCP and helps to better integrate with DNS on the server.  It will take less then 15 minutes to implement and I am sure you will be happy you did.

    Author Comment

    Thanks for the insights guys.

    I am admittedly a little green in the Cisco arena, VPN IPSec policies specifically.

    I see from looking in the pix that there is an IPSec rule that is likely causing the problem (from GUI):
    #1 protect ip inside:dynamic-20
    #1 protect outside:any ip inside:dynamic-20

    The is remote office network and the are addresses on our network and are part of the - DHCP address pool.

    Those internal addresses in the IPSec rules show a range of - which happens to be the addresses that do not work if assigned via DHCP. Can someone explain what these rules mean and that the IPSec Rules in general mean? I Googled but didn't find much that really explains what is going on here.

    Author Comment

    Oh, and I will take into strong consideration the moving of the DHCP server role to SBS03.

    I'm just curious as to what those rules mean?  A previous admin set those up with a sister company and I'm not familiar enough with site-to-site IPSec protected VPN tunnels.

    Featured Post

    Threat Intelligence Starter Resources

    Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

    Join & Write a Comment

    There are times where you would like to have access to information that is only available from a different network. This network could be down the hall, or across country. If each of the network sites have access to the internet, you can create a ne…
    Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    729 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    24 Experts available now in Live!

    Get 1:1 Help Now