I guess my question is just too difficult for everyone

Question

I am trying to modify my configuration to be more robust and cover some scenarios I have not previously thought about. My device is a cisco pix 525 with ios 8 on it.
I have a basic configuration, the cable box comes into the house and the pix outside interface is plugged into that. The inside interface plugs into a ethernet switch, and the rest of the network plugs into the switch.under this current setup, I have 3 remote access groups. the first one is a full tunnel group, the second is a split tunnel, and the third one is web only traffic for secure browsng when I am not home.
DHCP is setup and all inside hosts can talk to the outside hosts passing full traffic both ways and vice versa, the outside hosts on the full and split tunnel can talk to the inside hosts with full traffic.
The IP layout is as follows: 10.1.1.x is for the inside hosts, 10.1.2 is for full tunnel, 10.1.3 is for split tunnel, 10.1.1.4 is for web only.
Here is my goal with questions:
The goal is to setup a second network(a small lab) which will allow guests etc to connect to my network but not hit anything outside of that subnet, while the inside hosts can still talk to all hosts on the 10.1.5. subnet
I can plug a switch into the ethernet2 nic, and have everything on ethernet2 get an ip range of 10.1.5.x?
Can I configure a new vpn group that also allows anyone connected to it to only see hosts in 10.1.5.x?
Can I set it up so that anything on 10.1.1.x, 10.1.2.x and 10.1.3.x can have access to the hosts in 10.1.5.x but not allow it the other way around?
The outside VPN access is working fine. it leases a 10.1.5.x address to remote hosts connecting in. what I can not seem to get at this point is the second network DHCP part working. The interface is on and turned up. When I plug anything into the NIC card it just sits there trying to get an IP and then ultimately fails.
The config script I ran before this has the following:
configure terminal
interface ethernet0
nameif outside
ip address dhcp setroute
no shutdown
exit
dns domain-lookup inside
dns domain-lookup outside
dns name-server 8.8.8.8
dns name-server 8.8.4.4
dhcpd address 10.1.1.50-10.1.1.254 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd enable inside
nat-control
global (outside) 101 interface
nat (inside) 101 10.0.0.0 255.0.0.0
access-list ThcInside-nat0 extended permit ip 10.1.1.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list ThcInside-nat0 extended permit ip 10.1.1.0 255.255.255.0 10.1.3.0 255.255.255.0
nat (inside) 0 access-list ThcInside-nat0
same-security-traffic permit intra-interface
object-group icmp-type ICMPObject
icmp-object echo-reply
icmp-object source-quench
icmp-object time-exceeded
icmp-object unreachable
access-list outside_access_in extended permit icmp any any object-group ICMPObject
access-group outside_access_in in interface outside
http server enable
http 10.0.0.0 255.0.0.0 inside
logging asdm informational
no asdm history enable
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes-256
isakmp policy 1 hash sha
isakmp policy 1 group 2
isakmp policy 1 lifetime 43200
isakmp enable outside
crypto isakmp nat-traversal 30
policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error
exit
exit
username blahblah password blahblah
crypto ipsec transform THCTransformSet esp-aes-256 esp-sha-hmac
My additions to try to get my objective working are as follows:
interface ethernet2
nameif lab
ip address 10.1.5.1 255.255.255.0
no shutdown
exit
dns domain-lookup lab
nat (lab) 0 access-list ThcInside-nat0
nat (lab) 101 10.0.0.0 255.0.0.0
dhcpd address 10.1.5.2-10.1.5.254 lab
dhcpd dns 8.8.8.8 10.1.1.1 interface lab
dhcpd enable lab
http 10.0.0.0 255.0.0.0 lab
access-list ThcInside-nat0 extended permit ip 10.1.1.0 255.255.255.0 10.1.5.0 255.255.255.0
nat (outside) 101 10.1.5.0 255.255.255.0
ip local pool ThcIPLabOnlyTunnelPool 10.1.5.1-10.1.5.254 mask 255.255.255.0
group-policy THCLabOnlyTunnel internal
group-policy THCLabOnlyTunnel attributes
 dns-server value 8.8.8.8 8.8.4.4
 wins-server value 10.1.1.3
 vpn-tunnel-protocol IPSec
 split-tunnel-policy tunnelall
tunnel-group THCLabOnlyTunnel type ipsec-ra
tunnel-group THCLabOnlyTunnel general-attributes
 address-pool ThcIPLAbOnlyTunnelPool
 default-group-policy THCLabOnlyTunnel
 tunnel-group THCLabOnlyTunnel ipsec-attributes
 pre-shared-key blahblah
crypto dynamic-map THCDynamicMap 1 set transform-set THCTransformSet
crypto dynamic-map THCDynamicMap 1 set reverse-route
crypto map THCCryptoMap 1 ipsec-isakmp dynamic THCDynamicMap
crypto map THCCryptoMap interface lab
Thanks,
Jeff

Answer 1

I think you're saying you're having trouble with getting DHCP to work on the lab interface.
Have you tried shrinking your ThcIPLabOnlyTunnelPool and the DHCP address space so they don't overlap? I'm not an expert on PIX DHCP but I doubt the local pool and DHCP database are synching data so that they know not to assign addresses already in use.
Did you run wireshark on a client connected to the lab interface? Debug DHCP on the PIX?