DHCP Relay over SDWAN issue

MoAb123 — Tue, 09 Dec 2025 17:22:08 GMT

Hello all,

DHCP relay is configured on the firewall over SDWAN the device acquire the IP normally but after some days it stop working and need to clear the session so any device can acquire an IP.

The DHCP relay was working fine before implanting the SDWAN no issues at all but after the integration of SDWAN the issue start so what could be wrong which led to this behavior.

PA-410> show session all filter application dhcp

--------------------------------------------------------------------------------
ID          Application    State   Type Flag  Src[Sport]/Zone/Proto (translated IP[Port])
Vsys                                          Dst[Dport]/Zone (translated IP[Port])
--------------------------------------------------------------------------------
16250        dhcp           ACTIVE  FLOW       172.16.12.1[67]/LAN/17  (172.16.12.1[67])
vsys1                                          192.168.3.200[67]/zone-to-hub  (192.168.3.200[67])
14499        dhcp           ACTIVE  FLOW       172.16.12.1[67]/LAN/17  (172.16.12.1[67])
vsys1                                          192.168.0.200[67]/zone-to-hub  (192.168.0.200[67])

no discard state but DHCP sessions seem to be stuck in the firewall, and that these sessions have been active for more than 6 hours.

 PA-410 > show session id 16250

Session           16250

        c2s flow:
                source:      172.16.12.1 [LAN]
                dst:         192.168.3.200
                proto:       17
                sport:       67              dport:      67
                state:       ACTIVE          type:       FLOW
                src user:    unknown
                dst user:    unknown
                fwd cache:   {FIB} cached
                        fib: 12587 hit(s), 93 miss(es)
                sdwan rule:  N/A             path:       tunnel.915
                sdwan FEC:   Unknown

        s2c flow:
                source:      192.168.3.200 [zone-to-hub]
                dst:         172.16.12.1
                proto:       17
                sport:       67              dport:      67
                state:       ACTIVE          type:       FLOW
                src user:    unknown
                dst user:    unknown
                sdwan rule:  N/A             path:       [N/A]

        start time                           : Mon Dec  8 08:03:13 2025
        timeout                              : 30 sec
        time to live                         : 28 sec
        total byte count(c2s)                : 4126161
        total byte count(s2c)                : 32774
        layer7 packet count(c2s)             : 11919
        layer7 packet count(s2c)             : 93
        vsys                                 : vsys1
        application                          : dhcp
        rule                                 : ACCESS  
        service timeout override(index)      : False
        session to be logged at end          : True
        session in session ager              : True
        session updated by HA peer           : False
        software fast forwarding             : False
        layer7 processing                    : enabled
        ctd version                          : 3

PAN-OS 11.1.10-h1
SDWAN plugin version 3.2.3-h2

Re: DHCP Relay over SDWAN issue

SamirAhemed — Sat, 31 Jan 2026 11:08:31 GMT

This is known behaviour, Its get trigger only when there is changes in routing/Forwarding of traffic.
UDP session is not automatic get clear once there is any routing change.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HBmqCAG
enable "set session teardown-upon-fwd-zonechange yes" will help

topic Re: DHCP Relay over SDWAN issue in Advanced SD-WAN for NGFW Discussions

DHCP Relay over SDWAN issue

Re: DHCP Relay over SDWAN issue