topic Re: Migrating from Windows DHCP to Palo Alto in Next-Generation Firewall Discussions

Migrating from Windows DHCP to Palo Alto

ghughes — Mon, 30 Oct 2023 20:23:13 GMT

Good afternoon, all!

I'm planning to migrate from my current Windows DHCP servers to Palo Alto DHCP. I'm moving from Windows Server 2012 R2 to an HA pair of PA-850s running PanOS 10.1.9-h3.

Looking for traps, best practice, and any places to get bumped.

Thanks to all for looking!

Gregg

Re: Migrating from Windows DHCP to Palo Alto

Manu_P — Wed, 01 Nov 2023 14:30:28 GMT

I would advise against this move.

DHCP is very basic in PanOS, you will miss a number of features (or maybe not)

Also it seems to be quite buggy, especially if you have workstations with vm's running in hyper-v and bridged network setup

i mean, it gets annoying really fast to get some tens or even hundreds of such errors without any workaround except configuring a reservation for that mac-address on a different ip. Only to have the same issue several days later and end up moving that reservation to a completely different IP

Re: Migrating from Windows DHCP to Palo Alto

Raido_Rattameister — Wed, 01 Nov 2023 15:04:43 GMT

Do you have 172.16.30.95 configured statically on some device and not excluded from Palo DHCP pool?

Re: Migrating from Windows DHCP to Palo Alto

Manu_P — Wed, 01 Nov 2023 15:29:59 GMT

Nope, initially i had no reservations at all and that IP address was not in use in that subnet / network segment.

Some day, i start getting this type of messages (ip address already in use).

The only workaround was to assign a static mapping to the offending mac-address. After committing the DHCP reservation, the offending mac-address got the new ip address, and the "old" ip address was not used by other devices (so there was no competition for that IP at the time, but later on it was "snatched" by a different device without any issues)

Then again, days later, same device started to generate the same messages and the workaround was again to change the static mapping to yet another IP.

This happened with several different devices, the only common thing was each of those devices being a w10 machine which was also running hyper-v vm with bridged networking with the host.

Eventually, i ended up adding the DHCP role to a Windows server that was already in place there and never had any issues further on