topic Re: DHCP Options in General Topics

DHCP Options

JAG — Tue, 01 Jul 2014 15:00:11 GMT

Hi All,

I need to send DHCP option 119 to my clients that are using the Palo Alto as their DHCP server.

Please can you confirm whether this is possible or not?

Thanks,

Jaggie

Re: DHCP Options

HULK — Tue, 01 Jul 2014 16:06:39 GMT

Hello Jaggie,

As per my understanding, the DHCP Option 119 - Domain Suffix Search Lists are not supported by the PAN OS as of now. There are 2 feature request already submitted for adding more DHCP options into PAN OS as mentioned below:

DHCO OPtions

FR ID-784

Ability to support custom DHCP options within PANOS DHCP Server.

FR ID-2245

I would recommend you to contact with your Palo ALto SE for the same.

Thanks

Re: DHCP Options

GlobalOperations — Mon, 12 Aug 2019 15:23:56 GMT

Hi,

I know this is a 5 year old ticket but does anyone know if Pan OS finally has this capability? It's not working for me. I tried using using ASCII and Hex for option 119 and neither work.

Thanks,
David

Re: DHCP Options

TSilverline — Mon, 12 Aug 2019 17:36:14 GMT

This is certainly supported now.

Can you probide more details on what you would like to do and what's not working?

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/networking/dhcp/dhcp-options/dhcp-options-43-55-and-60-and-other-customized-options.html

Re: DHCP Options

GlobalOperations — Mon, 12 Aug 2019 18:20:43 GMT

Hi,

I have 3 domains that I'd like to add to my dhcp client domain search list. They are internal company domains so I will use the generic ones below for this example.

domaina.com

domainb.com

domainc.com

I'm using my PA850 as a dhcp server.

I added option 119 as a custom option. I first chose the hex value approach and used an ASCII to hex converter to add these domains as comma separated values. This is how it is done on some Cisco devices. That didn't work on my Windows 10 dhcp client. If I do an ipconfig /release and an ipconfig /renew I get my addresses, my multi-value option 6 DNS server list but nothing for domain search list.

I then tried one hex value per line. That did not work.

So I removed the values and reapplied them as ASCII as one per line, not comma separated. That didn't work either. There's no error when I do the commit. Everything is accepted. But the client doesn't pick up the suffix list.

The I tried to use ASCII with the three domains on a single separated by commas. That didn't work.

So I'm at a loss. Any advise you can provide would be appreciated.

Thanks,

David

Re: DHCP Options

GlobalOperations — Mon, 12 Aug 2019 18:21:06 GMT

Also, I'm using PAN OS 8.1.9

Re: DHCP Options

skuo2020 — Fri, 21 Oct 2022 18:06:37 GMT

Has a solution been found?

Re: DHCP Options

DavePalo — Fri, 21 Oct 2022 21:33:35 GMT

I've seen similar problems on non-PA systems.

Sometimes the option 119 strings need to be encoded.

Please see links below. Apologies if you have already tried these.

Domain search list DHCP option encoder (jjjordan.github.io)

Adding DHCP Option 119 (Domain Search List) to Windows Server 2008 R2 | Black Marble

I believe that there are other ways of encoding too. Unfortunately I've not tried to do this on our PAs.

Re: DHCP Options

mivaldi — Tue, 24 Jan 2023 01:44:15 GMT

Documented the solution in a Knowledge Base Article:

How to implement DHCP Option 119 (Domain Search List) in a Palo Alto Networks firewall