topic Palo alto interface DHCP in General Topics

Palo alto interface DHCP

tsepochechile — Fri, 30 May 2025 14:25:28 GMT

I have configured DHCP on 4 interfaces, each DHCP on a different subnet. I connected each Palo alto port to a unique switch with the understanding that all devices connected to particular PA port will get ip addresses only from the corresponding DHCP but unfortunately the ip addresses are leased randomly.

Scenario:

port 1: DHCP pool (192.168.1.10 - 192.168.1.50)

port 2: DHCP pool (192.168.2.10 - 192.168.2.50)

port 3: DHCP pool (192.168.3.10 - 192.168.3.50)

port 4: DHCP pool (192.168.4.10 - 192.168.4.50)

port 5: DHCP pool (192.168.5.10 - 192.168.5.50)

devices on switch that is connected to port 1 get ip addresses from port 5 DHCP.

Re: Palo alto interface DHCP

Raido_Rattameister — Fri, 30 May 2025 19:50:42 GMT

Switches are layer 2 and no ip helper / dhcp forwarding configured in them?

If you connect endpoint directly to Palo port do you still get IP from wrong subnet?

Re: Palo alto interface DHCP

reaper — Mon, 02 Jun 2025 13:59:41 GMT

- make sure your switches are not bridged anywhere / vlans are used properly if you have managed switches

- ensure you're only allowing intrazone dhcp and block interzone dhcp (if your firewall ports are layer2)

- if you set the DHCP mode to AUTO, the DHCP server will disable itself if it finds other DHCP server on the interface network. this may help tracking 'bridges' on the switches

- check your arp/mac table to see if endpoint mac addresses are showing up on multiple interfaces