topic Is DHCP Logging for lease-start possible in General Topics

Is DHCP Logging for lease-start possible

paulwoolnough — Thu, 16 Jun 2011 11:02:56 GMT

Hi All,

We have got a captive portal set up for guest access which terminates on our Palo Alto firewalls. To meet our code of connection we need to capture DHCP lease offers but by default this does not seem possible.

DHCP lease ends are sent to the system log under the event lease-end, but to accurately ascertain when users connected to wireless we need to capture the full sequence of events ie. DHCP Offer, Portal Login and subsequent DHCP lease end and Portal session timeout.

The CLI command show dhcp lease all provides information on offered leases so one machanism which has been suggested is to script this to be pulled off the firewall, but this is not ideal.

Any further suggestions would be more than welcome!

Thanks

Paul Woolnough - CCNP, CCDP
ICT Infrastructure Engineer - Networks
University Campus Suffolk

Re: Is DHCP Logging for lease-start possible

skrall — Thu, 16 Jun 2011 22:48:53 GMT

It sounds like yo are using the Paloalto as the DHCP server. Our implementation is rather simple and has very few options. There are no user configurable options other than what you see in the GUI.

Steve Krall

Re: Is DHCP Logging for lease-start possible

paulwoolnough — Fri, 17 Jun 2011 01:28:36 GMT

Hi skrall, Yes we are using DHCP and by default it sends the lease end to SYSLOG, but most standard implementations also log the DHCP OFFER request also, it must obviously be happening but where does the Palo Alto put it? Thanks Paul