topic Re: Different DHCP Subnets on same Interface in General Topics

Different DHCP Subnets on same Interface

rjdahav163 — Thu, 13 Oct 2016 13:42:16 GMT

Hello everyone,

one of my customer has the following specific requirement.

PA500 version 7.1.0

Inside Interface IP: 10.0.1.1/24

Firewall should act as DHCP Server and assign IP Addresses in the following Scopes only via inside interface.

Scope: LAN Devices

Range: 10.0.1.50-10.0.1.100 /24

Gateway: 10.0.1.254

Scope: WAN Devices

Range: 10.0.25.50-10.0.25.100/24

Gateway: 10.0.25.254

Scope: Voice Devices

Range: 10.0.30.50-10.0.30.100/24

Gateway: 10.0.30.254

So the questions are following:

1. Is such a configuration at all possible? The inside interface IP Subnet is different from WAN and Voice Scope.

2. The inside interface on PA is connected to a trunk on a switch and all the traffic to PA is untagged. How can PA differentiate whether the incoming DHCP request is from LAN device, WLAN device or a Voice device?

Thanks and Regards,

Re: Different DHCP Subnets on same Interface

BPry — Thu, 13 Oct 2016 14:20:14 GMT

I believe that the only way to do this properly would be to setup LAN,WAN, and VOICE interfaces on your PA500 and then setup the DHCP for the interface, I believe that you can only have one DHCP scope on any particular interface.

PS. If they are running on 7.1.0 I would upgrade them to 7.1.5 and get the latest code; they have made a lot of bug fixes since 7.1.0.

Re: Different DHCP Subnets on same Interface

TranceforLife — Thu, 13 Oct 2016 14:23:20 GMT

Or you could create a subinterfaces and have a DHCP server configured there for each network

Re: Different DHCP Subnets on same Interface

rjdahav163 — Thu, 13 Oct 2016 18:13:49 GMT

Yeah subinterfaces was my initial thought, but they want that the inside interface has only one IP. For each subinterface I would need one IP from respective subnet each which is not possible 😞

Re: Different DHCP Subnets on same Interface

Ken_Cornetet — Fri, 14 Oct 2016 19:19:37 GMT

How would the DHCP server possibly know which type of device was making the request in order to hand out the correct IP address?

Some DHCP servers have filters where you can use MAC address prefixes to do such things, but as far as I know, the Palo Alto DHCP server doesn't offer this.

Re: Different DHCP Subnets on same Interface

santonic — Mon, 17 Oct 2016 07:12:07 GMT

You said: "The inside interface on PA is connected to a trunk on a switch and all the traffic to PA is untagged"

But trunk always has tagged traffic. Otherwise trunk can't work.

So DHCP requests should arrive with correct VLAN tag and you can use subinterfaces. Actually you must use subinterfaces in this scenario otherwise only untagged (or vlan 1) traffic will be receieved by PA.

Re: Different DHCP Subnets on same Interface

rjdahav163 — Fri, 21 Oct 2016 07:40:47 GMT

This was exactly my argument with the customer. However his typical response is - "Other Firewall manufacturers are able to do that easily why not Palo Alto". 😞