DHCP Discard session

fatboy1607 — Fri, 09 Dec 2016 10:03:32 GMT

Scenario is we have ISP connected to Outside zone.

DHCP server on Inside Zone.

On Each satellite we have DHCP relay configured to readh DHCP server.

Whenever there is any issue with Power at location where interface connected to inside zone goes down.

Traffic gets routed to Outside zone and inturn gets discarded session as we dont have security policy to allow that traffic.

We have to manually clear that particular session for DHCP to work.

Any suggestions on this issue.

Thanks In Advance.

Re: DHCP Discard session

reaper — Mon, 12 Dec 2016 08:38:13 GMT

sounds like your session discard state is being refreshed (by receiving dhcp packets too frequently) causing the same session to remain in discard state

you can change the discard state timeout:

> show session info

...
--------------------------------------------------------------------------------
Session timeout
  TCP default timeout:                           3600 secs
  TCP session timeout before SYN-ACK received:      5 secs
  TCP session timeout before 3-way handshaking:    10 secs
  TCP half-closed session timeout:                120 secs
  TCP session timeout in TIME_WAIT:                15 secs
  TCP session timeout for unverified RST:          30 secs
  UDP default timeout:                             30 secs
  ICMP default timeout:                             6 secs
  other IP default timeout:                        30 secs
  Captive Portal session timeout:                  30 secs
  Session timeout in discard state:
    TCP: 90 secs, UDP: 60 secs, other IP protocols: 60 secs

you can use this operational command to change the timeout to figure out what is the ideal timeout

admin@myNGFW> set session timeout-discard-udp 
  <value>  <1-15999999> set timeout of udp session in discard state

i would recommend gradually decreasing from the default 60 seconds and not immediately going to the 1 second minumum as there is a good reason the discard state is 60 seconds 😉 )

you can change this timer through configuration once you find the sweet spot

admin@myNGFW> configure 
Entering configuration mode
[edit]                                                                                                                                                                                          
admin@myNGFW# set deviceconfig setting session timeout-discard-udp 
  <value>  <1-15999999> set timeout of udp session in discard state

topic Re: DHCP Discard session in General Topics

DHCP Discard session

Re: DHCP Discard session