topic Re: DHCP Server on Palo Alto in General Topics

DHCP Server on Palo Alto

Denis — Sun, 16 Apr 2017 17:28:56 GMT

The DHCP server on Palo Alto does not clear the Expired sessions, its stays and we have to manually go and clear the sessions.

Can you please help.

Re: DHCP Server on Palo Alto

BPry — Mon, 17 Apr 2017 13:32:45 GMT

@Denis,

Can you elaborate on the model and firmware version you are running. It appears that on older software versions this was/is a semi regular issue.

Re: DHCP Server on Palo Alto

bradk14 — Mon, 17 Apr 2017 18:46:38 GMT

I have the same issue on 8.0.1

Re: DHCP Server on Palo Alto

Denis — Mon, 17 Apr 2017 19:08:51 GMT

Model is PA-500

Software Version is 7.1.7

Re: DHCP Server on Palo Alto

Denis — Mon, 17 Apr 2017 19:11:54 GMT

Did anyone from palo alto support revert back to you on this issue. I've raised a support ticket and waiting for the to revert back.

Re: DHCP Server on Palo Alto

bradk14 — Mon, 17 Apr 2017 19:24:50 GMT

I never reported it. I suppose I should, but I just sort of accepted it for what it was. There's a lot about the DHCP server that I don't care for. It seems like an afterthought, but it's really not even the primary function of the firewall, so I cut it some slack in that respect.

Re: DHCP Server on Palo Alto

Denis — Mon, 17 Apr 2017 19:27:50 GMT

For us its critical as we've used it as the DHCP for all our WIFI's so its quiete inconvinient after each hour to manually clear ou the expired sessions.

hoping to find some solution or workaround to this...

Re: DHCP Server on Palo Alto

BPry — Mon, 17 Apr 2017 19:52:05 GMT

You wouldn't actually need to do so manually as the request can be scripted with relative ease. Not that it fixes the issue but it can clear the expired sessions on a set schedule.

Re: DHCP Server on Palo Alto

Denis — Mon, 17 Apr 2017 19:54:19 GMT

Can you show me how to schedule the clear expired sessions. Powershell or Windows task scheduler

I've done the script but need to paste it each time on browser

Re: DHCP Server on Palo Alto

BPry — Mon, 17 Apr 2017 21:09:27 GMT

[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$wc = New-Object System.Net.WebClient
$src=$wc.DownloadString("https://MGMTIP/api/?type=commit&cmd=<commit></commit>&key=APIKEY")

Replace the address with whatever you are pasting into your browser currently; make sure that you are utilizing the API key as you won't be authenticated if you don't.

Re: DHCP Server on Palo Alto

BPry — Mon, 17 Apr 2017 21:16:03 GMT

@Denis

Specifically it would look like the following if I didn't specify an interface; then you just need to schedule it with task sheduler to actually run the powershell command at a set interval.

$netAssembly = [Reflection.Assembly]::GetAssembly([System.Net.Configuration.SettingsSection])

if($netAssembly)
{
$bindingFlags = [Reflection.BindingFlags] "Static,GetProperty,NonPublic"
$settingsType = $netAssembly.GetType("System.Net.Configuration.SettingsSectionInternal")

$instance = $settingsType.InvokeMember("Section", $bindingFlags, $null, $null, @())

    if($instance)
    {
        $bindingFlags = "NonPublic","Instance"
        $useUnsafeHeaderParsingField = $settingsType.GetField("useUnsafeHeaderParsing", $bindingFlags)

        if($useUnsafeHeaderParsingField)
        {
          $useUnsafeHeaderParsingField.SetValue($instance, $true)
        }
    }
}
$OutputFile = "$($env:USERPROFILE)\Desktop\CommandStatus.xml"
[System.Net.ServicePointManager]::ServerCertificateValidationCallback = {$true}
$wc = New-Object System.Net.WebClient
$src=$wc.DownloadString("https://10.191.136.7/api/?type=op&cmd=<clear><dhcp><lease><all><expired-only></expired-only></all></lease></dhcp></clear>&key=REPLACEWITHYOURKEY| Out-File $OutputFile