topic Re: DHCP trough the PA in General Topics

DHCP trough the PA

Eleven — Tue, 27 Jun 2017 12:21:43 GMT

Hi all,

I'm having a question about allowing DHCP trough the PA firewall.

The issue I have is the following.

- We have a PA deployed between LAN, Internet and WAN

- The LAN has a L3 switch, that performes inter VLAN routing, and uses a transit subnet and a default route to the PA

- DHCP relay is configured on the L3 switch, pointing to the DHCP server

- The DHCP server lives on the WAN

- When I have the LAN and WAN interfaces in the same security zone all is well and DHCP works just fine

- When I move the WAN interface to a new security zone, and configure 2 firewall rules 'permit any to WAN from LAN' and 'permit any from LAN to WAN', DHCP stops working.

No information is visible in the traffic log about DHCP being blocked

Is it possible that the PA can't handle this between 2 security zones and requires DHCP relay to be configured on the PA as well?

Re: DHCP trough the PA

TranceforLife — Tue, 27 Jun 2017 12:55:02 GMT

As soon as your L3 Switch relay the DHCP broadcast it sends a unicast out to the DHCP Server. So relay should only be configured once at your local Layer 3 boundary. What PAN-OS you currently on? Can you please also override default deny policy enabling logging?

Re: DHCP trough the PA

BPry — Tue, 27 Jun 2017 16:11:37 GMT

You need to actually allow the traffic to traverse security zones is all. Enable logging on the default inerzone-default rule and see what's actually being blocked. You'll need a new security policy to allow the dhcp request to actually go to your dhcp server.