topic Re: DHCP server relay service down from Palo Alto monitoring in General Topics

DHCP server relay service down from Palo Alto monitoring

Roby_Sreejith — Wed, 27 Jun 2018 13:21:48 GMT

We are using DHCP server relay in Palo Alto provide IPs to network.

We have faced issues aboutpalo alto stopped processing DHCP relay

It was not shown in system logs

It was shown in dhcpd.logs

Warning: pan_dhcpd_cfgagent_initial_config_callback(pan_dhcpd_cfg.c:1902): pan_dhcpd_cfgagent_initial_config() failed

2018-05-13 14:44:35.441 +0200 Sending ALL Bound DHCP Client info to Peer since peer is now passive/susp

2018-05-13 14:44:35.458 +0200 The dataplane has come up

2018-05-13 14:44:35.763 +0200 HA local version 3; local compat 1; peer version 3; peer compat 1

2018-05-14 07:11:37.325 +0200 Warning: pan_hash_init(pan_hash.c:112): nbuckets 100 is not power of 2!

2018-05-14 07:11:37.338 +0200 Warning: pan_hash_init(pan_hash.c:112): nbuckets 100 is not power of 2!

2018-05-14 07:11:43.324 +0200 Warning: pan_hash_init(pan_hash.c:112): nbuckets 100 is not power of 2!

The reboot fixed the issue. However is there any way to monitor if similiar sitaution arrives.

Re: DHCP server relay service down from Palo Alto monitoring

BPry — Wed, 27 Jun 2018 15:25:24 GMT

@Roby_Sreejith,

Has this only happened once or has it been recurring? What PAN-OS are you currently running?

Re: DHCP server relay service down from Palo Alto monitoring

Roby_Sreejith — Tue, 03 Jul 2018 10:01:22 GMT

it happened only once. 7.1.7 is the version

Re: DHCP server relay service down from Palo Alto monitoring

BPry — Wed, 04 Jul 2018 00:57:16 GMT

@Roby_Sreejith

If it's a once and done thing I wouldn't generally worry about it with this error message; sometimes internal processes don't 100% function correctly. If this was something that you ran into more than once then I would probably start worrying about it, but if it's functional now and had been up until this point then you'll likely never really run into it again.

FYI,

I would highly recommend scheduling some time to upgrade this device to the latest 7.1.18 so that you have the latest bug fixes, but more importantly there are a number of known vulnerabilities that you aren't currently patched for.