topic Re: DHCP Relay in General Topics

DHCP Relay

bschaper — Wed, 28 Jul 2021 17:02:42 GMT

I have a strange intermittent problem with DHCP relay. I have it setup on all our firewalls, PA-220, and they relay to servers in the data center (Windows 2016). At some point the relay stops sending offers. I can see the discovery packet and no offer after. The firewalls connect to a Cisco 2960 switch, nothing crazy on the config. It works then suddenly stops. I can resolve the issue two ways and neither help me isolate the problem.

1. I can reboot the switch

2. I can remove and reapply the DHCP relay settings to the firewall (PA-220 so that takes a bit)

Anyone seen a similar problem or suggests on the switch config I may be missing?

Re: DHCP Relay

Mick_Ball — Wed, 28 Jul 2021 17:14:46 GMT

Can you do a doodle... not sure where the switch is in the equation or where the users and dhcp server sit...

Where are you seeing the discover... on th palo or windoze box... perhaps wireshark the server to see if it is replying....

is the switch layer 2 or are you using ip helper...

more info may be helpful here ...

Re: DHCP Relay

bschaper — Wed, 28 Jul 2021 18:03:21 GMT

Hi Mick, here is the diagram. The site uses SDWAN and connects to a PA-3220 at the data center. The PANOS Version is 10.0.2. Now the switch does not have IP helper on it, but it does not have routing services either. All of this worked fine until recently and does not seem to correlate to a PANOS version either. I am at a loss as to why rebooting the switch would work and removing the relay and re-adding works as well. It has worked fine for years, until the last couple months. The packet capture was from the workstation, but the plan next time is run it from the firewall as well.

Re: DHCP Relay

Mick_Ball — Thu, 29 Jul 2021 06:02:22 GMT

Not sure what it could be, perhaps for some reason the traffic is getting NAT and server not recognising scope and perhaps interface change of state on relay palo is resetting policy...

it seems simple enough as switch on relay side is just layer 2. I would capture trusted int on relay palo when broken to see if cisco is doing something odd... if broadcast is seen for dhcp then do the same on server palo interface. Probably teaching you to suck eggs here..... good luck...

Re: DHCP Relay

lfraij — Wed, 21 Aug 2024 21:06:14 GMT

I have the exact same issue , what was your fix ?

Re: DHCP Relay

bschaper — Wed, 21 Aug 2024 21:28:32 GMT

So honestly I am not sure I remember the solution, and it was many versions ago. But the bottom line of the problem was basically stale sessions, so I would clear the Dns sessions. What version of PANOS are you running? I will check my notes as well.

Re: DHCP Relay

lfraij — Wed, 21 Aug 2024 21:34:45 GMT

please try to remember , I have 11.0.2-h4 for the SD-Wan Branches , 10.2.7-h6 for the hub , and Cisco 9200 switches

Re: DHCP Relay

bschaper — Wed, 21 Aug 2024 21:42:50 GMT

I will. I know in the long run we moved away from dhcp servers and placed dhcp on the firewalls. It was part of longer term goals anyways.