DHCP trough the PA

[Eleven]

Hi all,

I'm having a question about allowing DHCP trough the PA firewall.

The issue I have is the following.

- We have a PA deployed between LAN, Internet and WAN

- The LAN has a L3 switch, that performes inter VLAN routing, and uses a transit subnet and a default route to the PA

- DHCP relay is configured on the L3 switch, pointing to the DHCP server

- The DHCP server lives on the WAN

- When I have the LAN and WAN interfaces in the same security zone all is well and DHCP works just fine

- When I move the WAN interface to a new security zone, and configure 2 firewall rules 'permit any to WAN from LAN'  and 'permit any from LAN to WAN', DHCP stops working.

No information is visible in the traffic log about DHCP being blocked

Is it possible that the PA can't handle this between 2 security zones and requires DHCP relay to be configured on the PA as well?

[TranceforLife]

As soon as your L3 Switch relay the DHCP broadcast it sends a unicast out to the DHCP Server. So relay should only be configured once at your local Layer 3 boundary. What PAN-OS you currently on? Can you please also override default deny policy enabling logging?

[BPry]

You need to actually allow the traffic to traverse security zones is all. Enable logging on the default inerzone-default rule and see what's actually being blocked. You'll need a new security policy to allow the dhcp request to actually go to your dhcp server.