Is DHCP Logging for lease-start possible

[paulwoolnough]

Hi All,

We have got a captive portal set up for guest access which terminates on our Palo Alto firewalls. To meet our code of connection we need to capture DHCP lease offers but by default this does not seem possible.

DHCP lease ends are sent to the system log under the event lease-end, but to accurately ascertain when users connected to wireless we need to capture the full sequence of events ie. DHCP Offer, Portal Login and subsequent DHCP lease end and Portal session timeout.

The CLI command show dhcp lease all provides information on offered leases so one machanism which has been suggested is to script this to be pulled off the firewall, but this is not ideal.

Any further suggestions would be more than welcome!

Thanks

Paul Woolnough - CCNP, CCDP
ICT Infrastructure Engineer - Networks
University Campus Suffolk

[skrall]

It sounds like yo are using the Paloalto as the DHCP server. Our implementation is rather simple and has very few options. There are no user configurable options other than what you see in the GUI.

Steve Krall

[paulwoolnough]

Hi skrall,  Yes we are using DHCP and by default it sends the lease end to SYSLOG, but most standard implementations also log the DHCP OFFER request also, it must obviously be happening but where does the Palo Alto put it?  Thanks  Paul