Log entry: DHCP server auto-probe finished

[santonic]

Hello.

At a customer DHCP server has suddenly stopped working. Log entry shows following info:

Type: dhcp

Severity: informational

Event: server-auto-probe-off

Description: DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface ethernet1/x

I was looking for event info but I couldn't find System Log document for PanOS 5.0 and such event doesn't exist in System Log document for PanOS 4.1.

Can anyone provide info about auto-probe service for DHCP? Any info what does this event mean?

I'm assuming that auto-probe service shut down the DHCP server because it received DHCP offer on this interface and assumed there is another DHCP server present for that network.

Best regards,

Simon

[Ameya-Kawimandan · Accepted solution]

Palo Alto Networks firewalls have been designed to perform an Auto-Probe/Auto-Discovery when a DHCP server is configured in auto mode. The auto-probing detects existing DHCP servers in the same subnet. When another DHCP server is detected in the subnet, the firewall will shut down DHCP services and the other DHCP would gain/retain control.

Note: Auto-Probing cannot be turned-off and should not be mistaken for the "probe-ip" feature.

When the DHCP server in auto mode on the Palo Alto Networks firewall stops working due to the discovery of another DHCP server, the  following message will appear in the System Log :

DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface <DHCP Server Interface>

[santonic]

Thanx for confirmation and clarification. I tried searching for an answer before posting but your post never came up.

[Ameya-Kawimandan]

This information was not posted earlier  ,I will post this as a knowledge base article.

Regards,

AK

[santonic]

This document: https://live.paloaltonetworks.com/docs/DOC-4821

Says it was created by you on March 22nd? Definitely useful info.