Log entry: DHCP server auto-probe finished

[santonic]

Hello.

At a customer DHCP server has suddenly stopped working. Log entry shows following info:

Type: dhcp

Severity: informational

Event: server-auto-probe-off

Description: DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface ethernet1/x

I was looking for event info but I couldn't find System Log document for PanOS 5.0 and such event doesn't exist in System Log document for PanOS 4.1.

Can anyone provide info about auto-probe service for DHCP? Any info what does this event mean?

I'm assuming that auto-probe service shut down the DHCP server because it received DHCP offer on this interface and assumed there is another DHCP server present for that network.

Best regards,

Simon

[UhMayYeah · Accepted solution]

Palo Alto Networks firewalls have been designed to perform an Auto-Probe/Auto-Discovery when a DHCP server is configured in auto mode. The auto-probing detects existing DHCP servers in the same subnet. When another DHCP server is detected in the subnet, the firewall will shut down DHCP services and the other DHCP would gain/retain control.

Note: Auto-Probing cannot be turned-off and should not be mistaken for the "probe-ip" feature.

When the DHCP server in auto mode on the Palo Alto Networks firewall stops working due to the discovery of another DHCP server, the  following message will appear in the System Log :

DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface <DHCP Server Interface>

[santonic]

Thanx for confirmation and clarification. I tried searching for an answer before posting but your post never came up.

[UhMayYeah]

This information was not posted earlier  ,I will post this as a knowledge base article.

Regards,

AK

[santonic]

This document: https://live.paloaltonetworks.com/docs/DOC-4821

Says it was created by you on March 22nd? Definitely useful info.

[K.Kadow]

This doesn't match up with my experience. Once auto-probe starts up the DHCP service (no other DHCP servers seen), it appears that the firewall stops probing, and even if the other DHCP servers come back, the firewall DHCP server does NOT stop running. The only way (short of a reboot) I was able to get the DHCP server to go back to auto-probe after "turn on DHCP server since no offer received" was to use the command-line to force the server off and then back to auto:

configure
set network dhcp interface ethernet1/2 server mode disabled
commit
set network dhcp interface ethernet1/2 server mode auto
commit
exit 

I've seen this behavior on a PA-200 with v6.1.5 and after upgrading to 7.0.4