Log entry: DHCP server auto-probe finished

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Log entry: DHCP server auto-probe finished

L6 Presenter

Hello.

At a customer DHCP server has suddenly stopped working. Log entry shows following info:

Type: dhcp

Severity: informational

Event: server-auto-probe-off

Description: DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface ethernet1/x

I was looking for event info but I couldn't find System Log document for PanOS 5.0 and such event doesn't exist in System Log document for PanOS 4.1.

Can anyone provide info about auto-probe service for DHCP? Any info what does this event mean?

I'm assuming that auto-probe service shut down the DHCP server because it received DHCP offer on this interface and assumed there is another DHCP server present for that network.

Best regards,

Simon

1 accepted solution

Accepted Solutions

L5 Sessionator

Palo Alto Networks firewalls have been designed to perform an Auto-Probe/Auto-Discovery when a DHCP server is configured in auto mode. The auto-probing detects existing DHCP servers in the same subnet. When another DHCP server is detected in the subnet, the firewall will shut down DHCP services and the other DHCP would gain/retain control.

Note: Auto-Probing cannot be turned-off and should not be mistaken for the "probe-ip" feature.

When the DHCP server in auto mode on the Palo Alto Networks firewall stops working due to the discovery of another DHCP server, the  following message will appear in the System Log :

DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface <DHCP Server Interface>

View solution in original post

5 REPLIES 5

L5 Sessionator

Palo Alto Networks firewalls have been designed to perform an Auto-Probe/Auto-Discovery when a DHCP server is configured in auto mode. The auto-probing detects existing DHCP servers in the same subnet. When another DHCP server is detected in the subnet, the firewall will shut down DHCP services and the other DHCP would gain/retain control.

Note: Auto-Probing cannot be turned-off and should not be mistaken for the "probe-ip" feature.

When the DHCP server in auto mode on the Palo Alto Networks firewall stops working due to the discovery of another DHCP server, the  following message will appear in the System Log :

DHCP server auto-probe finished, turn off DHCP server since received offer from server 255.255.255.255 interface <DHCP Server Interface>

Thanx for confirmation and clarification. I tried searching for an answer before posting but your post never came up.

This information was not posted earlier  ,I will post this as a knowledge base article.

Regards,

AK

This document: https://live.paloaltonetworks.com/docs/DOC-4821

Says it was created by you on March 22nd? Definitely useful info.

L1 Bithead

This doesn't match up with my experience. Once auto-probe starts up the DHCP service (no other DHCP servers seen), it appears that the firewall stops probing, and even if the other DHCP servers come back, the firewall DHCP server does NOT stop running. The only way (short of a reboot) I was able to get the DHCP server to go back to auto-probe after "turn on DHCP server since no offer received" was to use the command-line to force the server off and then back to auto:

configure
set network dhcp interface ethernet1/2 server mode disabled
commit
set network dhcp interface ethernet1/2 server mode auto
commit
exit 

I've seen this behavior on a PA-200 with v6.1.5 and after upgrading to 7.0.4

  • 1 accepted solution
  • 4356 Views
  • 5 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!