Routing question

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Routing question

L0 Member

I might be overlooking something fundamental.


We are trying to slow-step out of another firewall into a PA. I have created an interface on the PA in the old subnet. I can ping across to the server and old firewall.


Clients behind the PA cannot get a DHCP address. I am wondering if trying to maintain the same subnet on a Legacy VLAN will even work.


I am trying to put clients on the old subnet via layer 3 vlan. All the new switches have a static route that point to the PA interface ( The PA VR has a static route to the old firewall ( There is a DHCP relay pointed to the server (lets say I have a rule in place to allow traffic back and forth including security and threat policies. I see no blocks and the old firewall has routes in place for return traffic.


Clients>Layer 2 VLAN on new switches>PA layer 3 interface>old flat network>old firewall(default gateway)


I have pings allowed, but my client on the new switches with layer 2 VLAN cannot get DHCP and cannot communicate with static IP addresses.


I will sleep on this and comb through all configurations in the morning, but was hoping for a sanity check on the overall idea.


Hi @Brad_Teige,

One note you need to remember for PAN DHCP relay is that once FW receive the DHCP request  and try to forward it to the DHCP server this traffic becomes inter-zone. Meaning the DHCP request from interface/zone pointing to the users needs to be forwarded to another interface/zone pointing to DHCP server. For that reason you need to have rule allowing dhcp traffic from one zone to another.

Step2 from this guide -

Above guide define any as destination, I would suggest you to restrict to only your trusted DHCP server.


I would also suggest to try to eliminate DHCP relay issues by:

- Set static IP address one of the problematic machines, try to ping PA FW interface in that network (if don't have interface zone protection ping will fail, but) important part here is to check if you have ARP entry on the laptop for FW IP. Check if you have ARP on FW interface for that laptop. If no ARP you probably have issues with the VLAN config .

- Set a packet capture on PA interface pointing to the users -

Important for the filter is to set : inbound interface, and non-IP include. Leave the capture running and try ipconfig /renew to trigger new DHCP request (don't forget to switch back from static ip to dhcp if you are testing from same laptop)

  • 1 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!