CAUTION when configuring DHCP options

Gregory_Muller — Mon, 15 Mar 2021 10:25:49 GMT

Hello community,

for my first post, I would like to share with you my experience concerning the DHCP option configuration.
According to sk92473, after configuring the range via the Gaia clish (that will automatically populate the /etc/dhcpd.conf file), I manually edited the /etc/dhcpd.conf file in order to add the specific option.
I finally locked the DHCP configuration file (setting the immutable status) in order to avoid configuration override.

But, some time after I tried to configure a new range, forgotting to unset the "immutable" attribute on this file.
Even if I didn't received any error message from the Gaia clish when setting this new range, we hit an unexpected DHCP daemon behaviour.

Since the file was "locked", the Gaia daemon was not able to update the /etc/dhcpd.con file.
Moreover, the DHCP daemon unexpectedly stopped to listen on UDP67 on all interfaces) :
[Expert@GW01:0]# netstat -anu | grep 67
udp 0 0 <relay_interface_IP>:67 0.0.0.0:*
udp 0 0 255.255.255.255:67 0.0.0.0:*

Instead of having the following (before the change) :
[Expert@GW01:0]# netstat -anu | grep 67
udp 0 0 <relay_interface_IP>:67 0.0.0.0:*
udp 0 0 255.255.255.255:67 0.0.0.0:*
udp 0 0 0.0.0.0:67 0.0.0.0:*
udp 0 0 0.0.0.0:67 0.0.0.0:*
udp 0 0 0.0.0.0:67 0.0.0.0:*

When I remembered I set the immutable attribute, and in order to make it work back correctly, I did the following :
- removed the Gaia DHCP new configuration
- removed the immutable attribute
- disabled the DHCP (using Gaia clish) (at this time I lost the specific option configured manually, the file has been overriden by Gaia mechanism)
- configured the DHCP new range
- added the DHCP option manually again
- set the immutable attribute

Is there anyone that also met this kind of issue ?
May I ask Checkpoint (as an RFE) to add the option configuration directly in Gaia in order to avoid this misconfiguration issue ?

Thank you very much,

Kind regards,

Greg

topic CAUTION when configuring DHCP options in Firewall and Security Management

CAUTION when configuring DHCP options