topic quick question about bootp in Firewall and Security Management

quick question about bootp

Jerry — Tue, 26 Mar 2019 15:10:46 GMT

hi chaps

quick question:

when you do bootp, you change your "relay-to" IP address and ...

do you really have to push FW policy even though you've made already "save config" with immediate effect on Gaia?

I found this little bit odd but it turnes out that Install Policy (via SC) is really not needed at all.

Just wanted to make sure you've had similar things on your side in a past. Some people claim that whatever you chage via clish/shell or gaia you need to "push" from SC - I strongly disagreed to that knowing that routing require that "push" but dhcp-relay not necessarily.

what do you think?

Re: quick question about bootp

PhoneBoy — Tue, 26 Mar 2019 18:04:51 GMT

Certainly for a new bootp/dhcp relay configuration, a policy install makes sense. Changing the "relay to" IP, not 100% sure on that.

Re: quick question about bootp

Maarten_Sjouw — Tue, 26 Mar 2019 19:06:28 GMT

When you setup your policy properly, in DHCP relay youhave a rule allowing the gateway to send the DHCP requests to the DHCP server, so when that server IP changes, the rule changes as well.
So as long as you don have a rule that will allow the traffic anyway, you should indeed push policy with the updated DHCP server.

Re: quick question about bootp

JozkoMrkvicka — Tue, 26 Mar 2019 20:24:32 GMT

In case everything is already allowed within rulebase (new relay-to IP), there is no need to install policy. Tested. Confirmed.

The best is to have all DHCP servers in 1 group.

In case some new DHCP server is needed, just add the new host (or network) to this particular group and push the policy.
Another case is new VLAN and DHCP on top of this new VLAN. In case you are creating new VLAN together with bootp, policy push is still needed (to fetch Primary Address).