topic Re: DHCP Relay and server issue on Active cluster member in Firewall and Security Management

DHCP Relay and server issue on Active cluster member

Alex- — Mon, 15 Apr 2024 15:25:55 GMT

R81.10 Take 130

Since the environment was upgraded from 5000 to 6000 appliances recently, we faced twice the issue that all DHCP services stopped working suddenly with the symptoms seen in sk158974 which is an old SK not relevant anymore if we trust the affected versions.

The appliances are configured with a mix of DHCP relay and server along with the new services as it has been for years.

Additionally, /var/log/messages shows that DHCP requests arrived on interface X and dhcpd.conf should be edited to allow DHCP on that interface.

The workaround is to failover which immediately solves the issue, reboot the appliance and go from there.

We will open an SR, maybe this issue has been seen by some CheckMates.

Re: DHCP Relay and server issue on Active cluster member

PhoneBoy — Mon, 15 Apr 2024 15:42:11 GMT

Seems like a potential issue with the newer DHCP enforcement logic.
The SK documents a workaround to the issue, but to properly fix it, we'll need debugs and such.

Re: DHCP Relay and server issue on Active cluster member

Lesley — Mon, 15 Apr 2024 19:55:37 GMT

The appliances are configured with a mix of DHCP relay and server along with the new services as it has been for years.

This is a trigger for me. Fix this part, remove the old services from the rulebase and move over to new services only.

The 'it worked for many years' argument is invalid especially after an upgrade of the system.

I don't see a reason not to change it to new services.

Re: DHCP Relay and server issue on Active cluster member

Alex- — Mon, 15 Apr 2024 20:20:59 GMT

To be clear, I meant they have both DHCP Relay and Servers at the Gaia level.

The rule base has new services only.

Re: DHCP Relay and server issue on Active cluster member

Lesley — Mon, 15 Apr 2024 20:43:00 GMT

Ahh check, does relay break or server, or both?

Able to share screenshot of rulebase and GAIA config?

They should work of course both together that should not be an issue.