XG-multiple DHCP release/renews within 1-2seconds from same computers

Hi Art,

STOP and Restart the DHCP services from System Services | Services | DHCP. A tcpdump on port 67 and 68 might help us to get some insight about this issue. To do a tcpdump capture, please refer to, Sophos Firewall: How to monitor packet flow using the CLI.

Thanks

Sachin,

I saw this issue in other thread from other people. I think it is a bug when a particular condition is matched.

My lease time is 1440 minutes.

See screenshot.

Can you investigate more in depth on this issue? if you need log, let us know!

Thanks.

I will require some information:

1. What is configured on IP 192.168.0.9? Is there any other device, which is configured to request the same IP address in static mode?

2. Do you face this issue only for this IP address?

3. Any MAC-IP Bind configuration? 

4. Please attach a screenshot of the configured DHCP Server in your XG Firewall.

5. Please share the links to similar threads on this matter.

Thanks

I will require some information:

1. What is configured on IP 192.168.0.9? Is there any other device, which is configured to request the same IP address in static mode?

2. Do you face this issue only for this IP address?

3. Any MAC-IP Bind configuration? 

4. Please attach a screenshot of the configured DHCP Server in your XG Firewall.

5. Please share the links to similar threads on this matter.

Thanks

Sachin,

thank you for your answer.

1. iPhone. No static devices are used on this network. MAC, Printer and AP get the IP from XG but they do not have this issue
2. It occurs only with this IP
3. MAC bind is in place
4. 
5. https://community.sophos.com/products/xg-firewall/f/126/t/73932

Hi,

Thanks for the information.

I sense this issue is related with iPhone. 

I will update you once I reproduce the incident in our Labs.

Thanks

Sachin

Hi lferrara,

Greetings.

I would like you to check if Spoof Prevention is enabled in XG? You can check this from System > System Services >DoS & Spoof Protection.

PFA screenshot,

De-select Spoof Prevention and monitor the scenario.

Thank you Sachin.

Spoof protection is already disabled.

Hi,

I have tested this in our lab and the issue doesn't seem to appear at our end.  The renew logs appear when I disconnected my iPhone and reconnect it back. PFA screenshot.

Thanks

I ran into something similar on an XG115 and an AP55C.  Wireless clients on the Guest would have their IP renew ever 1 second.  While Spoof Prevention was off, the DoS Flags were enabled and once I disabled them everything started working.