DHCP Relay Not working

Question

Hi. I have a XG330 setup to do routing for my Guest network 172.16.100.0/24. I have a relay pointing to my DHCP server however my clients aren't getting any ip addresses. The firewall is plugged into a HP switch and its a trunk port. the vlans are tagged. If i let the switch do the routing the clients get ip addresses but it doesnt look like the firewall relay is working. 
 the guest network is setup as a subinterface on the xg330. any ideas? 
 
 thanks

Alex Riggs · Accepted Answer

I ran into this same issue (getting "Appliance Access" denied on DHCP requests), and this may not be the fix for everyone else, but I spun my wheels on it for hours and finally figured it out. But I seen many questions of this with no answers so I wanted to make sure I shared my findings. 
 I had a DHCP relay set for the same subnet as my actual Windows DHCP server. In my head, I wanted one set for every subnet, but for one, you dont need it in the same subnet anyway. Two, any request sent to that subnet will get looped and Sophos wont know what to do with it. As soon as I deleted the relay that was in the same subnet as the DHCP server, it was fixed. 
 Just for test, I added it back, and could not get a DHCP address anymore. As soon as I removed it again, it worked. 
 Hope this helps someone else! 
 EDIT: In case it helps, I explained this in a little more detail in a blog post I made.. https://moreabout.tech/sophos-xg-firewall-windows-dhcp-server-not-getting-ip-addresses/

sachingurung · Answer

Hi Ahmed, 
 Welcome to Sophos Community. 
 It is not possible to configure a DHCP relay agent on an interface alias. I think the sub interface on XG330 is an alias? 
 Thanks

sachingurung · Answer

Hi Ahmed, 
 If an Alias is configured on an Interface then Relay is not supported. Considering your setup, you have a virtual LAN configured on Port1, which can do relay. In the DHCP relay configuration, you will need to select the Interface where the DHCP will be leased. Is Port1.100 is your listening interface? 
 Thanks

sachingurung · Answer

Hi, 
 I edited my previous response on this thread, please check that and refer the KB article, Sophos Firewall: How to configure firewall as a DHCP Relay . Next, you will need to add a static route to send out the DHCP offer from the directly connected interface as in a DHCP relay scenario there will be an IP address(DHCP server) to which the request packets will be sent. 
 If that doesn't help, please show me picture of configurations and tcpdump logs for port 67, 68. 
 Thanks